deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-29681
Published: 2023-05-01
Description: Cleartext Transmission in cookie:ecos_pw: in Tenda N301 v6.0, firmware v12.03.01.06_pt allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://medium.com/%400ta/tenda-n301-v6-cve-2023-29680-cve-2023-29681-a40f7ae6dc62; https://www.youtube.com/watch?v=Xy9_hmpvvA4&ab_channel=0ta; https://medium.com/%400ta/tenda-n301-v6-cve-2023-29680-cve-2023-29681-a40f7ae6dc62
CVE: CVE-2023-30639
Published: 2023-05-01
Description: Archer Platform 6.8 before 6.12 P6 HF1 (6.12.0.6.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. 6.11.P4 (6.11.0.4) is also a fixed release.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.archerirm.community/t5/security-advisories/archer-update-for-stored-cross-site-scripting/ta-p/697581; https://www.archerirm.community/t5/security-advisories/archer-update-for-stored-cross-site-scripting/ta-p/697581
CVE: CVE-2013-10026
Published: 2023-05-02
Description: A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress. This issue affects some unknown processing of the file index.php. The manipulation of the argument sml_name/sml_email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.1 is able to address this issue. The identifier of the patch is 484970ef8285cae51d2de3bd4e4684d33c956c28. It is recommended to upgrade the affected component. The identifier VDB-227765 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/mail-subscribe-list/commit/484970ef8285cae51d2de3bd4e4684d33c956c28; https://vuldb.com/?ctiid.227765; https://vuldb.com/?id.227765
CVE: CVE-2014-125100
Published: 2023-05-02
Description: A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is dbb71deee071422ce3e663fbcdce3ad24886f940. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227764.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/job-board/commit/dbb71deee071422ce3e663fbcdce3ad24886f940; https://vuldb.com/?ctiid.227764; https://vuldb.com/?id.227764
CVE: CVE-2022-48482
Published: 2023-05-02
Description: 3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal. Files may have credentials, full backups, call recordings, and chat logs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88; https://www.3cx.com/blog/change-log/phone-system-change-log/; https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88
CVE: CVE-2022-48483
Published: 2023-05-02
Description: 3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory traversal in conjunction with a path component that has a drive letter and uses backslash characters. NOTE: this issue exists because of an incomplete fix for CVE-2022-28005.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88; https://www.3cx.com/blog/change-log/phone-system-change-log/; https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88
CVE: CVE-2023-2247
Published: 2023-05-02
Description: In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function
CVSS Score: 5.3 (MEDIUM)
References: https://advisories.octopus.com/post/2023/sa2023-07/; https://advisories.octopus.com/post/2023/sa2023-07/
CVE: CVE-2022-25713
Published: 2023-05-02
Description: Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2022-33281
Published: 2023-05-02
Description: Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-129, CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2022-33292
Published: 2023-05-02
Description: Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2022-33304
Published: 2023-05-02
Description: Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2022-33305
Published: 2023-05-02
Description: Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2022-34144
Published: 2023-05-02
Description: Transient DOS due to reachable assertion in Modem during OSI decode scheduling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2022-40505
Published: 2023-05-02
Description: Information disclosure due to buffer over-read in Modem while parsing DNS hostname.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2022-40508
Published: 2023-05-02
Description: Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2023-21642
Published: 2023-05-02
Description: Memory corruption in HAB Memory management due to broad system privileges via physical address.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2023-21665
Published: 2023-05-02
Description: Memory corruption in Graphics while importing a file.
CVSS Score: 8.4 (HIGH)
CWE: CWE-704, CWE-704
References: http://packetstormsecurity.com/files/172663/Qualcomm-Adreno-KGSL-Unchecked-Cast-Type-Confusion.html; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; http://packetstormsecurity.com/files/172663/Qualcomm-Adreno-KGSL-Unchecked-Cast-Type-Confusion.html
CVE: CVE-2023-21666
Published: 2023-05-02
Description: Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.
