Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ttackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61c39f5f-3b17-4e4d-824e-241159a73400?source=cve - https://plugins.trac.wordpress.org/browser/contact-form-with-a-meeting-scheduler-by-vcita/trunk/system/parse_vcita_callback.php#L55 - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
CVE ID: CVE-2023-2302 State: PUBLISHED Published: 2023-06-03T04:35:14.577Z Last Updated: 2024-12-20T23:57:48.903Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vcita Products: Contact Form and Calls To Action by vcita Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such
nitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4dfc237a-9157-4da9-ba8f-9daf2ba4f20b?source=cve - https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-callback.php - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
CVE ID: CVE-2023-2303 State: PUBLISHED Published: 2023-06-03T04:35:13.759Z Last Updated: 2024-12-20T23:57:56.854Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: eyale-vc Products: Contact Form Builder by vcita Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.4. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick
d attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2345c972-9fd4-4709-8bde-315ab54f60e2?source=cve - https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-callback.php - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
CVE ID: CVE-2023-2304 State: PUBLISHED Published: 2023-05-31T04:35:41.279Z Last Updated: 2025-01-13T16:31:00.220Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kylephillips Products: Favorites Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_favorites' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject ar
attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd03cd0-34f0-491c-8247-79656eba32a8?source=cve - https://plugins.trac.wordpress.org/browser/favorites/tags/2.3.2/app/API/Shortcodes/UserFavoritesShortcode.php#L57 - https://plugins.trac.wordpress.org/browser/favorites/tags/2.3.2/assets/js/favorites.js#L421 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2
s/2.3.2/assets/js/favorites.js#L421 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2919192%40favorites&old=2805323%40favorites&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2305 State: PUBLISHED Published: 2023-06-09T05:33:25.665Z Last Updated: 2024-12-20T23:38:38.338Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codename065 Products: Download Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with con
anitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a66bc196-e5f8-46b4-a81c-c888eb64021c?source=cve - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.2.70/src/User/views/members.php#L10 - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.2.70/src/User/views/login-form.php#L10 - https://plugins.trac.wordpress
ac.wordpress.org/browser/download-manager/tags/3.2.70/src/User/views/login-form.php#L10 - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.2.70/src/User/views/reg-form.php#L11 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2906403%40download-manager&new=2906403%40download-manager&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2306 State: PUBLISHED Published: 2023-10-05T16:46:42.171Z Last Updated: 2025-01-16T21:29:36.919Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Qognify Products: NiceVision Problem Types: CWE-798 Description: Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacker can retrieve information about the cameras, user information, and modify database records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-02
CVE ID: CVE-2023-2307 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-01-31T19:18:10.343Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: builderio Products: builderio/qwik Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/204ea12e-9e5c-4166-bf0e-fd49c8836917 - https://github.com/BuilderIO/qwik/pull/3862/commits/09190b70027354baf7ad3d208df9c05a87f75f57
CVE ID: CVE-2023-2309 State: PUBLISHED Published: 2023-07-24T10:20:23.546Z Last Updated: 2024-10-24T15:02:54.084Z Vendors: Unknown Products: wpForo Forum Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1b3f4558-ea41-4749-9aa2-d3971fc9ca0d
CVE ID: CVE-2023-2310 State: PUBLISHED Published: 2023-05-10T19:18:43.806Z Last Updated: 2025-01-27T18:20:35.192Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Schweitzer Engineering Laboratories, Schweitzer Engineering Laboratories, Inc. Products: SEL-3505, SEL-3505-3, SEL-3530, SEL-3530-4, SEL-3532, SEL-3555, SEL-3560S, SEL-3560E, SEL-2241 RTAC module, SEL-3350 Problem Types: CWE-300 Description: A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) could allow a remote attacker to perform a man-in-the-middle (MiTM) that could result in denial of service. See the ACSELERAT
allow a remote attacker to perform a man-in-the-middle (MiTM) that could result in denial of service. See the ACSELERATOR RTAC SEL-5033 Software instruction manual date code 20210915 for more details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://selinc.com/support/security-notifications/external-reports/
CVE ID: CVE-2023-2311 State: PUBLISHED Published: 2023-07-28T23:26:54.736Z Last Updated: 2025-02-13T16:44:07.148Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html - https://crbug.com/1354505 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAS
crbug.com/1354505 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE ID: CVE-2023-2312 State: PUBLISHED Published: 2023-08-15T17:07:09.753Z Last Updated: 2025-02-13T16:44:07.750Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1448548 - https://www.debian.org/security/2023/dsa-5479 - https://lis
nel-update-for-desktop_15.html - https://crbug.com/1448548 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-2313 State: PUBLISHED Published: 2023-07-28T23:26:54.882Z Last Updated: 2025-02-13T16:44:08.292Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a malicious file. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html - https://crbug.com/1335974 - https://lists.fedoraproject.org/archives/list/package-announce@lists.
