Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2329 State: PUBLISHED Published: 2023-07-17T13:29:48.544Z Last Updated: 2024-11-05T19:53:11.383Z Vendors: Unknown Products: WooCommerce Google Sheet Connector Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6e58f099-e8d6-49e4-9f02-d6a556c5b1d2
CVE ID: CVE-2023-2330 State: PUBLISHED Published: 2023-07-17T13:29:57.798Z Last Updated: 2024-10-30T14:03:25.495Z Vendors: Unknown Products: Caldera Forms Google Sheets Connector Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fa8ccdd0-7b23-4b12-9aa9-4b29d47256b8
CVE ID: CVE-2023-2331 State: PUBLISHED Published: 2023-04-27T11:51:45.946Z Last Updated: 2025-01-30T21:00:57.199Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: 42Gears Products: Surelock Windows Problem Types: CWE-428 Description: Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service. This issue affects Surelock Windows : from 2.3.12 through 2.40.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.42gears.com/security-and-compliance
CVE ID: CVE-2023-2332 State: PUBLISHED Published: 2024-11-15T10:57:19.795Z Last Updated: 2024-11-15T21:00:49.061Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially stealing cookies or redirecting users to malicious sites. The
pt code in the context of the user's browser, potentially stealing cookies or redirecting users to malicious sites. The issue is fixed in version 10.5.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c - https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe
CVE ID: CVE-2023-2333 State: PUBLISHED Published: 2023-07-04T07:23:24.093Z Last Updated: 2024-11-21T15:11:13.757Z Vendors: Unknown Products: Ninja Forms Google Sheet Connector, gsheetconnector-ninja-forms-pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerabi
n Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/13c4e065-fde6-41a4-a22b-bca1b10e0d30
CVE ID: CVE-2023-2334 State: PUBLISHED Published: 2025-05-15T20:08:56.575Z Last Updated: 2025-05-16T18:35:06.742Z Vendors: Unknown Products: edd-google-sheet-connector-pro, Easy Digital Downloads Google Sheet Connector Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
he access code to an arbitrary one via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/95562684-2bb1-46f0-838c-8501db6b43ed/
CVE ID: CVE-2023-2335 State: PUBLISHED Published: 2023-04-27T17:55:49.876Z Last Updated: 2025-01-30T20:54:42.317Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: 42gears Products: surelock windows Problem Types: CWE-314, CWE-312 Description: Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin user credentials This issue affects surelock windows: from 2.3.12 through 2.40.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.42gears.com/security-and-compliance/
CVE ID: CVE-2023-2336 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:51:08.170Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-22 Description: Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/af764624-7746-4f53-8480-85348dbb4f14 - https://github.com/pimcore/pimcore/commit/498cadec2292f7842fb10612068ac78496e884b4
CVE ID: CVE-2023-2337 State: PUBLISHED Published: 2023-06-05T13:39:01.309Z Last Updated: 2025-01-08T16:34:19.798Z Vendors: Unknown Products: ConvertKit Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e5a6f834-80a4-406b-acae-57ffeec2e689
CVE ID: CVE-2023-2338 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-02-03T16:28:46.713Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-89 Description: SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/bbf59fa7-cf5b-4945-81b0-328adc710462 - https://github.com/pimcore/pimcore/commit/21e35af721c375ef4676ed50835e30d828e76520
CVE ID: CVE-2023-2339 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-30T21:27:22.267Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/bb1537a5-fe7b-4c77-a582-10a82435fbc2 - https://github.com/pimcore/pimcore/commit/6946f8a5a0a93b516c49f17a5b45044eebd73480
CVE ID: CVE-2023-2340 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:32:58.770Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/964762b0-b4fe-441c-81e1-0ebdbbf80f3b - https://github.com/pimcore/pimcore/commit/aa38319e353cc3cdfac12e03e21ed7a8f3628d3e
CVE ID: CVE-2023-2341 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:32:18.482Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/cf3901ac-a649-478f-ab08-094ef759c11d - https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11
CVE ID: CVE-2023-2342 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:31:35.752Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/01cd3ed5-dce8-4021-9de0-81cb14bf1829 - https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564
CVE ID: CVE-2023-2343 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-30T20:05:15.271Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2fa17227-a717-4b66-ab5a-16bffbb4edb2 - https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e
CVE ID: CVE-2023-2344 State: PUBLISHED Published: 2023-04-27T14:00:06.340Z Last Updated: 2024-08-02T06:19:14.898Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Service Provider Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_service of the component HTTP POST Request Handler. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The
to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227587. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227587 - https://vuldb.com/?ctiid.227587 - http://cdn.polowong.top/image-20230427193041378.png
CVE ID: CVE-2023-2345 State: PUBLISHED Published: 2023-04-27T14:00:08.074Z Last Updated: 2025-01-30T20:55:39.925Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Service Provider Management System Problem Types: CWE-285 Description: A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to improper authorization. The attack may be launched remotely. The identifier of this vulnerability is VDB-227588. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
tifier of this vulnerability is VDB-227588. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.227588 - https://vuldb.com/?ctiid.227588
CVE ID: CVE-2023-2346 State: PUBLISHED Published: 2023-04-27T14:31:03.384Z Last Updated: 2024-08-02T06:19:14.690Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Service Provider Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227589 was assigned to this vulnerability. Ad
ploit has been disclosed to the public and may be used. The identifier VDB-227589 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227589 - https://vuldb.com/?ctiid.227589 - https://github.com/E1CHO/cve_hub/blob/main/Service%20Provider%20Management%20System/Service%20Provider%20Management%20System%20-%20vuln%201.pdf
