rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-49182 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Marzocca List all posts by Authors, nested Categories and Titles allows Reflected XSS.This issue affects List all posts by Authors, nested Categories and Titles: from n/a through 2.7.10.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Fabio Marzocca
product: List all posts by Authors, nested Categories and Titles
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Skalucy (Patchstack Alliance)
Published: 2023-12-15T14:52:08.191Z
CVE-2023-49183 WordPress NextScripts Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NextScripts NextScripts: Social Networks Auto-Poster allows Reflected XSS.This issue affects NextScripts: Social Networks Auto-Poster: from n/a through 4.4.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: NextScripts
product: NextScripts: Social Networks Auto-Poster
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Le Ngoc Anh (Patchstack Alliance)
Published: 2023-12-15T14:54:38.275Z
CVE-2023-49184 WordPress Parallax Slider Block Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Parallax Slider Block allows Stored XSS.This issue affects Parallax Slider Block: from n/a through 1.2.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: WPDeveloper
product: Parallax Slider Block
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: emad (Patchstack Alliance)
Published: 2023-12-15T14:56:35.899Z
CVE-2023-49185 WordPress Doofinder for WooCommerce Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder WP & WooCommerce Search allows Reflected XSS.This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.1.7.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Doofinder
product: Doofinder WP & WooCommerce Search
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Phd (Patchstack Alliance)
Published: 2023-12-15T14:59:27.925Z
CVE-2023-49186 WordPress Machic Core plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS.This issue affects Machic Core: from n/a through 1.2.6.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: KlbTheme
product: Machic Core
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: RE-ALTER | Patchstack Bug Bounty Program
Published: 2026-01-05T13:27:52.015Z
CVE-2023-49187 WordPress Adifier System Plugin < 3.1.4 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allows Reflected XSS.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Spoonthemes
product: Adifier - Classified Ads WordPress Theme
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: FearZzZz (Patchstack Alliance)
Published: 2023-12-15T15:02:17.908Z
CVE-2023-49188 WordPress Track Geolocation Of Users Using Contact Form 7 Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.This issue affects Track Geolocation Of Users Using Contact Form 7: from n/a through 2.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ZealousWeb
product: Track Geolocation Of Users Using Contact Form 7
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: DoYeon Park / p6rkdoye0n (Patchstack Alliance)
Published: 2023-12-15T15:05:27.588Z
CVE-2023-49189 WordPress Social Share Buttons & Analytics Plugin – GetSocial.io Plugin <= 4.3.12 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Getsocial, S.A. Social Share Buttons & Analytics Plugin – GetSocial.Io allows Stored XSS.This issue affects Social Share Buttons & Analytics Plugin – GetSocial.Io: from n/a through 4.3.12.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Getsocial, S.A.
product: Social Share Buttons & Analytics Plugin – GetSocial.io
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: DoYeon Park / p6rkdoye0n (Patchstack Alliance)
Published: 2023-12-15T15:08:01.376Z
CVE-2023-49190 WordPress Site Offline Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chandra Shekhar Sahu Site Offline Or Coming Soon Or Maintenance Mode allows Stored XSS.This issue affects Site Offline Or Coming Soon Or Maintenance Mode: from n/a through 1.5.6.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Chandra Shekhar Sahu
product: Site Offline Or Coming Soon Or Maintenance Mode
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: emad (Patchstack Alliance)
Published: 2023-12-15T15:10:56.818Z
CVE-2023-49191 WordPress GDPR Cookie Consent by Supsystic Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored XSS.This issue affects GDPR Cookie Consent by Supsystic: from n/a through 2.1.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Supsystic
product: GDPR Cookie Consent by Supsystic
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: DoYeon Park / p6rkdoye0n (Patchstack Alliance)
Published: 2023-12-15T15:13:35.661Z
CVE-2023-49192 WordPress Enhanced Text Widget plugin <= 1.6.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in cl272 Enhanced Text Widget enhanced-text-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through <= 1.6.3.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: cl272
product: Enhanced Text Widget
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Abdi Pranata | Patchstack Bug Bounty Program
Published: 2024-12-09T11:30:19.252Z
CVE-2023-49193 WordPress Grow Social plugin <= 1.30.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in NerdPress Hubbub Lite social-pug allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hubbub Lite: from n/a through <= 1.30.0.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: NerdPress
product: Hubbub Lite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Abdi Pranata | Patchstack Bug Bounty Program
Published: 2024-12-09T11:30:18.438Z
CVE-2023-49194 WordPress Importify (Dropshipping WooCommerce) plugin <= 1.0.4 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Debugging Code vulnerability in importify Importify (Dropshipping WooCommerce) importify allows Retrieve Embedded Sensitive Data.This issue affects Importify (Dropshipping WooCommerce): from n/a through <= 1.0.4.
Problem types: cwe_id: CWE-215
description: Insertion of Sensitive Information Into Debugging Code
Affected products: vendor: importify
product: Importify (Dropshipping WooCommerce)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Mika | Patchstack Bug Bounty Program
Published: 2024-12-09T11:30:17.608Z
CVE-2023-49195 WordPress Nested Pages Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages allows Stored XSS.This issue affects Nested Pages: from n/a through 3.2.6.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Kyle Phillips
product: Nested Pages
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: emad (Patchstack Alliance)
Published: 2023-12-14T15:39:26.529Z
CVE-2023-49196 WordPress Pagelayer plugin <= 1.7.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Pagelayer Team PageLayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PageLayer: from n/a through 1.7.7.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Pagelayer Team
product: PageLayer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Abdi Pranata (Patchstack Alliance)
Published: 2024-12-09T11:30:16.800Z
CVE-2023-49197 WordPress DoFollow Case by Case Plugin <= 3.4.2 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Apasionados, Apasionados del Marketing, NetConsulting DoFollow Case by Case.This issue affects DoFollow Case by Case: from n/a through 3.4.2.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Apasionados, Apasionados del Marketing, NetConsulting
product: DoFollow Case by Case
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Skalucy (Patchstack Alliance)
Published: 2023-12-15T15:39:22.792Z
CVE-2023-49198 Apache SeaTunnel Web: Arbitrary file read vulnerability
Mysql security vulnerability in Apache SeaTunnel.

