Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2962 State: PUBLISHED Published: 2023-05-29T14:00:05.234Z Last Updated: 2024-08-02T06:41:04.178Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Faculty Evaluation System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Faculty Evaluation System 1.0. Affected by this issue is some unknown functionality of the file index.php?page=edit_user. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230150 is the identifier assigned to this vulnerability. Additional An
been disclosed to the public and may be used. VDB-230150 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230150 - https://vuldb.com/?ctiid.230150 - https://github.com/JinYunlei/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-1.md
CVE ID: CVE-2023-2963 State: PUBLISHED Published: 2023-07-17T13:33:37.952Z Last Updated: 2024-10-30T13:56:33.552Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Oliva Expertise Products: Oliva Expertise EKS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliva Expertise Oliva Expertise EKS allows SQL Injection.This issue affects Oliva Expertise EKS: before 1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0409
CVE ID: CVE-2023-2964 State: PUBLISHED Published: 2023-07-10T12:40:29.302Z Last Updated: 2025-04-23T16:20:46.947Z Vendors: Unknown Products: Simple Iframe Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is at least that of a contributor to conduct Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/97aac334-5323-41bb-90f0-d180bcc9162f
CVE ID: CVE-2023-2965 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:14.381Z Description: No description available.
CVE ID: CVE-2023-2967 State: PUBLISHED Published: 2023-07-10T12:41:10.826Z Last Updated: 2025-05-05T15:58:19.023Z Vendors: Unknown Products: TinyMCE Custom Styles Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9afec4aa-1210-4c40-b566-64e37acf2b64
CVE ID: CVE-2023-2968 State: PUBLISHED Published: 2023-05-30T17:37:45.166Z Last Updated: 2025-01-09T21:21:19.735Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Problem Types: CWE-232 Description: A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/undefined-variable-usage-in-proxy-leads-to-remote-denial-of-service-xray-520917
CVE ID: CVE-2023-2970 State: PUBLISHED Published: 2023-05-30T05:31:03.695Z Last Updated: 2024-11-22T18:01:00.795Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: MindSpore Problem Types: CWE-119 Description: A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176. Additional
9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.230176 - https://vuldb.com/?ctiid.230176 - https://gitee.com/mindspore/mindspore/issues/I73DOS - https://gitee.com/mindspore/mindspore/commit/30f4729ea2c01e1ed437ba92a81e2fc098d608a9
CVE ID: CVE-2023-2971 State: PUBLISHED Published: 2023-08-19T05:45:35.025Z Last Updated: 2024-10-07T19:54:42.467Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Typora Products: Typora Problem Types: CWE-22 Description: Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://st
ste it into Typora. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://starlabs.sg/advisories/23/23-2971/
CVE ID: CVE-2023-2972 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-10T18:53:01.436Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: antfu Products: antfu/utils Problem Types: CWE-1321 Description: Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/009f1cd9-401c-49a7-bd08-be35cff6faef - https://github.com/antfu/utils/commit/7f8b16c6181c988bdb96613fbb2533b345f68682
CVE ID: CVE-2023-2973 State: PUBLISHED Published: 2023-05-30T10:31:02.680Z Last Updated: 2024-08-02T06:41:04.047Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Students Online Internship Timesheet Syste Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Students Online Internship Timesheet Syste 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_company. The manipulation of the argument name with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed
ment.cookie)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230204. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230204 - https://vuldb.com/?ctiid.230204 - https://github.com/ShallowDream888/VulnerabilityReport/blob/main/XSS.md
CVE ID: CVE-2023-2974 State: PUBLISHED Published: 2023-07-04T13:24:29.648Z Last Updated: 2024-08-02T06:41:03.976Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat build of Quarkus 2.13.8.Final Problem Types: CWE-757 Description: A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:3809 - https://access.redhat.com/security/cve/CVE-2023-2974 - https://bug
: - https://access.redhat.com/errata/RHSA-2023:3809 - https://access.redhat.com/security/cve/CVE-2023-2974 - https://bugzilla.redhat.com/show_bug.cgi?id=2211026
CVE ID: CVE-2023-2975 State: PUBLISHED Published: 2023-07-14T11:16:25.151Z Last Updated: 2025-04-23T16:20:14.504Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-354 Description: Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misled by removing, adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple
entation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qua
ated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230714.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598
CVE ID: CVE-2023-2976 State: PUBLISHED Published: 2023-06-14T17:36:40.640Z Last Updated: 2025-11-03T21:47:58.120Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Google Products: Guava Problem Types: Creation of Temporary File With Insecure Permissions Description: Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend
access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/guava/issues/2575 - https://security.netapp.com/advisory/ntap-20230818-0008/ - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01006.html
CVE ID: CVE-2023-2977 State: PUBLISHED Published: 2023-06-01T00:00:00.000Z Last Updated: 2025-11-03T21:47:59.585Z Vendors: n/a Products: OpenSC Problem Types: CWE-119 Description: A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible
b read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-2977 - https://bugzilla.redhat.com/show_bug.cgi?id=2211088 - https://github.com/OpenSC/OpenSC/issues/2785 - https://github.com/OpenSC/OpenSC/pull/2787 - https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAR54OV6EHA56B4XJF6RNPQ4HJ2ITU66/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.
