Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-27592 State: PUBLISHED Published: 2023-03-17T19:04:00.630Z Last Updated: 2025-02-25T14:53:55.753Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: miniflux Products: v2 Problem Types: CWE-79 Description: Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the `html.ServerError` is returned unescaped without the expected Content Security Policy header added to valid responses. By creating an RSS feed item with the inline description containing an `<img>` tag with a `srcset` attribute pointing to an invalid
an RSS feed item with the inline description containing an `<img>` tag with a `srcset` attribute pointing to an invalid URL like `http:a<script>alert(1)</script>`, we can coerce the proxy handler into an error condition where the invalid URL is returned unescaped and in full. This results in JavaScript execution on the Miniflux instance as soon as the user is convinced (e.g. by a message in the alt text) to open the broken image. An attacker can execute arbitrary JavaScript in the context of a victim Miniflux user when they open a broken image in a crafted RSS feed. This can be used to perform actions on the Miniflux instance as that user and gain administrative access to the Miniflux insta
an be used to perform actions on the Miniflux instance as that user and gain administrative access to the Miniflux instance if it is reachable and the victim is an administrator. A patch is available in version 2.0.43. As a workaround sisable image proxy; default value is `http-only`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/miniflux/v2/security/advisories/GHSA-mqqg-xjhj-wfgw - https://github.com/miniflux/v2/pull/1746 - https://github.com/miniflux/v2/blob/b2fd84e0d376a3af6329b9bb2e772ce38a25c31c/ui/proxy.go#L76 - https://github.com/miniflux/v2/blob/b2fd84e0d376a3af6329b9bb2e772ce38a25c31c/ui/proxy.go#L90 - https://github.com
#L76 - https://github.com/miniflux/v2/blob/b2fd84e0d376a3af6329b9bb2e772ce38a25c31c/ui/proxy.go#L90 - https://github.com/miniflux/v2/releases/tag/2.0.25 - https://github.com/miniflux/v2/releases/tag/2.0.43 - https://miniflux.app/docs/configuration.html#proxy-images
CVE ID: CVE-2023-27593 State: PUBLISHED Published: 2023-03-17T19:51:16.689Z Last Updated: 2025-02-25T14:53:40.623Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: cilium Products: cilium Problem Types: CWE-276 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an attacker with access to a Cilium agent pod can write to `/opt/cni/bin` due to a `hostPath` mount of that directory in the agent pod. By replacing the CNI binary with their own malicious binary and waiting for the creation of a new pod on the node, the attacker can gain access to the underlying node. T
ous binary and waiting for the creation of a new pod on the node, the attacker can gain access to the underlying node. The issue has been fixed and the fix is available on versions 1.11.15, 1.12.8, and 1.13.1. Some workarounds are available. Kubernetes RBAC should be used to deny users and service accounts `exec` access to Cilium agent pods. In cases where a user requires `exec` access to Cilium agent pods, but should not have access to the underlying node, no workaround is possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-4hc4-pgfx-3mrx - https://github.com/cilium/cilium/pull/24075 -
ttps://github.com/cilium/cilium/security/advisories/GHSA-4hc4-pgfx-3mrx - https://github.com/cilium/cilium/pull/24075 - https://github.com/cilium/cilium/releases/tag/v1.11.15 - https://github.com/cilium/cilium/releases/tag/v1.12.8 - https://github.com/cilium/cilium/releases/tag/v1.13.1 - https://kubernetes.io/docs/reference/access-authn-authz/rbac/
CVE ID: CVE-2023-27594 State: PUBLISHED Published: 2023-03-17T19:56:43.687Z Last Updated: 2025-02-25T14:53:31.518Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: cilium Products: cilium Problem Types: CWE-285 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, identifying external traffic as coming from the host on which Cilium is running. As a consequence, network policies for that cluster might be bypassed, depending on the specific network policies enabled. Thi
onsequence, network policies for that cluster might be bypassed, depending on the specific network policies enabled. This issue only manifests when Cilium is routing IPv6 traffic and NodePorts are used to route traffic to pods. IPv6 and endpoint routes are both disabled by default. The problem has been fixed and is available on versions 1.11.15, 1.12.8, and 1.13.1. As a workaround, disable IPv6 routing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-8fg8-jh2h-f2hc - https://github.com/cilium/cilium/releases/tag/v1.11.15 - https://github.com/cilium/cilium/releases/tag/v1.12.8 - https://github.
github.com/cilium/cilium/releases/tag/v1.11.15 - https://github.com/cilium/cilium/releases/tag/v1.12.8 - https://github.com/cilium/cilium/releases/tag/v1.13.1
CVE ID: CVE-2023-27595 State: PUBLISHED Published: 2023-03-17T21:12:00.903Z Last Updated: 2025-02-25T14:53:22.413Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: cilium Products: cilium Problem Types: CWE-755 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In version 1.13.0, when Cilium is started, there is a short period when Cilium eBPF programs are not attached to the host. During this period, the host does not implement any of Cilium's featureset. This can cause disruption to newly established connections during this period due to the lack of Load Balancing, or can cause Network Policy bypass due t
y established connections during this period due to the lack of Load Balancing, or can cause Network Policy bypass due to the lack of Network Policy enforcement during the window. This vulnerability impacts any Cilium-managed endpoints on the node (such as Kubernetes Pods), as well as the host network namespace (including Host Firewall). This vulnerability is fixed in Cilium 1.13.1 or later. Cilium releases 1.12.x, 1.11.x, and earlier are not affected. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-r5x6-w42p-jhpp - https://github.com/cilium/cilium/pull/24336 -
ttps://github.com/cilium/cilium/security/advisories/GHSA-r5x6-w42p-jhpp - https://github.com/cilium/cilium/pull/24336 - https://github.com/cilium/cilium/releases/tag/v1.13.1
CVE ID: CVE-2023-27596 State: PUBLISHED Published: 2023-03-15T20:09:14.359Z Last Updated: 2025-02-25T14:57:18.710Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-770 Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed SDP body is sent multiple times to an OpenSIPS configuration that makes use of the `stream_process` function. This issue was discovered during coverage guided fuzzing of the function `codec_delete_except_re`. By abusing this vulnerability, an attacker is able to crash the server. It affects configura
n `codec_delete_except_re`. By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. This issue has been fixed in version 3.1.8 and 3.2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-3ghx-j39m-cw4f - https://github.com/OpenSIPS/opensips/commit/dd051f8ed5ae3347fb1d556ced3c97822c9d8450
CVE ID: CVE-2023-27597 State: PUBLISHED Published: 2023-03-15T20:17:20.536Z Last Updated: 2025-02-25T14:57:11.890Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-20 Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, when a specially crafted SIP message is processed by the function `rewrite_ruri`, a crash occurs due to a segmentation fault. This issue causes the server to crash. It affects configurations containing functions that make use of the affected code, such as the function `setport`. This issue has been fixed in version 3.1.8 and 3.2.5. Ad
make use of the affected code, such as the function `setport`. This issue has been fixed in version 3.1.8 and 3.2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-358f-935m-7p9c - https://github.com/OpenSIPS/opensips/commit/b2dffe4b5cd81182c9c8eabb6c96aac96c7acfe3
CVE ID: CVE-2023-27598 State: PUBLISHED Published: 2023-03-15T20:29:49.673Z Last Updated: 2025-02-25T14:57:06.043Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-908 Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed `Via` header to OpenSIPS triggers a segmentation fault when the function `calc_tag_suffix` is called. A specially crafted `Via` header, which is deemed correct by the parser, will pass uninitialized strings to the function `MD5StringArray` which leads to the crash. Abuse of this vulnerability leads to Denial of Se
zed strings to the function `MD5StringArray` which leads to the crash. Abuse of this vulnerability leads to Denial of Service due to a crash. Since the uninitialized string points to memory location `0x0`, no further exploitation appears to be possible. No special network privileges are required to perform this attack, as long as the OpenSIPS configuration makes use of functions such as `sl_send_reply` or `sl_gen_totag` that trigger the vulnerable code. This issue has been fixed in versions 3.1.7 and 3.2.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-wxfg-3gwh-rhvx - https://github.com
ichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-wxfg-3gwh-rhvx - https://github.com/OpenSIPS/opensips/commit/ab611f74f69d9c42be5401c40d56ea06a58f5dd7 - https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE ID: CVE-2023-27599 State: PUBLISHED Published: 2023-03-15T20:58:06.736Z Last Updated: 2025-02-25T14:56:53.351Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-20 Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, when the function `append_hf` handles a SIP message with a malformed To header, a call to the function `abort()` is performed, resulting in a crash. This is due to the following check in `data_lump.c:399` in the function `anchor_lump`. An attacker abusing this vulnerability will crash OpenSIPS leading to Denial of Service. It affects
tion `anchor_lump`. An attacker abusing this vulnerability will crash OpenSIPS leading to Denial of Service. It affects configurations containing functions that make use of the affected code, such as the function `append_hf`. This issue has been fixed in versions 3.1.7 and 3.2.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-qvj2-vqrg-f5jx - https://github.com/OpenSIPS/opensips/commit/cb56694d290530ac308f44b453c18120b1c1109d - https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE ID: CVE-2023-27600 State: PUBLISHED Published: 2023-03-15T21:14:33.131Z Last Updated: 2025-02-25T14:56:44.542Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-20 Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`). The vulnerability was found while performing black-box fuzzing against an OpenSIPS
erminate by a line feed (i.e. `\n`). The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`). By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is per
