Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-38498 State: PUBLISHED Published: 2023-07-28T15:18:18.903Z Last Updated: 2024-10-10T16:04:31.421Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-400, CWE-770 Description: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no kno
version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability. Users of multisite configurations should upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-wv29-rm3f-4g2j - https://github.com/discourse/discourse/commit/26e267478d785e2f32ee7da4613e2cf4a65ff182
CVE ID: CVE-2023-38499 State: PUBLISHED Published: 2023-07-25T20:54:41.648Z Last Updated: 2024-10-15T18:40:37.114Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-200 Description: TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that
allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-jq6g-4v5m-wm9r - https://github.com/TYPO3/typo3/commit/702e2debd4b28f9cdb540544565fe6a8627ccb6a - https://typo3.org/security/advisory/typo3-core-sa-2023-003
CVE ID: CVE-2023-38500 State: PUBLISHED Published: 2023-07-25T20:59:53.135Z Last Updated: 2024-10-10T17:36:20.315Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: TYPO3 Products: html-sanitizer Problem Types: CWE-79 Description: TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enab
script` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g - https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb - https://typo3.org/security/advisory/typo3-core-sa-2023-002
CVE ID: CVE-2023-38501 State: PUBLISHED Published: 2023-07-25T21:06:18.006Z Last Updated: 2025-02-13T17:01:52.251Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: 9001 Products: copyparty Problem Types: CWE-79 Description: copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one'
he malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/9001/copyparty/security/advisories/GHSA-f54q-j679-p9hh - https://github.com/9001/copyparty/commit/007d948cb982daa05bc6619cd20ee55b7e834c38 - http://packetstormsecurity.com/files/173821/Copyparty-1.8.6-Cross-Site-Scripting.html
CVE ID: CVE-2023-38502 State: PUBLISHED Published: 2023-07-25T21:14:22.087Z Last Updated: 2024-10-10T17:55:22.396Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: taosdata Products: TDengine Problem Types: CWE-20 Description: TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/taosdata/TDengine/security/advisor
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/taosdata/TDengine/security/advisories/GHSA-w23f-r2fm-27hf
CVE ID: CVE-2023-38503 State: PUBLISHED Published: 2023-07-25T22:06:00.476Z Last Updated: 2024-10-10T17:46:06.598Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-200 Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters (i.e. `user_created IS $CURRENT_USER`) are not properly checked when using GraphQL subscription resulting in unauthorized users getting event on their subscription which they should not be receiving according to the permissions. This can be any collection but out-of-the box the
tion which they should not be receiving according to the permissions. This can be any collection but out-of-the box the `directus_users` collection is configured with such a permissions filter allowing you to get updates for other users when changes happen. Version 10.5.0 contains a patch. As a workaround, disable GraphQL subscriptions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-gggm-66rh-pp98 - https://github.com/directus/directus/pull/19155
CVE ID: CVE-2023-38504 State: PUBLISHED Published: 2023-07-27T18:12:05.419Z Last Updated: 2024-10-03T18:39:16.029Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: balderdashy Products: sails Problem Types: CWE-248 Description: Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js` client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/balderdashy/sails/security/advisories/GHSA-g
rogram Container: - CISA ADP Vulnrichment: References: - https://github.com/balderdashy/sails/security/advisories/GHSA-gpw9-fwm8-7rx7 - https://github.com/balderdashy/sails/pull/7287 - https://github.com/balderdashy/sails/commit/4a023dc5095a4b30fdc8535f705ed34cd22d2f7d - https://github.com/balderdashy/sails/releases/tag/v1.5.7
CVE ID: CVE-2023-38505 State: PUBLISHED Published: 2023-07-27T18:49:29.182Z Last Updated: 2024-10-10T16:07:41.956Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ravenclaw900 Products: DietPi-Dashboard Problem Types: CWE-410, CWE-412 Description: DietPi-Dashboard is a web dashboard for the operating system DietPi. The dashboard only allows for one TLS handshake to be in process at a given moment. Once a TCP connection is established in HTTPS mode, it will assume that it should be waiting for a handshake, and will stay this way indefinitely until a handshake starts or some error occurs. In version 0.6.1, this can be exploited by simply not starting the handsha
ntil a handshake starts or some error occurs. In version 0.6.1, this can be exploited by simply not starting the handshake, preventing any other TLS handshakes from getting through. An attacker can lock the dashboard in a state where it is waiting for a TLS handshake from the attacker, who won't provide it. This prevents any legitimate traffic from getting to the dashboard, and can last indefinitely. Version 0.6.2 has a patch for this issue. As a workaround, do not use HTTPS mode on the open internet where anyone can connect. Instead, put a reverse proxy in front of the dashboard, and have it handle any HTTPS connections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
