Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0418 State: PUBLISHED Published: 2023-04-24T18:31:00.385Z Last Updated: 2025-02-04T16:13:23.146Z Vendors: Unknown Products: Video Central for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/821751bb-feaf-45b8-91a9-e173cb0c05fc
CVE ID: CVE-2023-0419 State: PUBLISHED Published: 2023-02-21T08:51:05.416Z Last Updated: 2025-03-12T15:20:25.781Z Vendors: Unknown Products: Shortcode for Font Awesome Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5ccfee43-920d-4613-b976-2ea8966696ba
CVE ID: CVE-2023-0420 State: PUBLISHED Published: 2023-04-24T18:30:49.071Z Last Updated: 2025-02-04T18:44:24.334Z Vendors: Unknown Products: Custom Post Type and Taxonomy GUI Manager Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/266e417f-ece7-4ff5-a724-4d9c8e2f3
ram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/266e417f-ece7-4ff5-a724-4d9c8e2f3faa
CVE ID: CVE-2023-0421 State: PUBLISHED Published: 2023-05-08T13:58:04.382Z Last Updated: 2025-05-05T16:09:09.983Z Vendors: Unknown Products: Cloud Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a356fea0-f143-4736-b2b2-c545c525335c
CVE ID: CVE-2023-0422 State: PUBLISHED Published: 2023-04-10T13:18:01.633Z Last Updated: 2025-05-05T16:08:57.576Z Vendors: Unknown Products: Article Directory Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d57f2fb2-5251-4069-8c9a-a4af269c5e62
CVE ID: CVE-2023-0423 State: PUBLISHED Published: 2023-04-10T13:18:02.898Z Last Updated: 2025-02-11T21:18:03.509Z Vendors: Unknown Products: WordPress Amazon S3 Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/73d588d7-26ae-42e2-8282-aa02bcb109b6
CVE ID: CVE-2023-0424 State: PUBLISHED Published: 2023-04-24T18:30:57.743Z Last Updated: 2025-02-04T16:16:30.855Z Vendors: Unknown Products: MS-Reviews Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b0f8713f-54b2-4ab2-a475-60a1692a50e9
CVE ID: CVE-2023-0425 State: PUBLISHED Published: 2023-08-07T05:06:46.584Z Last Updated: 2024-12-04T15:38:30.902Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: ABB Products: Freelance controllers AC 700F, Freelance controllers AC 900F Problem Types: CWE-839 Description: ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance. An attacker who successfully exploited one or more of these vulnerabilities could cause the product to stop or make the product inaccessible. Numeric Range Comparison Without Minimum Check vulnerability in ABB Freela
uct to stop or make the product inaccessible. Numeric Range Comparison Without Minimum Check vulnerability in ABB Freelance controllers AC 700F (Controller modules), ABB Freelance controllers AC 900F (controller modules).This issue affects: Freelance controllers AC 700F: from 9.0;0 through V9.2 SP2, through Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 2019 SP1 FP1; Freelance controllers AC 900F: Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 2019 SP1 FP1. Addi
016, through Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 2019 SP1 FP1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=7PAA007517&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.68514131.339223974.1691382343-1911411808.1686627590
CVE ID: CVE-2023-0426 State: PUBLISHED Published: 2023-08-07T05:23:45.868Z Last Updated: 2024-11-07T15:48:28.656Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: ABB Products: Freelance controllers AC 700F, Freelance controllers AC 900F Problem Types: CWE-121 Description: ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance. An attacker who successfully exploited one or more of these vulnerabilities could cause the product to stop or make the product inaccessible. Stack-based Buffer Overflow vulnerability in ABB Freelance controllers AC
uct to stop or make the product inaccessible. Stack-based Buffer Overflow vulnerability in ABB Freelance controllers AC 700F (conroller modules), ABB Freelance controllers AC 900F (controller modules).This issue affects: Freelance controllers AC 700F: from 9.0;0 through V9.2 SP2, through Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019 , through Freelance 2019 SP1, through Freelance 2019 SP1 FP1; Freelance controllers AC 900F: through Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 2019 SP1 FP1. Additional Anal
h Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 2019 SP1 FP1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=7PAA007517&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.68514131.339223974.1691382343-1911411808.1686627590
CVE ID: CVE-2023-0428 State: PUBLISHED Published: 2023-02-21T08:50:56.586Z Last Updated: 2025-03-12T20:26:43.909Z Vendors: Unknown Products: Watu Quiz Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c933460b-f77d-4986-9f5a-32d9f3f8b412
CVE ID: CVE-2023-0429 State: PUBLISHED Published: 2023-02-21T08:50:57.365Z Last Updated: 2025-03-12T20:24:08.716Z Vendors: Unknown Products: Watu Quiz Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/67d84549-d368-4504-9fa9-b1fce63cb967
CVE ID: CVE-2023-0430 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T18:21:53.874Z Vendors: Mozilla Products: Thunderbird Problem Types: Revocation status of S/Mime signature certificates was not checked Description: Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-04/ - https://bugzilla.mo
r: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-04/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1769000
CVE ID: CVE-2023-0431 State: PUBLISHED Published: 2023-06-12T17:28:21.850Z Last Updated: 2025-01-03T14:50:20.380Z Vendors: Unknown Products: File Away Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fdcbd9a3-552d-439e-b283-1d3d934889af
CVE ID: CVE-2023-0432 State: PUBLISHED Published: 2023-03-31T15:51:02.512Z Last Updated: 2025-01-17T17:16:16.964Z Vendors: Delta Electronics Products: DX-2100-L1-CN Problem Types: CWE-79 Description: The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system (OS) from the device in the context of the user "root." If the attacker has credentials for the web service, then the device could be fully compromised. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-033-05
CVE ID: CVE-2023-0433 State: PUBLISHED Published: 2023-01-21T00:00:00.000Z Last Updated: 2025-04-02T13:55:39.895Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ae933869-a1ec-402a-bbea-d51764c6618e - https://github.com/vim/vim/commit/11977f917506d950b7e0cae558bd9189260b253b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWIJBSQX53P7DHV77KRXJIXA4GH7XHC/ - https:/
project.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWIJBSQX53P7DHV77KRXJIXA4GH7XHC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EX6N2DB75A73MQGVW3CS4VTNPAYVM2M/ - https://support.apple.com/kb/HT213677 - https://support.apple.com/kb/HT213675 - https://support.apple.com/kb/HT213670 - http://seclists.org/fulldisclosure/2023/Mar/17 - http://seclists.org/fulldisclosure/2023/Mar/18 - http://seclists.org/fulldisclosure/2023/Mar/21
CVE ID: CVE-2023-0434 State: PUBLISHED Published: 2023-01-22T00:00:00.000Z Last Updated: 2025-04-02T15:51:41.649Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H) Vendors: pyload Products: pyload/pyload Problem Types: CWE-20 Description: Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7d9332d8-6997-483b-9fb9-bcf2ae01dad4 - https://github.com/pyload/pyload/commit/a2b1eb1028f45ac58dea5f58593c1d3db2b4a104
CVE ID: CVE-2023-0435 State: PUBLISHED Published: 2023-01-22T00:00:00.000Z Last Updated: 2025-04-02T15:50:20.297Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: pyload Products: pyload/pyload Problem Types: CWE-1125 Description: Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a3e32ad5-caee-4f43-b10a-4a876d4e3f1d - https://github.com/pyload/pyload/commit/431ea6f0371d748df66b344a05ca1a8e0310cff3
CVE ID: CVE-2023-0436 State: PUBLISHED Published: 2023-11-07T11:44:47.971Z Last Updated: 2024-08-02T05:10:56.307Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: MongoDB Inc Products: MongoDB Atlas Kubernetes Operator Problem Types: CWE-532 Description: The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version. R
t this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version. Required Configuration: DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 ) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1
CVE ID: CVE-2023-0437 State: PUBLISHED Published: 2024-01-12T13:33:39.503Z Last Updated: 2025-11-03T19:27:57.046Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: MongoDB Inc Products: MongoDB C Driver Problem Types: CWE-835 Description: When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/CDRIVER-4747 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.
