Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-23939 State: PUBLISHED Published: 2023-03-06T18:19:05.155Z Last Updated: 2025-02-25T15:00:56.243Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Azure Products: setup-kubectl Problem Types: CWE-732 Description: Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This Kubectl tool installer runs `fs.chmodSync(kubectlPath, 777)` to set permissions on the Kubectl binary, however, this allows any local user to repla
`fs.chmodSync(kubectlPath, 777)` to set permissions on the Kubectl binary, however, this allows any local user to replace the Kubectl binary. This allows privilege escalation to the user that can also run kubectl, most likely root. This attack is only possible if an attacker somehow breached the GitHub actions runner or if a user is utilizing an Action that maliciously executes this attack. This has been fixed and released in all versions `v3` and later. 775 permissions are used instead. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Azure/setup-kubectl/
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Azure/setup-kubectl/security/advisories/GHSA-p756-rfxh-x63h - https://github.com/Azure/setup-kubectl/commit/d449d75495d2b9d1463555bb00ca3dca77a42ab6
CVE ID: CVE-2023-23940 State: PUBLISHED Published: 2023-02-03T19:43:11.178Z Last Updated: 2025-03-10T21:16:55.772Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: OpenZeppelin Products: cairo-contracts Problem Types: CWE-347, CWE-345 Description: OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the m
` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9j4-mcp4 - https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299
CVE ID: CVE-2023-23941 State: PUBLISHED Published: 2023-02-03T20:26:52.692Z Last Updated: 2025-03-10T21:16:43.990Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: shopware Products: SwagPayPal Problem Types: CWE-345 Description: SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21. Add
5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/SwagPayPal/security/advisories/GHSA-vxpm-8hcp-qh27 - https://github.com/shopware/SwagPayPal/commit/57db5f4a57ef0a1646b509b415de9f03bf441b08
CVE ID: CVE-2023-23942 State: PUBLISHED Published: 2023-02-06T20:23:06.072Z Last Updated: 2025-03-10T21:15:57.175Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-79 Description: The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no k
allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-64qc-vf6v-8xgg - https://github.com/nextcloud/desktop/pull/5233 - https://hackerone.com/reports/1788598
CVE ID: CVE-2023-23943 State: PUBLISHED Published: 2023-02-06T20:18:33.641Z Last Updated: 2025-03-10T21:16:03.230Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-918 Description: Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app. Additional Analy
5.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6 - https://github.com/nextcloud/mail/pull/7796 - https://hackerone.com/reports/1736390 - https://hackerone.com/reports/1741525 - https://hackerone.com/reports/1746582
CVE ID: CVE-2023-23944 State: PUBLISHED Published: 2023-02-06T19:35:31.498Z Last Updated: 2025-03-10T21:16:09.420Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-312 Description: Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known
e OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g86r-x755-93f4 - https://github.com/nextcloud/mail/pull/7797 - https://hackerone.com/reports/1806275
CVE ID: CVE-2023-23946 State: PUBLISHED Published: 2023-02-14T19:48:00.554Z Last Updated: 2025-02-13T16:44:12.269Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: git Products: git Problem Types: CWE-22 Description: Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workarou
ll appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh - https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd - https://security.gentoo.org/glsa/202312-15
CVE ID: CVE-2023-23947 State: PUBLISHED Published: 2023-02-16T17:39:27.574Z Last Updated: 2025-03-10T21:10:20.291Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-863 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and 2.6.2 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to update any cluster secret. The attacker could use this access to escalate privileges (potentially controlling Kubernetes resources) or to break
t. The attacker could use this access to escalate privileges (potentially controlling Kubernetes resources) or to break Argo CD functionality (by preventing connections to external clusters). A patch for this vulnerability has been released in Argo CD versions 2.6.2, 2.5.11, 2.4.23, and 2.3.17. Two workarounds are available. Either modify the RBAC configuration to completely revoke all `clusters, update` access, or use the `destinations` and `clusterResourceWhitelist` fields to apply similar restrictions as the `namespaces` and `clusterResources` fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advi
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-3jfq-742w-xg8j - https://github.com/argoproj/argo-cd/commit/fbb0b99b1ac3361b253052bd30259fa43a520945
CVE ID: CVE-2023-23948 State: PUBLISHED Published: 2023-02-13T16:30:18.434Z Last Updated: 2025-03-10T21:13:02.126Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ownCloud Products: Android Problem Types: CWE-89 Description: The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in `FileContentProvider.kt`. This issue can lead to information disclosure. Two databases, `filelist` and `owncloud_database`, are affected. In version 3.0, the `filelist` database was deprecated. However, injections affecting `owncloud_database` remain relevant as of versi
0, the `filelist` database was deprecated. However, injections affecting `owncloud_database` remain relevant as of version 3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-059_GHSL-2022-060_Owncloud_Android_app/
CVE ID: CVE-2023-23949 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:36:10.855Z Vendors: n/a Products: Symantec Identity Management And Governance Problem Types: Multiple Reflected Cross-Site Scripting Description: An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/21174
CVE ID: CVE-2023-23950 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:34:15.496Z Vendors: n/a Products: Symantec Identity Management And Governance Problem Types: Response Splitting Description: User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/21174
CVE ID: CVE-2023-23951 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:33:21.236Z Vendors: n/a Products: Symantec Identity Management And Governance Problem Types: Response Splitting Description: Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/21174