hboard, and have it handle any HTTPS connections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ravenclaw900/DietPi-Dashboard/security/advisories/GHSA-3jr4-9rxf-fr44 - https://github.com/ravenclaw900/DietPi-Dashboard/pull/606 - https://github.com/ravenclaw900/DietPi-Dashboard/commit/79cd78615d28f577454415e4baafe4dcd9d09666 - https://asciinema.org/a/8nRKbdf7AkPLmP3QxFZUSmPwp?t=7
CVE ID: CVE-2023-38506 State: PUBLISHED Published: 2024-06-21T19:43:24.161Z Last Updated: 2024-08-02T17:46:55.757Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: laurent22 Products: joplin Problem Types: CWE-79 Description: Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized (or not sanitized properly). As such, the `onload` attribute of pasted images can execute arbitrary code. Because the TinyMCE editor frame does not use the `sandbox` attribute, such scripts can acc
can execute arbitrary code. Because the TinyMCE editor frame does not use the `sandbox` attribute, such scripts can access NodeJS's `require` through the `top` variable. From this, an attacker can run arbitrary commands. This issue has been addressed in version 2.12.10 and users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/laurent22/joplin/security/advisories/GHSA-m59c-9rrj-c399
CVE ID: CVE-2023-38507 State: PUBLISHED Published: 2023-09-15T19:15:06.391Z Last Updated: 2024-09-25T18:05:58.465Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: strapi Products: strapi Problem Types: CWE-770 Description: Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12.1 has a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/strapi/str
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/strapi/strapi/security/advisories/GHSA-24q2-59hm-rh9r - https://github.com/strapi/strapi/blob/32d68f1f5677ed9a9a505b718c182c0a3f885426/packages/core/admin/server/middlewares/rateLimit.js#L31 - https://github.com/strapi/strapi/releases/tag/v4.12.1
CVE ID: CVE-2023-38508 State: PUBLISHED Published: 2023-08-24T22:33:35.676Z Last Updated: 2024-10-02T18:54:16.704Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-285, CWE-862 Description: Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, the preview of an artifact link with a type does not respect the project, tracker and artifact level permissions. The issue occurs on the artifact view (not reproducible on the artifact modal). Users might get
fact level permissions. The issue occurs on the artifact view (not reproducible on the artifact modal). Users might get access to information they should not have access to. Only the title, status, assigned to and last update date fields as defined by the semantics are impacted. If those fields have strict permissions (e.g. the title is only visible to a specific user group) those permissions are still enforced. Tuleap Community Edition 14.11.99.28, Tuleap Enterprise Edition 14.10-6, and Tuleap Enterprise Edition 14.11-3 contain a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-h637-g4xp-2992 - https://github.com/Enalean/tuleap/commit/307c1c8044522a2dcc711062b18a3b3f9059a6c3 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=307c1c8044522a2dcc711062b18a3b3f9059a6c3 - https://tuleap.net/plugins/tracker/?aid=33608
CVE ID: CVE-2023-38509 State: PUBLISHED Published: 2023-07-27T18:53:31.259Z Last Updated: 2024-08-02T17:46:55.866Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-402 Description: XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10.9 and 15.3-rc-1, the mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. This has been patched in XWiki 14.10.9 and XWiki 15.3-rc-1. A workaround is to modify the page `XWiki.LiveTableResultsMacros` following the patc
XWiki 14.10.9 and XWiki 15.3-rc-1. A workaround is to modify the page `XWiki.LiveTableResultsMacros` following the patch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g9w4-prf3-m25g - https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0 - https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0c - https://jira.xwiki.org/browse/XWIKI-20601
CVE ID: CVE-2023-38510 State: PUBLISHED Published: 2023-07-27T18:57:28.197Z Last Updated: 2024-10-03T18:36:37.229Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: tolgee Products: tolgee-platform Problem Types: CWE-862 Description: Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the permission scopes associated with the key, effectively bypassing permission checks entirely for some endpoints. It's important to note that this vulnerability only affects projects that have inadvertently exposed their API keys on the internet. Projects that
this vulnerability only affects projects that have inadvertently exposed their API keys on the internet. Projects that have kept their API keys secure are not impacted. This issue is fixed in version 3.23.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-4f9j-4vh4-p85v - https://github.com/tolgee/tolgee-platform/pull/1818 - https://github.com/tolgee/tolgee-platform/commit/4776cba67e7bb8c1b0259376e3e5fa3bb46e45c7 - https://github.com/tolgee/tolgee-platform/releases/tag/v3.23.1
