Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
veComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This is patched in OWASP AntiSamy .NET 1.2.0 and later. See important remediation details in the reference given below. As a workaround, manually edit the AntiSamy policy file (e.g., antisamy.xml) by deleting the `preserveComments` directive or setting its value to `false`, if present. Also it would be useful to make AntiSamy remove the `noscript` tag by adding a line described in the GitHub Security Advisory to the tag definitions under the
y remove the `noscript` tag by adding a line described in the GitHub Security Advisory to the tag definitions under the `<tagrules>` node, or deleting it entirely if present. As the previously mentioned policy settings are preconditions for the mXSS attack to work, changing them as recommended should be sufficient to protect you against this vulnerability when using a vulnerable version of this library. However, the existing bug would still be present in AntiSamy or its parser dependency (HtmlAgilityPack). The safety of this workaround relies on configurations that may change in the future and don't address the root cause of the vulnerability. As such, it is strongly recommended to upgrade t
ge in the future and don't address the root cause of the vulnerability. As such, it is strongly recommended to upgrade to a fixed version of AntiSamy. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spassarop/antisamy-dotnet/security/advisories/GHSA-8x6f-956f-q43w - https://github.com/spassarop/antisamy-dotnet/commit/7e500daef6ad9c10e97c68feab78f4cb6e3083c6 - https://github.com/spassarop/antisamy-dotnet/commit/8117911933e75a25cd0054ef017577486338444a
CVE ID: CVE-2023-51653 State: PUBLISHED Published: 2024-02-22T15:39:49.280Z Last Updated: 2025-04-22T16:19:23.604Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dromara Products: hertzbeat Problem Types: CWE-74 Description: Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this iss
xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dromara/hertzbeat/security/advisories/GHSA-gcmp-vf6v-59gg - https://github.com/dromara/hertzbeat/commit/f794b0d82be49c596c04a042976446559eb315ef
CVE ID: CVE-2023-51654 State: PUBLISHED Published: 2023-12-26T05:33:57.383Z Last Updated: 2024-08-02T22:40:33.847Z Vendors: Brother Industries, Ltd. Products: iPrint&Scan Desktop for Windows Problem Types: Improper Link Resolution Before File Access ('Link Following') Description: Improper link resolution before file access ('Link Following') issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier. A symlink attack by a malicious user may cause a Denial-of-service (DoS) condition on the PC. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/vu/JVNVU97943829/
CVE ID: CVE-2023-51655 State: PUBLISHED Published: 2023-12-21T09:57:04.395Z Last Updated: 2024-08-02T22:40:34.145Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: JetBrains Products: IntelliJ IDEA Problem Types: CWE-349 Description: In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-51656 State: PUBLISHED Published: 2023-12-21T11:47:57.912Z Last Updated: 2025-02-13T17:19:46.209Z Vendors: Apache Software Foundation Products: Apache IoTDB Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/zy3klwpv11vl5n65josbfo2fyzxg3dxc - http://www.openwall.com/lists/oss-security/2023/12/21/5
CVE ID: CVE-2023-51661 State: PUBLISHED Published: 2023-12-22T14:54:23.103Z Last Updated: 2025-04-17T20:29:41.019Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wasmerio Products: wasmer Problem Types: CWE-284 Description: Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
ched in version 4.2.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5j - https://github.com/wasmerio/wasmer/issues/4267 - https://github.com/wasmerio/wasmer/commit/4d63febf9d8b257b0531963b85df48d45d0dbf3c
CVE ID: CVE-2023-51662 State: PUBLISHED Published: 2023-12-22T16:27:05.209Z Last Updated: 2024-08-02T22:40:34.244Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: snowflakedb Products: snowflake-connector-net Problem Types: CWE-295 Description: The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2
where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/snowflakedb/snowflake-connector-net/security/advisories/GHSA-hwcc-4cv8-cf3h - https://docs.snowflake.com/release-notes/clients-drivers/dotnet-2023#version-2-1-5-december-18-2023
CVE ID: CVE-2023-51663 State: PUBLISHED Published: 2023-12-29T16:53:36.692Z Last Updated: 2025-04-17T20:14:52.468Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: hail-is Products: hail Problem Types: CWE-289 Description: Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could crea
could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `test@example.org`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hail-is/hail
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hail-is/hail/security/advisories/GHSA-487p-qx68-5vjw
CVE ID: CVE-2023-51664 State: PUBLISHED Published: 2023-12-27T16:58:31.908Z Last Updated: 2024-09-25T20:17:19.352Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: tj-actions Products: changed-files Problem Types: CWE-77, CWE-74 Description: tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.
d execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tj-actions/changed-files/security/advisories/GHSA-mcph-m25j-8j63 - https://github.com/tj-actions/changed-files/commit/0102c07446a3cad972f4afcbd0ee4dbc4b6d2d1b - https://github.com/tj-actions/changed-files/commit/716b1e13042866565e00e85fd4ec490e186c4a2f - https://github.com/tj-actions/changed-files/commit/ff2f6e6b91913a7be42be1b5917330fe442f2ede
CVE ID: CVE-2023-51665 State: PUBLISHED Published: 2023-12-27T17:26:57.166Z Last Updated: 2024-08-02T22:40:34.167Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: advplyr Products: audiobookshelf Problem Types: CWE-918 Description: Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in Auth.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-gjgj-9
Notes: - CVE Program Container: References: - https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-gjgj-98v3-47pg - https://github.com/advplyr/audiobookshelf/commit/728496010cbfcee5b7b54001c9f79e02ede30d82
CVE ID: CVE-2023-51666 State: PUBLISHED Published: 2024-02-01T10:16:46.200Z Last Updated: 2024-08-02T22:40:34.200Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: PickPlugins Products: Related Post Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored XSS.This issue affects Related Post: from n/a through 2.0.53. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/related-post/wordpress-related-post-plugin-2-0-53-cross-site-scripting-xss-vulnerability?_s_id
om/database/vulnerability/related-post/wordpress-related-post-plugin-2-0-53-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-51667 State: PUBLISHED Published: 2024-06-04T12:29:22.829Z Last Updated: 2024-08-02T22:40:34.193Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: FeedbackWP Products: Rate my Post – WP Rating System Problem Types: CWE-290 Description: Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post – WP Rating System allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-wp-ratin
gram Container: References: - https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-wp-rating-system-plugin-3-4-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-51668 State: PUBLISHED Published: 2024-01-05T09:49:47.323Z Last Updated: 2024-11-14T18:17:55.777Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP Zone Products: Inline Image Upload for BBPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Inline Image Upload for BBPress.This issue affects Inline Image Upload for BBPress: from n/a through 1.1.18. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/image-upload-for-bbpress/wordpress-inline-image-upload-for-bbpress-plugin-1-1-18-cross-site-request-forgery-csrf-
bility/image-upload-for-bbpress/wordpress-inline-image-upload-for-bbpress-plugin-1-1-18-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-51669 State: PUBLISHED Published: 2024-02-01T10:19:55.970Z Last Updated: 2024-08-02T22:40:34.163Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Artios Media Products: Product Code for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artios Media Product Code for WooCommerce allows Stored XSS.This issue affects Product Code for WooCommerce: from n/a through 1.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/product-code-for-woocommerce/wordpress-produc
ram Container: References: - https://patchstack.com/database/vulnerability/product-code-for-woocommerce/wordpress-product-code-for-woocommerce-plugin-1-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-51670 State: PUBLISHED Published: 2024-06-12T08:54:14.270Z Last Updated: 2024-08-02T22:40:34.219Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: FunnelKit Products: FunnelKit Checkout Problem Types: CWE-862 Description: Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woofunnels-aero-checkout/wordpress-funnelkit-checkout-plugin-3-10-3-authenticated-arbitrary-plugin-activation-vulnerability?_s_id=cve
CVE ID: CVE-2023-51671 State: PUBLISHED Published: 2024-06-12T08:49:38.313Z Last Updated: 2024-08-02T22:40:34.146Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: FunnelKit Products: FunnelKit Checkout Problem Types: CWE-862 Description: Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woofunnels-aero-checkout/wordpress-funnelkit-checkout-plugin-3-10-3-authenticated-plugin-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2023-51672 State: PUBLISHED Published: 2024-03-21T17:25:36.387Z Last Updated: 2024-08-08T18:23:51.519Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: FunnelKit Products: FunnelKit Checkout Problem Types: CWE-862 Description: Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woofunnels-aero-checkout/wordpress-funnelkit-checkout-plugin-3-10-3-unauthenticated-arbitrary-post-page-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2023-51673 State: PUBLISHED Published: 2024-01-05T09:54:20.239Z Last Updated: 2025-05-23T16:03:17.672Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Designful Products: Stylish Price List – Price Table Builder & QR Code Restaurant Menu Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Designful Stylish Price List – Price Table Builder & QR Code Restaurant Menu.This issue affects Stylish Price List – Price Table Builder & QR Code Restaurant Menu: from n/a through 7.0.17. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/styl