CVE ID: CVE-2023-23952 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T19:56:15.293Z Vendors: n/a Products: Advanced Secure Gateway, Content Analysis Problem Types: Command Injection Description: Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22217
CVE ID: CVE-2023-23953 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T19:55:32.677Z Vendors: n/a Products: Advanced Secure Gateway, Content Analysis Problem Types: Elevation of Privilege Description: Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22217
CVE ID: CVE-2023-23954 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T19:50:37.910Z Vendors: n/a Products: Advanced Secure Gateway, Content Analysis Problem Types: Stored Cross-Site Scripting Description: Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22217
CVE ID: CVE-2023-23955 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T19:49:39.015Z Vendors: n/a Products: Advanced Secure Gateway, Content Analysis Problem Types: Server-Side Request Forgery Description: Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22217
CVE ID: CVE-2023-23956 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-14T16:31:01.685Z Vendors: n/a Products: Symantec SiteMinder WebAgent Problem Types: Cross-Site Scripting Description: A user can supply malicious HTML and JavaScript code that will be executed in the client browser Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22221 - http://packetstormsecurity.com/files/173038/Symantec-SiteMinder-WebAgent-12.52-Cross-Site-Scripting.html
CVE ID: CVE-2023-23957 State: PUBLISHED Published: 2023-09-19T12:30:39.763Z Last Updated: 2024-09-25T14:22:08.217Z Vendors: Symantec - A Division of Broadcom Products: Symantec Identity Governance And Administration Description: An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22544
CVE ID: CVE-2023-23958 State: PUBLISHED Published: 2023-09-26T21:51:02.226Z Last Updated: 2024-09-23T20:22:52.722Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Symantec Products: Symantec Protection Engine Problem Types: CWE-200 Description: Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22599
CVE ID: CVE-2023-23969 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T14:17:49.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.1/releases/security/ - https://www.djang
oogle.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.1/releases/security/ - https://www.djangoproject.com/weblog/2023/feb/01/security-releases/ - https://lists.debian.org/debian-lts-announce/2023/02/msg00000.html - https://security.netapp.com/advisory/ntap-20230302-0007/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
CVE ID: CVE-2023-23970 State: PUBLISHED Published: 2023-12-20T19:24:29.785Z Last Updated: 2025-04-24T14:54:36.551Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: WooRockets Products: Corsa Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in WooRockets Corsa.This issue affects Corsa: from n/a through 1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/corsa/wordpress-corsa-theme-1-5-arbitrary-file-upload?_s_id=cve
CVE ID: CVE-2023-23971 State: PUBLISHED Published: 2023-04-06T05:04:10.875Z Last Updated: 2025-02-19T21:35:27.254Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: CodePeople Products: WP Time Slots Booking Form Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodePeople WP Time Slots Booking Form plugin <= 1.1.81 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-1-81-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-23972 State: PUBLISHED Published: 2023-04-06T05:50:34.640Z Last Updated: 2025-01-10T19:10:51.893Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Smplug-in Products: Social Like Box and Page by WpDevArt Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smplug-in Social Like Box and Page by WpDevArt plugin <= 0.8.39 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/like-box/wordpress-social-like-box-and-page-by-wpdevart-plugin-0-8-39-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-23973 State: PUBLISHED Published: 2023-03-01T12:49:28.839Z Last Updated: 2025-01-13T15:55:14.881Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: a3rev Software Products: Contact Us Page – Contact People Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Contact Us Page – Contact People plugin <= 3.7.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contact-us-page-contact-people/wordpress-contact-us-page-contact-people-plugin-3-7-0-cross-site-request-forgery-csrf-leading-to-contact-creation-vulnerabilit
ess-contact-us-page-contact-people-plugin-3-7-0-cross-site-request-forgery-csrf-leading-to-contact-creation-vulnerability?_s_id=cve
CVE ID: CVE-2023-23974 State: PUBLISHED Published: 2023-03-01T12:33:35.686Z Last Updated: 2025-01-13T15:55:21.786Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Fullworks Products: Quick Event Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quick-event-manager/wordpress-quick-event-manager-plugin-9-7-4-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-23975 State: PUBLISHED Published: 2024-12-09T11:31:43.110Z Last Updated: 2024-12-09T18:41:54.728Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Fullworks Products: Quick Event Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in Fullworks Quick Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Event Manager: from n/a through 9.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/quick-event-manager/vulnerability/wordpress-quick-event-manager-plugin-9-7-4-broken-access-control?_s_id=cve
CVE ID: CVE-2023-23976 State: PUBLISHED Published: 2024-04-24T10:48:46.155Z Last Updated: 2024-08-02T10:49:08.168Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Metagauss Products: RegistrationMagic Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.1.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-custom-
.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-custom-registration-forms-user-registration-and-user-login-plugin-plugin-5-1-9-2-arbitrary-price-change?_s_id=cve
CVE ID: CVE-2023-23977 State: PUBLISHED Published: 2023-04-04T12:56:36.232Z Last Updated: 2025-02-19T21:35:45.872Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Team Heateor Products: WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments plugin <= 1.6.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/heateor-social-comments/wordpress-vkontakte-co
Vulnrichment: References: - https://patchstack.com/database/vulnerability/heateor-social-comments/wordpress-vkontakte-comments-and-disqus-comments-plugin-1-6-1-cross-site-scripting-xss?_s_id=cve