rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-4980 Cross-site Scripting (XSS) - Generic in librenms/librenms
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: librenms
product: librenms/librenms
Published: 2023-09-15T00:00:42.319Z
CVE-2023-4981 Cross-site Scripting (XSS) - DOM in librenms/librenms
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: librenms
product: librenms/librenms
Published: 2023-09-15T00:00:42.509Z
CVE-2023-4982 Cross-site Scripting (XSS) - Stored in librenms/librenms
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: librenms
product: librenms/librenms
Published: 2023-09-15T00:00:50.054Z
CVE-2023-4983 app1pro Shopicial search cross site scripting
A vulnerability was found in app1pro Shopicial up to 20230830. It has been declared as problematic. This vulnerability affects unknown code of the file search. The manipulation of the argument from with the input comments</script>'"><img src=x onerror=alert(document.cookie)> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239794 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: app1pro
product: Shopicial
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: Stux (VulDB User)
Published: 2023-09-15T13:31:05.366Z
CVE-2023-4984 didi KnowSearch 1 credentials storage
A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/admin/v3/security/user/1. The manipulation leads to unprotected storage of credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239795.
Problem types: cwe_id: CWE-256
description: CWE-256 Unprotected Storage of Credentials
Affected products: vendor: didi
product: KnowSearch
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: gaogaostone (VulDB User)
Published: 2023-09-15T13:31:06.947Z
CVE-2023-4985 Supcon InPlant SCADA Project.xml improper authentication
A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901. Affected is an unknown function of the file Project.xml. The manipulation leads to improper authentication. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239796. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Supcon
product: InPlant SCADA
CVSS v3.1: version: 3.1
baseScore: 5.9
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Published: 2023-09-15T14:00:10.223Z
CVE-2023-4986 Supcon InPlant SCADA Project.xml unknown vulnerability
A vulnerability classified as problematic was found in Supcon InPlant SCADA up to 20230901. Affected by this vulnerability is an unknown functionality of the file Project.xml. The manipulation leads to password hash with insufficient computational effort. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-239797 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-916
description: CWE-916 Password Hash With Insufficient Computational Effort
Affected products: vendor: Supcon
product: InPlant SCADA
CVSS v3.1: version: 3.1
baseScore: 2.5
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Credits: lang: en
value: 01dgu0 (VulDB User)
Published: 2023-09-15T14:31:04.464Z
CVE-2023-4987 infinitietech taskhub GET Parameter get_tasks_list sql injection
A vulnerability, which was classified as critical, has been found in infinitietech taskhub 2.8.7. Affected by this issue is some unknown functionality of the file /home/get_tasks_list of the component GET Parameter Handler. The manipulation of the argument project/status/user_id/sort/search leads to sql injection. VDB-239798 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: infinitietech
product: taskhub
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: skalvin (VulDB User)
Published: 2023-09-15T14:31:05.555Z
CVE-2023-4988 Bettershop LaikeTui unrestricted upload
A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?module=system&action=uploadImg. The manipulation of the argument imgFile leads to unrestricted upload. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-239799.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: Bettershop
product: LaikeTui
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: yuanshen (VulDB User)
Published: 2023-09-15T15:00:09.019Z
CVE-2023-4990 
Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: MCL Technologies
product: MCL-Net
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2023-10-11T07:46:22.593Z
CVE-2023-4991 NextBX QWAlerter QWAlerter.exe unquoted search path
A vulnerability was found in NextBX QWAlerter 4.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file QWAlerter.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. The identifier of this vulnerability is VDB-239804. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path
Affected products: vendor: NextBX
product: QWAlerter
CVSS v3.1: version: 3.1
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseSeverity: HIGH
Credits: lang: en
value: _Phx (VulDB User)
Published: 2023-09-15T15:31:05.016Z
CVE-2023-4993 Sensetive Data Exposure in Utarit's Soliclub
Incorrect Use of Privileged APIs vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users.

This issue affects SoliPay Mobile App: before 5.0.8.