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/stylish-price-list/wordpress-stylish-price-list-plugin-7-0-17-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-51674 State: PUBLISHED Published: 2024-02-01T10:22:55.887Z Last Updated: 2024-08-02T22:40:34.219Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: AAM Products: Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18. Additional Analyst No
Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/advanced-access-manager/wordpress-advanced-access-manager-plugin-6-9-18-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-51675 State: PUBLISHED Published: 2023-12-29T13:57:17.047Z Last Updated: 2024-09-09T17:27:49.263Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: AAM Products: Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
nced Security and More: from n/a through 6.9.18. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-access-manager/wordpress-advanced-access-manager-plugin-6-9-18-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2023-51676 State: PUBLISHED Published: 2023-12-29T12:44:14.337Z Last Updated: 2024-08-02T22:40:34.194Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Leevio Products: Happy Addons for Elementor Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor.This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/happy-elementor-addons/wordpress-happy-addons-for-elementor-plugin-3-9-1-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-51677 State: PUBLISHED Published: 2024-02-01T10:28:57.719Z Last Updated: 2024-08-02T22:40:34.224Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Magazine3 Products: Schema & Structured Data for WP & AMP Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.23. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/schema-and-structured-dat
richment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/schema-and-structured-data-for-wp/wordpress-schema-structured-data-for-wp-amp-plugin-1-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-51678 State: PUBLISHED Published: 2024-01-05T10:00:54.295Z Last Updated: 2025-06-17T20:29:12.921Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Doofinder Products: Doofinder WP & WooCommerce Search Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.0.33. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-wp-woocommerce-search-plugin-2-0-33-broken-access-control
se/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-wp-woocommerce-search-plugin-2-0-33-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-51679 State: PUBLISHED Published: 2024-06-12T08:47:21.418Z Last Updated: 2024-08-02T22:40:34.234Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: BulkGate Products: BulkGate SMS Plugin for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in BulkGate BulkGate SMS Plugin for WooCommerce.This issue affects BulkGate SMS Plugin for WooCommerce: from n/a through 3.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woosms-sms-module-for-woocommerce/wordpress-bulkgate-sms-plugin-for-woocommerce-plugin-3-0-2-broken-access-contr
ability/woosms-sms-module-for-woocommerce/wordpress-bulkgate-sms-plugin-for-woocommerce-plugin-3-0-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-51680 State: PUBLISHED Published: 2024-06-12T08:46:12.601Z Last Updated: 2024-08-02T22:40:34.154Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: TechnoVama Products: Quotes for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in TechnoVama Quotes for WooCommerce.This issue affects Quotes for WooCommerce: from n/a through 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/quotes-for-woocommerce/wordpress-quotes-for-woocommerce-plugin-2-0-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-51681 State: PUBLISHED Published: 2024-02-28T16:41:37.143Z Last Updated: 2024-08-23T20:00:16.392Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Duplicator Products: Duplicator – WordPress Migration & Backup Plugin Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Duplicator Duplicator – WordPress Migration & Backup Plugin.This issue affects Duplicator – WordPress Migration & Backup Plugin: from n/a through 1.5.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://patchstack.com/database/vulnerability/duplicator/wordpress-duplicator-plugin-1-5-7-cros
t: References: - https://https://patchstack.com/database/vulnerability/duplicator/wordpress-duplicator-plugin-1-5-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve