Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d keys 'key' and 'post_id'. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve arbitrary post meta values which may contain sensitive information when combined with another plugin. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d936a48-b300-4a41-8d28-ba34cb3c5cb7?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/meta.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3000576%40shortcodes-ultimate&new=3000576%40shortcodes-ultimate&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6228 State: PUBLISHED Published: 2023-12-18T13:43:08.775Z Last Updated: 2025-11-21T06:24:06.676Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-787 Description: An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2289 - https://access.redhat.com/errata/RHSA-202
ram Container: References: - https://access.redhat.com/errata/RHSA-2024:2289 - https://access.redhat.com/errata/RHSA-2024:5079 - https://access.redhat.com/security/cve/CVE-2023-6228 - https://bugzilla.redhat.com/show_bug.cgi?id=2240995
CVE ID: CVE-2023-6229 State: PUBLISHED Published: 2024-02-06T00:20:48.446Z Last Updated: 2025-06-17T21:29:26.638Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Inc. Products: Satera LBP670C Series, Satera MF750C Series, Color imageCLASS LBP674C, Color imageCLASS X LBP1333C, Color imageCLASS MF750C Series, Color imageCLASS X MF1333C Series, i-SENSYS LBP673Cdw, C1333P, i-SENSYS MF750C Series, C1333i Series Problem Types: CWE-787 Description: Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive o
aser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2024-001/ - https://canon.jp/support/support-info/240205vulnerabi
ferences: - https://psirt.canon/advisory-information/cp2024-001/ - https://canon.jp/support/support-info/240205vulnerability-response - https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Vulnerability-Measure-Against-Buffer-Overflow-for-Laser-Printers-and-Small-Office-Multifunctional-Printers - https://www.canon-europe.com/support/product-security-latest-news/
CVE ID: CVE-2023-6230 State: PUBLISHED Published: 2024-02-06T00:21:33.337Z Last Updated: 2025-06-17T21:29:26.771Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Inc. Products: Satera LBP670C Series, Satera MF750C Series, Color imageCLASS LBP674C, Color imageCLASS X LBP1333C, Color imageCLASS MF750C Series, Color imageCLASS X MF1333C Series, i-SENSYS LBP673Cdw, C1333P, i-SENSYS MF750C Series, C1333i Series Problem Types: CWE-787 Description: Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigge
tion of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2024-001/ - https://ca
gram Container: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2024-001/ - https://canon.jp/support/support-info/240205vulnerability-response - https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Vulnerability-Measure-Against-Buffer-Overflow-for-Laser-Printers-and-Small-Office-Multifunctional-Printers - https://www.canon-europe.com/support/product-security-latest-news/
CVE ID: CVE-2023-6231 State: PUBLISHED Published: 2024-02-06T00:22:03.670Z Last Updated: 2025-06-17T21:29:26.939Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Inc. Products: Satera LBP670C Series, Satera MF750C Series, Color imageCLASS LBP674C, Color imageCLASS X LBP1333C, Color imageCLASS MF750C Series, Color imageCLASS X MF1333C Series, i-SENSYS LBP673Cdw, C1333P, i-SENSYS MF750C Series, C1333i Series Problem Types: CWE-787 Description: Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to exec
ters(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2024-001/ - https://canon.jp/support/support-info/240205vulnerability-resp
- https://psirt.canon/advisory-information/cp2024-001/ - https://canon.jp/support/support-info/240205vulnerability-response - https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Vulnerability-Measure-Against-Buffer-Overflow-for-Laser-Printers-and-Small-Office-Multifunctional-Printers - https://www.canon-europe.com/support/product-security-latest-news/
CVE ID: CVE-2023-6232 State: PUBLISHED Published: 2024-02-06T00:22:31.201Z Last Updated: 2025-06-17T21:29:27.066Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Inc. Products: Satera LBP670C Series, Satera MF750C Series, Color imageCLASS LBP674C, Color imageCLASS X LBP1333C, Color imageCLASS MF750C Series, Color imageCLASS X MF1333C Series, i-SENSYS LBP673Cdw, C1333P, i-SENSYS MF750C Series, C1333i Series Problem Types: CWE-787 Description: Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigge
CVE ID: CVE-2023-6233 State: PUBLISHED Published: 2024-02-06T00:23:05.601Z Last Updated: 2025-06-17T21:29:27.325Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Inc. Products: Satera LBP670C Series, Satera MF750C Series, Color imageCLASS LBP674C, Color imageCLASS X LBP1333C, Color imageCLASS MF750C Series, Color imageCLASS X MF1333C Series, i-SENSYS LBP673Cdw, C1333P, i-SENSYS MF750C Series, C1333i Series Problem Types: CWE-787 Description: Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to
Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2024-001/ - https://canon.jp/support/support-info/240205vulnerability-
ces: - https://psirt.canon/advisory-information/cp2024-001/ - https://canon.jp/support/support-info/240205vulnerability-response - https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Vulnerability-Measure-Against-Buffer-Overflow-for-Laser-Printers-and-Small-Office-Multifunctional-Printers - https://www.canon-europe.com/support/product-security-latest-news/
CVE ID: CVE-2023-6234 State: PUBLISHED Published: 2024-02-06T00:23:28.727Z Last Updated: 2024-08-02T08:21:17.875Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Inc. Products: Satera LBP670C Series, Satera MF750C Series, Color imageCLASS LBP674C, Color imageCLASS X LBP1333C, Color imageCLASS MF750C Series, Color imageCLASS X MF1333C Series, i-SENSYS LBP673Cdw, C1333P, i-SENSYS MF750C Series, C1333i Series Problem Types: CWE-787 Description: Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unrespon
and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://psirt.canon/advisory-information/cp2024-001/ - https://canon.jp/support/support-info/240205vul
er: References: - https://psirt.canon/advisory-information/cp2024-001/ - https://canon.jp/support/support-info/240205vulnerability-response - https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Vulnerability-Measure-Against-Buffer-Overflow-for-Laser-Printers-and-Small-Office-Multifunctional-Printers - https://www.canon-europe.com/support/product-security-latest-news/
CVE ID: CVE-2023-6235 State: PUBLISHED Published: 2023-11-21T12:24:55.918Z Last Updated: 2024-08-02T08:21:17.946Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Duet Display Products: Duet Display for Windows 10+ Problem Types: CWE-427 Description: An uncontrolled search path element vulnerability has been found in the Duet Display product, affecting version 2.5.9.1. An attacker could place an arbitrary libusk.dll file in the C:\Users\user\AppData\Local\Microsoft\WindowsApps\ directory, which could lead to the execution and persistence of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/noti
bitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/arbitrary-code-execution-duet-display
CVE ID: CVE-2023-6236 State: PUBLISHED Published: 2024-04-10T01:04:53.970Z Last Updated: 2025-11-20T18:08:20.949Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Expansion Pack Problem Types: CWE-345 Description: A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the u
n Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in OidcSessionTokenStore when determining if a cached token should be used or not. This logic needs to be updated to take into account the new "provider-url" option in addition to the "realm" option. EAP-7 does not provide the vulnerable provider-url configuration option in its OIDC implementation and is not affected by this flaw. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-202
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:3580 - https://access.redhat.com/errata/RHSA-2024:3581 - https://access.redhat.com/errata/RHSA-2024:3583 - https://access.redhat.com/security/cve/CVE-2023-6236 - https://bugzilla.redhat.com/show_bug.cgi?id=2250812
CVE ID: CVE-2023-6237 State: PUBLISHED Published: 2024-04-25T06:27:26.990Z Last Updated: 2024-11-01T14:28:51.338Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-606 Description: Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service. When function EVP_PKEY_public_check() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two o
eys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is an overly large prime, then this computation would take a long time. An application that calls EVP_PKEY_public_check() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function EVP_PKEY_public_check() is not called from other OpenSSL functions however it is called from the OpenSSL pkey command line application. For that reason that application is also vulnerable if used with the '-pubin' and '-check' options on untrusted data. The Open
at reason that application is also vulnerable if used with the '-pubin' and '-check' options on untrusted data. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20240115.txt - https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a - https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 - https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d
CVE ID: CVE-2023-6238 State: PUBLISHED Published: 2023-11-21T20:21:20.625Z Last Updated: 2024-10-17T18:01:41.927Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a, Red Hat, Fedora Products: kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-120 Description: A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memor
t Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memory corruption. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-6238 - https://bugzilla.redhat.com/show_bug.cgi?id=2250834
CVE ID: CVE-2023-6239 State: PUBLISHED Published: 2023-11-28T14:07:20.877Z Last Updated: 2024-08-28T08:17:32.251Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: M-Files Products: M-Files Server Problem Types: CWE-281 Description: Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object. Additional Analyst Notes: - CVE Program Container: References: - https://product.m-files.com/security-advisories/cve-2023-6239/
CVE ID: CVE-2023-6240 State: PUBLISHED Published: 2024-02-04T14:11:17.824Z Last Updated: 2025-11-08T07:10:21.775Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-203 Description: A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services that use that priv
issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services that use that private key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:1881 - https://access.redhat.com/errata/RHSA-2024:1882 - https://access.redhat.com/errata/RHSA-2024:2758 - https://access.redhat.com/errata/RHSA-2024:3414 - https://access.redhat.com/errata/RHSA-2024:3421 - https://access.redhat.com/errata/RHSA-2024:3618 - https://access.redhat.com/errata/RHSA-2024:3627 - https://access.redhat.com/security/cve/CVE-2023-6240 - https://bugzilla.redhat.com/show_bug.cgi?id=2250843 - https://people.redhat.
ess.redhat.com/security/cve/CVE-2023-6240 - https://bugzilla.redhat.com/show_bug.cgi?id=2250843 - https://people.redhat.com/~hkario/marvin/ - https://securitypitfalls.wordpress.com/2023/10/16/experiment-with-side-channel-attacks-yourself/
CVE ID: CVE-2023-6241 State: PUBLISHED Published: 2024-03-04T12:15:58.212Z Last Updated: 2025-03-13T14:35:52.185Z Vendors: Arm Ltd Products: Midgard GPU Kernel Driver, Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race condition to perform improper memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn cause a use-a
memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn cause a use-after-free.This issue affects Midgard GPU Kernel Driver: from r13p0 through r32p0; Bifrost GPU Kernel Driver: from r11p0 through r25p0; Valhall GPU Kernel Driver: from r19p0 through r25p0, from r29p0 through r46p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r46p0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-6242 State: PUBLISHED Published: 2024-01-11T14:32:23.144Z Last Updated: 2025-06-03T14:07:59.543Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: ashanjay, EventON Products: EventON, EventON Pro Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or incorrect nonce validation on the evo_eventpost_update_meta function. This makes it possible for unauthenticated attackers to update arbitrary post metadata via a for
t_update_meta function. This makes it possible for unauthenticated attackers to update arbitrary post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e9a333-a6b7-4b5e-93c1-b95566e5d6fb?source=cve - https://docs.myeventon.com/documentations/eventon-changelog/ - https://plugins.trac.wordpress.org/changeset/3017578/eventon-lite/trunk/includes/admin/class-admin-ajax.php
CVE ID: CVE-2023-6243 State: PUBLISHED Published: 2024-10-19T06:41:59.957Z Last Updated: 2024-10-20T13:50:29.698Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: EventON Products: EventON Pro Problem Types: CWE-352 Description: The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admin_test_email function. This makes it possible for unauthenticated attackers to send test emails to arbitrary email addresses via a forged request granted they can trick a site administrator into performing
st emails to arbitrary email addresses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d0a40f8-4c31-447d-ac28-73cfe7a07687?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3017939%40eventon-lite&new=3017939%40eventon-lite&sfp_email=&sfph_mail= - https://docs.myeventon.com/documentations/eventon-changelog/
CVE ID: CVE-2023-6244 State: PUBLISHED Published: 2024-01-11T14:32:22.556Z Last Updated: 2025-06-03T14:08:06.315Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: ashanjay, EventON Products: EventON, EventON Pro Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). This is due to missing or incorrect nonce validation on the save_virtual_event_settings function. This makes it possible for unauthenticated attackers to modify virtual event settings via a forged req