Attackers can read files on the MySQL server by modifying the information in the MySQL URL

 allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360
This issue affects Apache SeaTunnel: 1.0.0.

Users are recommended to upgrade to version [1.0.1], which fixes the issue.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Apache Software Foundation
product: Apache SeaTunnel Web
default_status: unaffected
Credits: lang: en
value: jiahua huang
Published: 2024-08-21T09:37:57.478Z
CVE-2023-49203 
Technitium 11.5.3 allows remote attackers to cause a denial of service (bandwidth amplification) because the DNSBomb manipulation causes accumulation of low-rate DNS queries such that there is a large-sized response in a burst of traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-18T00:00:00.000Z
CVE-2023-49208 
scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-23T00:00:00.000Z
CVE-2023-49210 
The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-23T00:00:00.000Z
CVE-2023-49213 
The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings. The fixed versions are 3.10.2, 4.1.10, and 4.2.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-23T00:00:00.000Z
CVE-2023-49214 
Usedesk before 1.7.57 allows chat template injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-23T00:00:00.000Z
CVE-2023-49215 
Usedesk before 1.7.57 allows filter reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-23T00:00:00.000Z
CVE-2023-49216 
Usedesk before 1.7.57 allows profile stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-23T00:00:00.000Z
CVE-2023-49221 
Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and access the service menu, because there is a hard-coded service code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-07T00:00:00.000Z
CVE-2023-49222 
Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to gain root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-07T00:00:00.000Z
CVE-2023-49223 
Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd. An attacker could exploit this to extract files and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-07T00:00:00.000Z
CVE-2023-49224 
Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file. A remote attacker could use this key to gain root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-07T00:00:00.000Z
CVE-2023-49225 
A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: CommScope, Inc.
product: ZoneDirector
vendor: CommScope, Inc.
product: SmartZone
vendor: CommScope, Inc.
product: AP Solo R750
vendor: CommScope, Inc.
product: AP Solo R650
vendor: CommScope, Inc.
product: AP Solo R730
vendor: CommScope, Inc.
product: AP Solo T750
vendor: CommScope, Inc.
product: AP Solo R550
vendor: CommScope, Inc.
product: AP Solo R850
vendor: CommScope, Inc.
product: AP Solo T750SE
vendor: CommScope, Inc.
product: AP Solo R510
vendor: CommScope, Inc.
product: AP Solo T310D
vendor: CommScope, Inc.
product: AP Solo E510
vendor: CommScope, Inc.
product: AP Solo C110
vendor: CommScope, Inc.
product: AP Solo R320
vendor: CommScope, Inc.
product: AP Solo H510
vendor: CommScope, Inc.
product: AP Solo H320
vendor: CommScope, Inc.
product: AP Solo T310S
vendor: CommScope, Inc.
product: AP Solo T310N
vendor: CommScope, Inc.
product: AP Solo T310C
vendor: CommScope, Inc.
product: AP Solo T305
vendor: CommScope, Inc.
product: AP Solo M510
vendor: CommScope, Inc.
product: AP Solo R720
vendor: CommScope, Inc.
product: AP Solo R710
vendor: CommScope, Inc.
product: AP Solo T710
vendor: CommScope, Inc.
product: AP Solo T710s
vendor: CommScope, Inc.
product: AP Solo T610
vendor: CommScope, Inc.
product: AP Solo T610s
vendor: CommScope, Inc.
product: AP Solo R610
vendor: CommScope, Inc.
product: AP Solo R310
vendor: CommScope, Inc.
product: AP Solo R760
vendor: CommScope, Inc.
product: AP Solo R560
vendor: CommScope, Inc.
product: AP Solo H550
vendor: CommScope, Inc.
product: AP Solo H350
vendor: CommScope, Inc.
product: AP Solo T350c
vendor: CommScope, Inc.
product: AP Solo T350d
vendor: CommScope, Inc.
product: AP Solo T350se
vendor: CommScope, Inc.
product: AP Solo R350
Published: 2023-12-07T06:22:32.328Z
CVE-2023-49226 
An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2023-49228 
An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-28T00:00:00.000Z
CVE-2023-49229 
An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-28T00:00:00.000Z
CVE-2023-49230 
An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-28T00:00:00.000Z
CVE-2023-49231 
An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-29T00:00:00.000Z
CVE-2023-49232 
An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the password reset PINs of administrative users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-29T00:00:00.000Z
CVE-2023-49233 
Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning account to utilize functions normally reserved for administrators. The affected functions allow attackers to obtain different types of configured credentials and potentially elevate their privileges to administrator level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z