ra.mongodb.org/browse/CDRIVER-4747 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GUVOAFZFSYTNBF6R7H4XJM5DHWBRQ6P/
CVE ID: CVE-2023-0438 State: PUBLISHED Published: 2023-01-23T00:00:00.000Z Last Updated: 2025-04-03T16:58:48.502Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: modoboa Products: modoboa/modoboa Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/07a5b61b-306d-47c4-8ff0-06c540c7dfb3 - https://github.com/modoboa/modoboa/commit/38d778cc71e370216e067d054ce0169ad83078c8
CVE ID: CVE-2023-0439 State: PUBLISHED Published: 2023-07-17T13:29:58.934Z Last Updated: 2024-10-30T14:02:35.287Z Vendors: Unknown Products: NEX-Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/04cea9aa-b21c-49f8-836b-2d312253e09a
CVE ID: CVE-2023-0440 State: PUBLISHED Published: 2023-01-23T00:00:00.000Z Last Updated: 2025-04-03T16:58:22.894Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: healthchecks Products: healthchecks/healthchecks Problem Types: CWE-203 Description: Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/208a096f-7986-4eed-8629-b7285348a686 - https://github.com/healthchecks/healthchecks/commit/359edbd2709e27b60687061a32e19322bc971c1f
CVE ID: CVE-2023-0441 State: PUBLISHED Published: 2023-03-27T15:37:16.230Z Last Updated: 2025-02-19T16:56:02.620Z Vendors: Unknown Products: Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery Problem Types: CWE-862 Missing Authorization Description: The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role. Additional Analyst Notes:
ss options which could be used to enable registration with a default administrator user role. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/11703e49-c042-4eb6-9a5f-6e006e3725a0
CVE ID: CVE-2023-0442 State: PUBLISHED Published: 2023-02-21T08:51:06.188Z Last Updated: 2025-03-12T13:27:36.989Z Vendors: Unknown Products: Loan Comparison Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/34d95d88-4114-4597-b4db-e9f5ef80d322
CVE ID: CVE-2023-0443 State: PUBLISHED Published: 2023-05-30T07:49:18.666Z Last Updated: 2025-01-10T20:54:41.785Z Vendors: Unknown Products: AnyWhere Elementor Problem Types: CWE-200 Information Exposure Description: The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/471f3226-8f90-43d1-b826-f11ef4bbd602
CVE ID: CVE-2023-0444 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-03T20:08:36.897Z Vendors: n/a Products: Delta Electronics InfraSuite Device Master 00.00.02a Problem Types: Privilege Escalation Description: A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the 'Read Only User' group, can view the password of another default user 'Administrator', which is in the 'Administrator' group. This allows any lower privileged user to log in as an administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/res
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-4
CVE ID: CVE-2023-0446 State: PUBLISHED Published: 2023-01-23T16:25:53.272Z Last Updated: 2025-01-13T17:10:57.059Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: urkekg Products: My YouTube Channel Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scri
es it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d979f899-8cdc-4230-b1b5-865c025dc86a - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2844200%40youtube-channel&new=2844200%40youtube-channel&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0447 State: PUBLISHED Published: 2023-01-23T16:30:26.228Z Last Updated: 2025-01-13T17:10:45.190Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: urkekg Products: My YouTube Channel Problem Types: CWE-862 Missing Authorization Description: The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions up to, and including, 3.0.12.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to clear the plugin's cache. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
o clear the plugin's cache. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/486b6a75-d101-4f3a-8436-6c23dd0ff200 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2844200%40youtube-channel&new=2844200%40youtube-channel&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/browser/youtube-channel/trunk/youtube-channel.php?rev=2482795#L1502
CVE ID: CVE-2023-0448 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:24:19.315Z Vendors: n/a Products: WP Helper Lite Wordpress Plugin Problem Types: Reflected Cross-Site Scripting Description: The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-3
CVE ID: CVE-2023-0449 State: REJECTED Published: N/A Last Updated: 2025-04-14T17:03:50.684Z Description: No description available.