deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-28243
Published: 2024-03-25
Description: KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/KaTeX/KaTeX/commit/e88b4c357f978b1bca8edfe3297f0aa309bcbe34; https://github.com/KaTeX/KaTeX/security/advisories/GHSA-64fm-8hw2-v72w; https://github.com/github/advisory-database/pull/6777
CVE: CVE-2024-28244
Published: 2024-03-25
Description: KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\def` or `\newcommand` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. KaTeX supports an option named maxExpand which aims to prevent infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. Unfortunately, support for "Unicode (sub|super)script characters" allows an attacker to bypass this limit. Each sub/superscript group instantiated a separate Parser with its own limit on macro executions, without inheriting the current count of macro executions from its parent. This has been corrected in KaTeX v0.16.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/KaTeX/KaTeX/commit/085e21b5da05414efefa932570e7201a7c70e5b2; https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cvr6-37gx-v8wc; https://github.com/KaTeX/KaTeX/commit/085e21b5da05414efefa932570e7201a7c70e5b2
CVE: CVE-2024-28245
Published: 2024-03-25
Description: KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-116
References: https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770; https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h; https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770
CVE: CVE-2024-28246
Published: 2024-03-25
Description: KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist certain URL protocols, can be fooled by URLs in malicious inputs that use uppercase characters in the protocol. In particular, this can allow for malicious input to generate `javascript:` links in the output, even if the `trust` function tries to forbid this protocol via `trust: (context) => context.protocol !== 'javascript'`. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-184, CWE-697
References: https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de; https://github.com/KaTeX/KaTeX/security/advisories/GHSA-3wc5-fcw2-2329; https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de
CVE: CVE-2024-29025
Published: 2024-03-25
Description: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3; https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c; https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v
CVE: CVE-2024-29041
Published: 2024-03-25
Description: Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-1286
References: https://expressjs.com/en/4x/api.html#res.location; https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd; https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94
CVE: CVE-2024-29179
Published: 2024-03-25
Description: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. An attacker with admin privileges can upload an attachment containing JS code without extension and the application will render it as HTML which allows for XSS attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hm8r-95g3-5hj9; https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hm8r-95g3-5hj9
CVE: CVE-2024-29440
Published: 2024-03-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-2425
Published: 2024-03-25
Description: 
A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, the web server will crash and need a manual restart to recover it.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://https://www.rockwellautomation.com/en-us/support/advisory.SD1664.html; https://https://www.rockwellautomation.com/en-us/support/advisory.SD1664.html
CVE: CVE-2024-2426
Published: 2024-03-25
Description: 
A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption in the CIP communication will occur and a manual restart will be required by the user to recover it.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/support/advisory.SD1664.html; https://www.rockwellautomation.com/en-us/support/advisory.SD1664.html
CVE: CVE-2024-2427
Published: 2024-03-25
Description: 
A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper traffic throttling in the device. If multiple data packets are sent to the device repeatedly the device will crash and require a manual restart to recover.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/support/advisory.SD1664.html; https://www.rockwellautomation.com/en-us/support/advisory.SD1664.html
CVE: CVE-2023-47430
Published: 2024-03-25
Description: Stack-buffer-overflow vulnerability in ReadyMedia (MiniDLNA) v1.3.3 allows attackers to cause a denial of service via via the SendContainer() function at tivo_commands.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-120
References: https://sourceforge.net/p/minidlna/bugs/361/; https://sourceforge.net/projects/minidlna/; https://sourceforge.net/p/minidlna/bugs/361/
CVE: CVE-2024-1973
Published: 2024-03-25
Description: By leveraging the vulnerability, lower-privileged users of Content Manager can manipulate Content Manager clients to elevate privileges and perform unauthorized operations. 
CVSS Score: 8.5 (HIGH)
CWE: CWE-269
References: https://portal.microfocus.com/s/article/KM000027861; https://portal.microfocus.com/s/article/KM000027861
CVE: CVE-2024-21914
Published: 2024-03-25
Description: 
A vulnerability exists in the affected product that allows a malicious user to restart the Rockwell Automation PanelView™ Plus 7 terminal remotely without security protections. If the vulnerability is exploited, it could lead to the loss of view or control of the PanelView™ product.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://www.rockwellautomation.com/en-us/support/advisory.SD1663.html; https://www.rockwellautomation.com/en-us/support/advisory.SD1663.html
CVE: CVE-2024-29442
Published: 2024-03-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-2873
Published: 2024-03-25
Description: A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user authentication, resulting in unauthorized access.

CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/wolfSSL/wolfssh/pull/670; https://github.com/wolfSSL/wolfssh/pull/671; https://www.wolfssl.com/docs/security-vulnerabilities/
CVE: CVE-2024-0901
Published: 2024-03-25
Description: Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: https://github.com/wolfSSL/wolfssl/issues/7089; https://github.com/wolfSSL/wolfssl/pull/7099; https://github.com/wolfSSL/wolfssl/issues/7089
CVE: CVE-2024-28421
Published: 2024-03-25
Description: SQL Injection vulnerability in Razor 0.8.0 allows a remote attacker to escalate privileges via the ChannelModel::updateapk method of the channelmodle.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/LioTree/003202727a61c0fb3ec3c948ab5e38f9; https://github.com/cobub/razor/issues/178; https://gist.github.com/LioTree/003202727a61c0fb3ec3c948ab5e38f9
CVE: CVE-2024-29301
Published: 2024-03-26
Description: SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-admin.php?admin_id=
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://packetstormsecurity.com/files/177737/Task-Management-System-1.0-SQL-Injection.html; https://www.strongboxit.com/; https://packetstormsecurity.com/files/177737/Task-Management-System-1.0-SQL-Injection.html
CVE: CVE-2024-29302
Published: 2024-03-26
Description: SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-employee.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://packetstormsecurity.com/files/177737/Task-Management-System-1.0-SQL-Injection.html; https://www.strongboxit.com/; https://packetstormsecurity.com/files/177737/Task-Management-System-1.0-SQL-Injection.html
CVE: CVE-2024-29303
Published: 2024-03-26
Description: The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/177737/Task-Management-System-1.0-SQL-Injection.html; https://www.strongboxit.com/; https://packetstormsecurity.com/files/177737/Task-Management-System-1.0-SQL-Injection.html
CVE: CVE-2024-2732
Published: 2024-03-26
Description: The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3056453/themify-shortcodes/trunk/includes/themify-shortcodes.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0aeb63e7-a24d-4d76-a8c7-f082dad87a55?source=cve; https://plugins.trac.wordpress.org/changeset/3056453/themify-shortcodes/trunk/includes/themify-shortcodes.php
CVE: CVE-2024-0866
Published: 2024-03-26
Description: The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050794%40check-email&new=3050794%40check-email&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae9307c-680c-43c7-8246-a3e6149c1fb6?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050794%40check-email&new=3050794%40check-email&sfp_email=&sfph_mail=
CVE: CVE-2024-29189
Published: 2024-03-26
Description: PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78
References: https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html; https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428; https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc
CVE: CVE-2024-29195
Published: 2024-03-26
Description: The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This library may be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices. An attacker can cause an integer wraparound or under-allocation or heap buffer overflow due to vulnerabilities in parameter checking mechanism, by exploiting the buffer length parameter in Azure C SDK, which may lead to remote code execution. Requirements for RCE are 1. Compromised Azure account allowing malformed payloads to be sent to the device via IoT Hub service, 2. By passing IoT hub service max message payload limit of 128KB, and 3. Ability to overwrite code space with remote code. Fixed in commit https://github.com/Azure/azure-c-shared-utility/commit/1129147c38ac02ad974c4c701a1e01b2141b9fe2.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-120
References: https://github.com/Azure/azure-c-shared-utility/commit/1129147c38ac02ad974c4c701a1e01b2141b9fe2; https://github.com/Azure/azure-c-shared-utility/security/advisories/GHSA-m8wp-hc7w-x4xg; https://github.com/Azure/azure-c-shared-utility/commit/1129147c38ac02ad974c4c701a1e01b2141b9fe2
CVE: CVE-2024-29196
Published: 2024-03-26
Description: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments that allows attackers with admin rights to upload malicious files to other locations of the web root. This vulnerability is fixed in 3.2.6.