AR54OV6EHA56B4XJF6RNPQ4HJ2ITU66/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJD4Q4AJSGE5UIJI7OUYZY4HGGCVYQNI/
CVE ID: CVE-2023-2978 State: PUBLISHED Published: 2023-05-30T14:00:05.299Z Last Updated: 2024-08-02T06:41:03.881Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Abstrium Products: Pydio Cells Problem Types: CWE-639 Description: A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifi
ion 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230210 - https://vuldb.com/?ctiid.230210 - https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421 - https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be
CVE ID: CVE-2023-2979 State: PUBLISHED Published: 2023-05-30T14:00:06.300Z Last Updated: 2024-08-02T06:41:03.961Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Abstrium Products: Pydio Cells Problem Types: CWE-284 Description: A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of th
.2.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230211. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230211 - https://vuldb.com/?ctiid.230211 - https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421 - https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be
CVE ID: CVE-2023-2980 State: PUBLISHED Published: 2023-05-30T14:31:03.238Z Last Updated: 2025-01-10T17:31:19.346Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Abstrium Products: Pydio Cells Problem Types: CWE-99 Description: A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of th
o version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.230212 - https://vuldb.com/?ctiid.230212 - https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421 - https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be
CVE ID: CVE-2023-2981 State: PUBLISHED Published: 2023-05-30T15:00:04.651Z Last Updated: 2024-08-02T06:41:04.061Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Abstrium Products: Pydio Cells Problem Types: CWE-80 Description: A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component Chat. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230213 was
4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230213 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230213 - https://vuldb.com/?ctiid.230213 - https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421 - https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be
CVE ID: CVE-2023-2982 State: PUBLISHED Published: 2023-06-29T01:56:56.207Z Last Updated: 2024-11-27T16:18:29.073Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cyberlord92 Products: WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible fo
nsufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/08ca186a-2486-4a58-9c53-03e9eba13e66?source=cve - https://plugins.trac.wordpress.org/browser/miniorange-login-openid/trunk/mo-openid-social-login-functions.php#L107 - https://plugins.trac.wordpres
ress.org/browser/miniorange-login-openid/trunk/mo-openid-social-login-functions.php#L107 - https://plugins.trac.wordpress.org/changeset/2925914/miniorange-login-openid - https://plugins.trac.wordpress.org/changeset/2924863/miniorange-login-openid - https://lana.codes/lanavdb/2326f41f-a39f-4fde-8627-9d29fff91443/
CVE ID: CVE-2023-2983 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-10T20:52:19.382Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-267 Description: Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/6b2f33d3-2fd0-4d2d-ad7b-2c1e2417eeb1 - https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a
CVE ID: CVE-2023-2984 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-13T19:58:54.371Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-29 Description: Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191 - https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed
CVE ID: CVE-2023-2985 State: PUBLISHED Published: 2023-06-01T00:00:00.000Z Last Updated: 2025-03-11T15:18:02.405Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=07db5e247ab5858439b14dd7cc1fe538b9efcf32
CVE ID: CVE-2023-2986 State: PUBLISHED Published: 2023-06-08T01:56:22.856Z Last Updated: 2024-12-28T00:52:18.876Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: tychesoftwares Products: Abandoned Cart Lite for WooCommerce Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the ca
cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68052614-204f-4237-af0e-4b8210ebd59f?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woo
204f-4237-af0e-4b8210ebd59f?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php#L1815 - https://plugins.trac.wordpress.org/changeset/2922242/ - https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php?rev=2916178#L1800 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925274%40woocommerce-abandoned-cart&new=2925274%40woocommerce-abandoned-cart&sfp_email=&sfph_mail= - https://www.wordfence.com/blog/2023/06/tyche-softwares-addresses-authentication-bypass-vulnerability-in-abandoned-cart-lite-for-woocommerce-wordpress-plugin/ - https://github.com/TycheSoftwares/woocomme
pass-vulnerability-in-abandoned-cart-lite-for-woocommerce-wordpress-plugin/ - https://github.com/TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment-1601813615 - https://github.com/Ayantaker/CVE-2023-2986
CVE ID: CVE-2023-2987 State: PUBLISHED Published: 2023-05-31T02:40:20.868Z Last Updated: 2025-01-13T16:31:38.630Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wordapp Products: Wordapp Problem Types: CWE-345 Insufficient Verification of Data Authenticity Description: The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functiona