CVE ID: CVE-2023-38511 State: PUBLISHED Published: 2024-04-15T17:06:35.666Z Last Updated: 2024-08-02T17:46:56.635Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-22 Description: iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm - https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7 - https:/
visories/GHSA-323r-chx5-m9gm - https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7 - https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab - https://www.synacktiv.com/advisories/file-read-in-itop
CVE ID: CVE-2023-38512 State: PUBLISHED Published: 2023-07-27T13:26:05.166Z Last Updated: 2024-09-25T16:58:28.975Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Wpstream Products: WpStream – Live Streaming, Video on Demand, Pay Per View Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Wpstream WpStream – Live Streaming, Video on Demand, Pay Per View plugin <= 4.5.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpstream/wordpress-wpstream-live-streaming-video-on-demand-pay-per-view-plugin-4-5-4-cross-site-request-forgery-
ability/wpstream/wordpress-wpstream-live-streaming-video-on-demand-pay-per-view-plugin-4-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-38513 State: PUBLISHED Published: 2023-12-20T13:52:29.820Z Last Updated: 2025-05-06T18:44:56.504Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Jordy Meow Products: Photo Engine (Media Organizer & Lightroom) Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media Organizer & Lightroom): from n/a through 6.2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wplr-sync/wordpress-photo-engine-plugin-6-2-5-insecure-direc
References: - https://patchstack.com/database/vulnerability/wplr-sync/wordpress-photo-engine-plugin-6-2-5-insecure-direct-object-references-idor?_s_id=cve
CVE ID: CVE-2023-38514 State: PUBLISHED Published: 2024-12-13T14:23:57.758Z Last Updated: 2024-12-13T18:24:22.032Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: social share pro Products: Social Share Icons & Social Share Buttons Problem Types: CWE-862 Description: Missing Authorization vulnerability in social share pro Social Share Icons & Social Share Buttons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-social-media-plus/v
es: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-social-media-plus/vulnerability/wordpress-social-share-icons-social-share-buttons-plugin-3-5-7-broken-access-control?_s_id=cve
CVE ID: CVE-2023-38515 State: PUBLISHED Published: 2023-11-13T02:32:33.748Z Last Updated: 2024-08-28T18:05:34.556Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Andy Moyle Products: Church Admin Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 3.7.56. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-3-7-56-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-38516 State: PUBLISHED Published: 2023-09-03T11:25:55.971Z Last Updated: 2025-02-19T21:24:58.191Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WP OnlineSupport, Essential Plugin Products: Audio Player with Playlist Ultimate Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <= 1.2.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/audio-player-with-playlist-ultimate/wordpress-audio-player-with-playlist-ultimate-
patchstack.com/database/vulnerability/audio-player-with-playlist-ultimate/wordpress-audio-player-with-playlist-ultimate-plugin-1-2-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-38517 State: PUBLISHED Published: 2023-09-03T11:20:55.964Z Last Updated: 2024-09-24T18:57:06.202Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Realwebcare Products: WRC Pricing Tables Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Realwebcare WRC Pricing Tables plugin <= 2.3.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wrc-pricing-tables/wordpress-wrc-pricing-tables-plugin-2-3-4-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-38518 State: PUBLISHED Published: 2023-09-03T11:16:54.922Z Last Updated: 2024-09-24T18:57:16.426Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Visualmodo Products: Borderless Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Visualmodo Borderless plugin <= 1.4.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/borderless/wordpress-borderless-plugin-1-4-7-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-38519 State: PUBLISHED Published: 2023-12-20T13:48:04.919Z Last Updated: 2024-08-02T17:46:55.227Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: MainWP Products: MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance.This issue affects MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: from n/a through 4.4.3.3. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.c
tenance: from n/a through 4.4.3.3. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/mainwp/wordpress-mainwp-plugin-4-4-3-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-38520 State: PUBLISHED Published: 2024-06-04T07:13:28.609Z Last Updated: 2024-08-14T16:28:53.654Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: PINPOINT.WORLD Products: Pinpoint Booking System Problem Types: CWE-472 Description: External Control of Assumed-Immutable Web Parameter vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Functionality Misuse.This issue affects Pinpoint Booking System: from n/a through 2.9.9.3.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/booking-system/wordpress-pinpoint-booking-system-plugin-2-9-9-3-4-paramete