CVSS Score: 8.4 (HIGH)
CWE: CWE-401, CWE-401
References: http://packetstormsecurity.com/files/172664/Qualcomm-Adreno-KGSL-Data-Leakage.html; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; http://packetstormsecurity.com/files/172664/Qualcomm-Adreno-KGSL-Data-Leakage.html
CVE: CVE-2022-33273
Published: 2023-05-02
Description: Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2022-40504
Published: 2023-05-02
Description: Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE: CVE-2023-0891
Published: 2023-05-02
Description: The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/72397fee-9768-462b-933c-400181a5487c; https://wpscan.com/vulnerability/72397fee-9768-462b-933c-400181a5487c
CVE: CVE-2023-0924
Published: 2023-05-02
Description: The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Administrator) to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://wpscan.com/vulnerability/0fd0d7a5-9263-43b6-9244-7880c3d3e6f4; https://wpscan.com/vulnerability/0fd0d7a5-9263-43b6-9244-7880c3d3e6f4
CVE: CVE-2023-1021
Published: 2023-05-02
Description: The amr ical events lists WordPress plugin through 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/91d04f96-11b2-46dc-860c-dc6c26360bf3; https://wpscan.com/vulnerability/91d04f96-11b2-46dc-860c-dc6c26360bf3
CVE: CVE-2023-1090
Published: 2023-05-02
Description: The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/youki992/youki992.github.io/blob/master/others/apply.md; https://wpscan.com/vulnerability/d470dd6c-dcac-4a3e-b42a-2489a31aca45; https://github.com/youki992/youki992.github.io/blob/master/others/apply.md
CVE: CVE-2023-1125
Published: 2023-05-02
Description: The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://wpscan.com/vulnerability/e8a4b6ab-47f8-495d-a22c-dcf914dfb58c; https://wpscan.com/vulnerability/e8a4b6ab-47f8-495d-a22c-dcf914dfb58c
CVE: CVE-2023-1525
Published: 2023-05-02
Description: The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/4ae6bf90-b100-4bb5-bdd7-8acdbd950596; https://wpscan.com/vulnerability/4ae6bf90-b100-4bb5-bdd7-8acdbd950596
CVE: CVE-2023-1546
Published: 2023-05-02
Description: The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bb065397-370f-4ee1-a2c8-20e4dc4415a0; https://wpscan.com/vulnerability/bb065397-370f-4ee1-a2c8-20e4dc4415a0
CVE: CVE-2023-1554
Published: 2023-05-02
Description: The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0d247a3d-154e-4da7-a147-c1c7e1b5e87e; https://wpscan.com/vulnerability/0d247a3d-154e-4da7-a147-c1c7e1b5e87e
CVE: CVE-2023-1614
Published: 2023-05-02
Description: The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/56abd1e2-0ea9-47f7-9a1b-2093ac15d39c; https://wpscan.com/vulnerability/56abd1e2-0ea9-47f7-9a1b-2093ac15d39c
CVE: CVE-2023-1669
Published: 2023-05-02
Description: The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://wpscan.com/vulnerability/fb8791f5-2879-431e-9afc-06d5839e4b9d; https://wpscan.com/vulnerability/fb8791f5-2879-431e-9afc-06d5839e4b9d
CVE: CVE-2023-1730
Published: 2023-05-02
Description: The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7; https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7
CVE: CVE-2023-1804
Published: 2023-05-02
Description: The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/55b28fa6-a54f-4365-9d59-f9e331c1e11b; https://wpscan.com/vulnerability/55b28fa6-a54f-4365-9d59-f9e331c1e11b
CVE: CVE-2023-1805
Published: 2023-05-02
Description: The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/46b4582f-7651-4b74-a00b-1788587ecfa8; https://wpscan.com/vulnerability/46b4582f-7651-4b74-a00b-1788587ecfa8
CVE: CVE-2023-1809
Published: 2023-05-02
Description: The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://wpscan.com/vulnerability/57f0a078-fbeb-4b05-8892-e6d99edb82c1; https://wpscan.com/vulnerability/57f0a078-fbeb-4b05-8892-e6d99edb82c1
CVE: CVE-2023-1861
Published: 2023-05-02
Description: The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810; https://wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810
CVE: CVE-2023-1911
Published: 2023-05-02
Description: The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://wpscan.com/vulnerability/e7c52af0-b210-4e7d-a5e0-ee0645ddc08c; https://wpscan.com/vulnerability/e7c52af0-b210-4e7d-a5e0-ee0645ddc08c