tions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue is patched in versions 3.1.7 and 3.2.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx - https://github.com/OpenSIPS/opensips/commit/c6ab3bb406c447e30c7d33a1a8970048b4612100 - https://opensips.org/docs/modules/3.3.x/sipmsgops.html - https://opensips.org/pub/audit-2022/opensips-audit-technical-
- https://opensips.org/docs/modules/3.3.x/sipmsgops.html - https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE ID: CVE-2023-27601 State: PUBLISHED Published: 2023-03-15T21:32:56.061Z Last Updated: 2025-02-25T14:56:36.328Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-20 Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`). The vulnerability was found while performing black-box fuzzing against an OpenSIPS
erminate by a line feed (i.e. `\n`). The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`): By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is per
tions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h - https://github.com/OpenSIPS/opensips/commit/8f87c7c03da55f9c79bd92e67fa2c94b2a7ce5cf - https://opensips.org/docs/modules/3.3.x/sipmsgops.html - https://opensips.org/pub/audit-2022/opensips-audit-techni
5cf - https://opensips.org/docs/modules/3.3.x/sipmsgops.html - https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE ID: CVE-2023-27602 State: PUBLISHED Published: 2023-04-10T07:36:28.437Z Last Updated: 2025-02-13T16:45:29.640Z Vendors: Apache Software Foundation Products: Apache Linkis Problem Types: CWE-434 Description: In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users upgrade the version of Linkis to version 1.3.2. For versions <=1.3.1, we suggest turning on the file path check switch in linkis.properties `wds.linkis.workspace.filesystem.owner.check=true` `wds.linkis.workspace.filesystem.path.check=true` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
filesystem.path.check=true` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/wt70jfc0yfs6s5g0wg5dr5klnc48nsp1 - http://www.openwall.com/lists/oss-security/2023/04/10/1 - http://www.openwall.com/lists/oss-security/2023/04/18/4 - http://www.openwall.com/lists/oss-security/2023/04/19/3
CVE ID: CVE-2023-27603 State: PUBLISHED Published: 2023-04-10T07:36:50.250Z Last Updated: 2024-10-22T15:24:50.114Z Vendors: Apache Software Foundation Products: Apache Linkis Problem Types: CWE-22 Description: In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We recommend users upgrade the version of Linkis to version 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/6n1vlvnyn441rm02zdqc0wnpckj8ltn8 - https://www.openwall.com/lists/oss-security/2023/04/10/2
CVE ID: CVE-2023-27604 State: PUBLISHED Published: 2023-08-28T07:47:29.702Z Last Updated: 2024-09-27T18:46:43.906Z Vendors: Apache Software Foundation Products: Apache Airflow Sqoop Provider Problem Types: CWE-20 Description: Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections. It is recommended to upgrade to a version that is not affected. This issue was reported independently by hap
onnections. It is recommended to upgrade to a version that is not affected. This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/33039 - https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd
CVE ID: CVE-2023-27605 State: PUBLISHED Published: 2023-11-06T08:11:23.851Z Last Updated: 2024-09-05T14:04:18.325Z Vendors: Sajjad Hossain Products: WP Reroute Email Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sajjad Hossain WP Reroute Email allows SQL Injection.This issue affects WP Reroute Email: from n/a through 1.4.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-reroute-email/wordpress-wp-reroute-email-plugin-1-4-6-admin-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-27606 State: PUBLISHED Published: 2023-07-17T10:28:56.935Z Last Updated: 2024-10-07T15:10:51.204Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Sajjad Hossain Products: WP Reroute Email Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Sajjad Hossain WP Reroute Email plugin <= 1.4.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-reroute-email/wordpress-wp-reroute-email-plugin-1-4-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-27607 State: PUBLISHED Published: 2024-03-21T17:15:07.023Z Last Updated: 2024-08-02T12:16:36.011Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: WP Swings Products: Points and Rewards for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/points-and-rewards-for-woocommerce/wordpress-points-and-rewards-for-woocommerce-plugin-1-5-0-settings-change-vuln
bility/points-and-rewards-for-woocommerce/wordpress-points-and-rewards-for-woocommerce-plugin-1-5-0-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2023-27608 State: PUBLISHED Published: 2024-03-25T11:12:54.772Z Last Updated: 2024-08-02T12:16:36.885Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: WP Swings Products: Points and Rewards for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/points-and-rewards-for-woocommerce/wordpress-points-and-rewards-for-woocommerce-plugin-1-5-0-broken-access-contro
bility/points-and-rewards-for-woocommerce/wordpress-points-and-rewards-for-woocommerce-plugin-1-5-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-27609 State: PUBLISHED Published: 2024-11-19T21:56:18.060Z Last Updated: 2024-11-20T14:16:09.770Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: NetTantra Products: WP Roles at Registration Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in NetTantra WP Roles at Registration allows Stored XSS.This issue affects WP Roles at Registration: from n/a through 0.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-roles-at-registration/wordpress-wp-roles-at-registration-plugin-0-23-cross-site
patchstack.com/database/vulnerability/wp-roles-at-registration/wordpress-wp-roles-at-registration-plugin-0-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-27610 State: PUBLISHED Published: 2023-04-16T07:41:13.603Z Last Updated: 2025-01-10T18:54:21.776Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) Vendors: TransbankDevelopers Products: Transbank Webpay REST Problem Types: CWE-89 Description: Auth. (admin+) SQL Injection (SQLi) vulnerability in TransbankDevelopers Transbank Webpay REST plugin <= 1.6.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/transbank-webpay-plus-rest/wordpress-transbank-webpay-rest-plugin-1-6-7-admin-sql-injection-vulnerability?_s_id=cve