ate-for-desktop.html - https://crbug.com/1335974 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE ID: CVE-2023-2314 State: PUBLISHED Published: 2023-07-28T23:26:55.094Z Last Updated: 2025-02-13T16:44:08.912Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html - https://crbug.com/813542 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAST6CB5KKCQKH75ER2U
CVE ID: CVE-2023-2315 State: PUBLISHED Published: 2023-09-26T04:36:21.668Z Last Updated: 2024-09-24T14:35:17.154Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Opencart Products: Opencart Problem Types: CWE-22, CWE-20 Description: Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://starlabs.sg/advisories/23/23-2315/ - https://github.com/opencart/opencart/commit/0a8dd91e385f70e42795380009fd644224c1bc97
CVE ID: CVE-2023-2316 State: PUBLISHED Published: 2023-08-19T05:34:20.390Z Last Updated: 2024-10-07T19:59:27.236Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Typora Products: Typora Problem Types: CWE-22 Description: Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://su
ste it into Typora. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.typora.io/What's-New-1.6/ - https://starlabs.sg/advisories/23/23-2316/
CVE ID: CVE-2023-2317 State: PUBLISHED Published: 2023-08-19T05:35:36.603Z Last Updated: 2024-10-07T19:57:59.068Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Typora Products: Typora Problem Types: CWE-79 Description: DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora main window via loading typora://app/typemark/updater/update.html in <embed> tag. This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora. Additional Analyst Notes: - CVE Program
le in Typora, or copies text from a malicious webpage and paste it into Typora. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.typora.io/What's-New-1.6/ - https://starlabs.sg/advisories/23/23-2317/
CVE ID: CVE-2023-2318 State: PUBLISHED Published: 2023-08-19T05:43:56.387Z Last Updated: 2024-10-07T19:56:42.497Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: MarkText Products: MarkText Problem Types: CWE-79 Description: DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in the context of MarkText main window. This vulnerability can be exploited if a user copies text from a malicious webpage and paste it into MarkText. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/marktext/marktext/issues/3618
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/marktext/marktext/issues/3618 - https://starlabs.sg/advisories/23/23-2318/
CVE ID: CVE-2023-2319 State: PUBLISHED Published: 2023-05-17T00:00:00.000Z Last Updated: 2025-01-22T18:24:17.936Z Vendors: n/a Products: pcs Problem Types: NA Description: It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2190092 - https://access.redhat.com/security/cve/CVE-2023-2319 - https://access.redhat.com/errata/RHSA-2023:2652
CVE ID: CVE-2023-2320 State: PUBLISHED Published: 2023-07-04T07:23:30.440Z Last Updated: 2024-11-26T18:53:00.307Z Vendors: Unknown Products: CF7 Google Sheets Connector, cf7-google-sheets-connector-pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f17ccbaa-
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f17ccbaa-2fcd-4f17-a4da-73f2bc8a4fe9
CVE ID: CVE-2023-2321 State: PUBLISHED Published: 2023-07-04T07:23:29.639Z Last Updated: 2024-11-25T16:35:00.758Z Vendors: Unknown Products: WPForms Google Sheet Connector, gsheetconnector-wpforms-pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/79a56359-f7
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/79a56359-f7e8-4c8c-b0aa-6300f5d57880
CVE ID: CVE-2023-2322 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:35:16.820Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f7228f3f-3bef-46fe-b0e3-56c432048a67 - https://github.com/pimcore/pimcore/commit/9fc674892b8b53103098b9524705074a45e7f773
CVE ID: CVE-2023-2323 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:34:07.651Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/41edf190-f6bf-4a29-a237-7ff1b2d048d3 - https://github.com/pimcore/pimcore/commit/e88fa79de7b5903fb58ddbc231130b04d937d79e
CVE ID: CVE-2023-2324 State: PUBLISHED Published: 2023-07-04T07:23:25.652Z Last Updated: 2024-11-21T15:01:43.673Z Vendors: Unknown Products: Elementor Forms Google Sheet Connector, gsheetconnector-for-elementor-forms-pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro WordPress plugin through 1.0.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
ivilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/50d81eec-f324-4445-b10f-96e94153917e
CVE ID: CVE-2023-2325 State: PUBLISHED Published: 2023-10-20T06:39:44.747Z Last Updated: 2024-08-28T20:06:58.799Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: M-Files Products: M-Files Web Problem Types: CWE-79 Description: Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2023-2325/
CVE ID: CVE-2023-2326 State: PUBLISHED Published: 2023-06-27T13:17:25.086Z Last Updated: 2024-11-27T19:13:50.633Z Vendors: Unknown Products: Gravity Forms Google Sheet Connector, gsheetconnector-gravityforms-pro Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vuln
attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f922695a-b803-4edf-aadc-80c79d99bebb
CVE ID: CVE-2023-2327 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:33:27.692Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7336b71f-a36f-4ce7-a26d-c8335ac713d6 - https://github.com/pimcore/pimcore/commit/fb3056a21d439135480ee299bf1ab646867b5f4f
CVE ID: CVE-2023-2328 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:51:45.775Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/01a44584-e36b-46f4-ad94-53af488397f6 - https://github.com/pimcore/pimcore/commit/e3562bfe249c557d15474c9a0acd5e06628521fe