CVE: CVE-2023-1196
Published: 2023-05-02
Description: The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://wpscan.com/vulnerability/8e5ec88e-0e66-44e4-bbf2-74155d849ede; https://wpscan.com/vulnerability/cf376ca2-92f6-44ff-929a-ace809460a33; https://wpscan.com/vulnerability/8e5ec88e-0e66-44e4-bbf2-74155d849ede
CVE: CVE-2023-2000
Published: 2023-05-02
Description: Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-31207
Published: 2023-05-02
Description: Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532, CWE-532, CWE-532
References: https://checkmk.com/werk/15189; https://checkmk.com/werk/15189
CVE: CVE-2023-32007
Published: 2023-05-02
Description: ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This issue was disclosed earlier as CVE-2022-33891, but incorrectly claimed version 3.1.3 (which has since gone EOL) would not be affected.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Users are recommended to upgrade to a supported version of Apache Spark, such as version 3.4.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://www.openwall.com/lists/oss-security/2023/05/02/1; https://lists.apache.org/thread/poxgnxhhnzz735kr1wos366l5vdbb0nv; https://spark.apache.org/security.html
CVE: CVE-2023-30869
Published: 2023-05-02
Description: Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://patchstack.com/articles/critical-easy-digital-downloads-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-1-1-4-1-unauthenticated-privilege-escalation-vulnerability?_s_id=cve; https://patchstack.com/articles/critical-easy-digital-downloads-vulnerability?_s_id=cve
CVE: CVE-2023-23723
Published: 2023-05-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-email-capture/wordpress-wordpress-email-marketing-plugin-wp-email-capture-plugin-3-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-email-capture/wordpress-wordpress-email-marketing-plugin-wp-email-capture-plugin-3-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29772
Published: 2023-05-02
Description: A Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC51U wireless router firmware version up to and including 3.0.0.4.380.8591 allows remote attackers to inject arbitrary web script or HTML via a malicious network request.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitlab.com/donnm/cves/-/blob/master/xss_rtac51u_syslog.md; https://gitlab.com/donnm/cves/-/blob/master/xss_rtac51u_syslog.md
CVE: CVE-2023-2473
Published: 2023-05-02
Description: A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwd of the file UserController.java of the component Password Hash Calculation. The manipulation leads to inefficient algorithmic complexity. The attack can be initiated remotely. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227860.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-407, CWE-407
References: https://gitee.com/isoftforce/dreamer_cms/issues/I6WHO7; https://vuldb.com/?ctiid.227860; https://vuldb.com/?id.227860
CVE: CVE-2023-2474
Published: 2023-05-02
Description: A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-227866 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://gitee.com/getrebuild/rebuild/issues/I6W4M2; https://vuldb.com/?ctiid.227866; https://vuldb.com/?id.227866
CVE: CVE-2023-2475
Published: 2023-05-02
Description: A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Message Handler. The manipulation of the argument 主题 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 7a9e1a00e3329fdc0ae05f7a8257cce77037134d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-227867.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/dromara/J2EEFAST/commit/7a9e1a00e3329fdc0ae05f7a8257cce77037134d; https://gitee.com/dromara/J2EEFAST/issues/I6W390; https://vuldb.com/?ctiid.227867
CVE: CVE-2023-2445
Published: 2023-05-02
Description: Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information on folders in user vaults via a specific folder name.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-346
References: https://devolutions.net/security/advisories/DEVO-2023-0013/; https://devolutions.net/security/advisories/DEVO-2023-0013/