Problem types: cwe_id: CWE-648
description: CWE-648 Incorrect Use of Privileged APIs
Affected products: vendor: Utarit Information Technologies
product: SoliPay Mobile App
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Credits: lang: en
value: Mustafa Anıl YILDIRIM
Published: 2024-02-15T15:40:24.532Z
CVE-2023-4994 Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode
The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: hit-reach
product: Allow PHP in Posts and Pages
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
baseScore: 9.9
baseSeverity: CRITICAL
Credits: lang: en
value: István Márton
Published: 2023-09-16T01:52:17.856Z
CVE-2023-4995 Embed Calendly <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: turn2honey
product: EMC – Easily Embed Calendly Scheduling
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-10-13T12:44:49.343Z
CVE-2023-4996 Local privilege escalation 
Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceController did not validate the permissions associated with the user before executing the user control code. This user control code had permissions to terminate the NSClient service. 

Problem types: cwe_id: CWE-281
description: CWE-281 Improper Preservation of Permissions
Affected products: vendor: Netskope
product: Netskope Client
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Netskope credits Alexander Katziv from Novartis for reporting this flaw.
Published: 2023-11-06T10:16:06.626Z
CVE-2023-4997 Improper authorisation in Uptime DC
Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users including administrators leading to a privilege escalation.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: ProIntegra S.A.
product: UptimeDC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Antoni Kwietniewski (Alior Bank)
Published: 2023-10-04T10:54:27.047Z
CVE-2023-4999 Horizontal scrolling announcement <= 9.2 -  Authenticated (Subscriber+) SQL Injection via Shortcode
The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-scrolling] shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: gopiplus
product: Horizontal scrolling announcement
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-10-20T07:29:29.706Z
CVE-2023-50000 
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-50001 
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-50002 
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-50007 
FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2023-50008 
FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2023-50009 
FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2023-50010 
FFmpeg v.n6.1-3-g466799d4f5 allows a buffer over-read at ff_gradfun_blur_line_movdqa_sse2, as demonstrated by a call to the set_encoder_id function in /fftools/ffmpeg_enc.c component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2023-50011 
PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-50015 
An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-09T00:00:00.000Z
CVE-2023-50017 
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-50019 
An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm_UECM_Registration response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-02T00:00:00.000Z
CVE-2023-50020 
An issue was discovered in open5gs v2.6.6. SIGPIPE can be used to crash AMF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-02T00:00:00.000Z
CVE-2023-50026 
SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and before, allows remote attackers to escalate privileges and obtain sensitive information via the method HsAccessoriesGroupProductAbstract::getAccessoriesByIdProducts().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2023-50027 
SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-05T00:00:00.000Z
CVE-2023-50028 
In the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a guest can perform SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2023-50029 
PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2023-50030 
In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions <= 1.1.0. The method `JmsSetting::getSecondImgs()` has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a blind SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2023-50035 
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-29T00:00:00.000Z
CVE-2023-50038 
There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-28T00:00:00.000Z
CVE-2023-50044 
Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50053 
An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce (random number)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-30T00:00:00.000Z
CVE-2023-50059 
An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed message lacks a nonce (random number)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-30T00:00:00.000Z
CVE-2023-50061 
PrestaShop Op'art Easy Redirect >= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2023-50069 
WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker's file, and the result will render on the Matched page in the Body area, resulting in the execution of the payload. This occurs because the response body is not validated or sanitized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-29T00:00:00.000Z
CVE-2023-50070 
Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-29T00:00:00.000Z
CVE-2023-50071 
Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-29T00:00:00.000Z
CVE-2023-50072 
A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-13T00:00:00.000Z
CVE-2023-50073 
EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-50082 
Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-04T00:00:00.000Z
CVE-2023-50089 
A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP for SOAP authentication, command execution occurs during the process after successful authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-15T00:00:00.000Z
CVE-2023-50090 
Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-03T00:00:00.000Z
CVE-2023-50092 
APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-03T00:00:00.000Z
CVE-2023-50093 
APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-03T00:00:00.000Z
CVE-2023-50094 
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-01T00:00:00.000Z