CVE ID: CVE-2023-2347 State: PUBLISHED Published: 2023-04-27T14:31:04.439Z Last Updated: 2024-08-02T06:19:14.875Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Service Provider Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227590 is the identifier assigned to this vulnerability. Add
ploit has been disclosed to the public and may be used. VDB-227590 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.227590 - https://vuldb.com/?ctiid.227590 - https://github.com/E1CHO/cve_hub/blob/main/Service%20Provider%20Management%20System/Service%20Provider%20Management%20System%20-%20vuln%202.pdf
CVE ID: CVE-2023-2348 State: PUBLISHED Published: 2023-04-27T15:00:07.235Z Last Updated: 2024-08-02T06:19:14.931Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Service Provider Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227591. Addition
as been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227591. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227591 - https://vuldb.com/?ctiid.227591 - https://github.com/E1CHO/cve_hub/blob/main/Service%20Provider%20Management%20System/Service%20Provider%20Management%20System%20-%20vuln%203.pdf
CVE ID: CVE-2023-2349 State: PUBLISHED Published: 2023-04-27T15:00:09.075Z Last Updated: 2024-11-22T19:52:59.163Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Service Provider Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227592. Additional Analyst Notes:
disclosed to the public and may be used. The identifier of this vulnerability is VDB-227592. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.227592 - https://vuldb.com/?ctiid.227592 - https://github.com/E1CHO/cve_hub/blob/main/Service%20Provider%20Management%20System/Service%20Provider%20Management%20System%20-%20vuln%204.pdf
CVE ID: CVE-2023-2350 State: PUBLISHED Published: 2023-04-27T15:31:03.873Z Last Updated: 2024-08-02T06:19:14.787Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Service Provider Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227593 was assigned to this vulnerability. Add
loit has been disclosed to the public and may be used. The identifier VDB-227593 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227593 - https://vuldb.com/?ctiid.227593 - https://github.com/E1CHO/cve_hub/blob/main/Service%20Provider%20Management%20System/Service%20Provider%20Management%20System%20-%20vuln%205.pdf
CVE ID: CVE-2023-2351 State: PUBLISHED Published: 2023-06-13T01:48:06.282Z Last Updated: 2024-12-03T16:36:43.367Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: listingthemes Products: WP Directory Kit Problem Types: CWE-862 Missing Authorization Description: The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_admin' function in versions up to, and including, 1.2.3. This makes it possible for authenticated attackers with subscriber-level permissions or above to delete or change plugin settings, import demo data, delete Directory Kit related posts and ter
l permissions or above to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50c5154c-1573-4c2b-85a1-a89bdb22dc7d?source=cve - https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.1.8/public/class-wpdirectorykit-public.php#L249 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2905046%40wpdirectorykit&new=2905046%40wpdirectorykit&sfp_email=&sfph_mail= - https://plugins.trac.wor
il=&reponame=&old=2905046%40wpdirectorykit&new=2905046%40wpdirectorykit&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2905795%40wpdirectorykit&new=2905795%40wpdirectorykit&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2907164%40wpdirectorykit&new=2907164%40wpdirectorykit&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2917413%40wpdirectorykit&new=2917413%40wpdirectorykit&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2352 State: PUBLISHED Published: 2023-08-31T05:33:13.592Z Last Updated: 2024-09-27T19:09:47.254Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: sureshchand12a Products: CHP Ads Block Detector Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is due to missing or incorrect nonce validation on the chp_abd_action function. This makes it possible for unauthenticated attackers to update or reset plugin settings via a forged request granted they can trick a site administrator into performing
kers to update or reset plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a9cced-0e5e-4b6e-8291-0a862c9f9523?source=cve - https://plugins.trac.wordpress.org/changeset/2920522/chp-ads-block-detector - https://plugins.trac.wordpress.org/changeset/2922313/chp-ads-block-detector - https://plugins.trac.wordpress.org/changeset/2926660/chp-ads-block-detector
CVE ID: CVE-2023-2353 State: PUBLISHED Published: 2023-08-31T05:33:07.617Z Last Updated: 2024-09-27T14:23:19.915Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: sureshchand12a Products: CHP Ads Block Detector Problem Types: CWE-862 Missing Authorization Description: The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd_action function in versions up to, and including, 3.9.4. This makes it possible for subscriber-level attackers to change or reset plugin settings. CVE-2023-36509 appears to be a duplicate of this issue. Additional Analyst Notes: - CVE Pro
ge or reset plugin settings. CVE-2023-36509 appears to be a duplicate of this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4eca64d7-6e33-4b8e-af37-a3e8bbf2b76f?source=cve - https://plugins.trac.wordpress.org/changeset/2920522/chp-ads-block-detector - https://plugins.trac.wordpress.org/changeset/2922313/chp-ads-block-detector - https://plugins.trac.wordpress.org/changeset/2926660/chp-ads-block-detector
CVE ID: CVE-2023-2354 State: PUBLISHED Published: 2023-08-31T05:33:10.827Z Last Updated: 2024-09-27T14:20:54.348Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sureshchand12a Products: CHP Ads Block Detector Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The CHP Ads Block Detector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings reachable though an AJAX action in versions up to, and including, 3.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and ab
zation and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8514c9-0e11-4e26-ba0b-1d08a990b56c?source=cve - https://plugins.trac.wordpress.org/changeset/2920522/chp-ads-block-detector - https://plugins.trac.wordpress.org/changeset/2922313/chp-ads-block-detector - https://plugins.trac.wordpress.org/changeset/2926660/chp-ads-block-detector
CVE ID: CVE-2023-2355 State: PUBLISHED Published: 2023-04-27T18:45:26.176Z Last Updated: 2025-01-30T20:49:56.542Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Snap Deploy Problem Types: CWE-427 Description: Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3900. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-4048