CVSS Score: 3.8 (LOW)
CWE: CWE-22, CWE-22
References: https://github.com/thorsten/phpMyFAQ/commit/7ae2559f079cd5fc9948b6fdfb87581f93840f62; https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-mmh6-5cpf-2c72; https://github.com/thorsten/phpMyFAQ/commit/7ae2559f079cd5fc9948b6fdfb87581f93840f62
CVE: CVE-2024-29199
Published: 2024-03-26
Description: Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750; https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb; https://github.com/nautobot/nautobot/pull/5464
CVE: CVE-2023-7232
Published: 2024-03-26
Description: The Backup and Restore WordPress  WordPress plugin through 1.45 does not protect some log files containing sensitive information such as site configuration etc, allowing unauthenticated users to access such data
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/323fef8a-aa17-4698-9a02-c12d1d390763/; https://wpscan.com/vulnerability/323fef8a-aa17-4698-9a02-c12d1d390763/
CVE: CVE-2024-1745
Published: 2024-03-26
Description: The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/b63bbfeb-d6f7-4c33-8824-b86d64d3f598/; https://wpscan.com/vulnerability/b63bbfeb-d6f7-4c33-8824-b86d64d3f598/
CVE: CVE-2024-2170
Published: 2024-03-26
Description: The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and including, 9.96.0.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className.' This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058212%40vk-all-in-one-expansion-unit&new=3058212%40vk-all-in-one-expansion-unit&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc697b3-20f6-46df-a250-f2009a60200e?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058212%40vk-all-in-one-expansion-unit&new=3058212%40vk-all-in-one-expansion-unit&sfp_email=&sfph_mail=
CVE: CVE-2024-2303
Published: 2024-03-26
Description: The Easy Textillate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'textillate' shortcode in all versions up to, and including, 2.01 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050231%40easy-textillate&new=3050231%40easy-textillate&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/66529116-7b0e-4e2f-96f1-a4d91fa7f956?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050231%40easy-textillate&new=3050231%40easy-textillate&sfp_email=&sfph_mail=
CVE: CVE-2024-2888
Published: 2024-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor allows Stored XSS.This issue affects Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: from n/a through 1.26.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/post-and-page-builder/wordpress-post-and-page-builder-by-boldgrid-plugin-1-26-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/post-and-page-builder/wordpress-post-and-page-builder-by-boldgrid-plugin-1-26-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-2889
Published: 2024-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon.This issue affects WP-Lister Lite for Amazon: from n/a through <= 2.6.11.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-lister-for-amazon/vulnerability/wordpress-wp-lister-lite-for-amazon-plugin-2-6-11-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-lister-for-amazon/wordpress-wp-lister-lite-for-amazon-plugin-2-6-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49839
Published: 2024-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Cosmetsy theme (core plugin), KlbTheme Partdo theme (core plugin), KlbTheme Bacola theme (core plugin), KlbTheme Medibazar theme (core plugin), KlbTheme Furnob theme (core plugin), KlbTheme Clotya theme (core plugin) allows Reflected XSS.This issue affects Cosmetsy theme (core plugin): from n/a through 1.3.0; Partdo theme (core plugin): from n/a through 1.0.9; Bacola theme (core plugin): from n/a through 1.3.3; Medibazar theme (core plugin): from n/a through 1.2.3; Furnob theme (core plugin): from n/a through 1.1.7; Clotya theme (core plugin): from n/a through 1.1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bacola-core/wordpress-bacola-core-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/clotya-core/wordpress-clotya-core-plugin-1-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cosmetsy-core/wordpress-cosmetsy-core-plugin-1-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-51416
Published: 2024-03-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in EnvialoSimple EnvíaloSimple.This issue affects EnvíaloSimple: from n/a through 2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/envialosimple-email-marketing-y-newsletters-gratis/wordpress-envialosimple-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/envialosimple-email-marketing-y-newsletters-gratis/wordpress-envialosimple-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-6175
Published: 2024-03-26
Description: NetScreen file parser crash in Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18 allows denial of service via crafted capture file
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://gitlab.com/wireshark/wireshark/-/issues/19404; https://www.wireshark.org/security/wnpa-sec-2023-29.html; https://gitlab.com/wireshark/wireshark/-/issues/19404