deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-29756
Published: 2023-06-09
Description: An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-346
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29756/CVE%20detailed.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29756/CVE%20detailed.md
CVE: CVE-2023-29757
Published: 2023-06-09
Description: An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-922
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29757/CVE%20detailed.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29757/CVE%20detailed.md
CVE: CVE-2023-29758
Published: 2023-06-09
Description: An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29758/CVE%20detailed.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29758/CVE%20detailed.md
CVE: CVE-2023-29759
Published: 2023-06-09
Description: An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29759/CVE%20detailed.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29759/CVE%20detailed.md
CVE: CVE-2023-29761
Published: 2023-06-09
Description: An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29761/CVE%20detailed.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29761/CVE%20detailed.md
CVE: CVE-2023-29766
Published: 2023-06-09
Description: An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29766/CVE%20detailed.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29766/CVE%20detailed.md
CVE: CVE-2023-29767
Published: 2023-06-09
Description: An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29767/CVE%20detailed.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29767/CVE%20detailed.md
CVE: CVE-2023-32312
Published: 2023-06-09
Description: UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit flow is not safe. For traditional MVC applications, it is recommended to use the authorization code flow, which requires the client to authenticate with the authorization server using a client secret. This flow provides better security, as it involves exchanging an authorization code for an access token and/or ID token, rather than directly returning tokens in the URL fragment. This issue has been patched in commit `e792429f9` and a release to Nuget is pending. Users are advised to upgrade when possible.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://docs.umbraco.com/umbraco-cms/reference/security/external-login-providers; https://github.com/umbraco/UmbracoIdentityExtensions/commit/e792429f9d1fa25c1ba4f7a61d23ee02fedd6dc9; https://github.com/umbraco/UmbracoIdentityExtensions/pull/53
CVE: CVE-2023-34856
Published: 2023-06-09
Description: A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /auth_pic.cgi.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hashshfza/Vulnerability/issues/2; https://github.com/hashshfza/Vulnerability/issues/2
CVE: CVE-2023-3141
Published: 2023-06-09
Description: A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416, CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=[PII_REDACTED]5021704c39b38f65a78ab9e4a186d7; https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
CVE: CVE-2023-26465
Published: 2023-06-09
Description: Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.pega.com/support-doc/pega-security-advisory-a23-vulnerability-remediation-note; https://support.pega.com/support-doc/pega-security-advisory-a23-vulnerability-remediation-note
CVE: CVE-2023-29751
Published: 2023-06-09
Description: An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-346
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29751/CVE%20detailed.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29751/CVE%20detailed.md
CVE: CVE-2023-29753
Published: 2023-06-09
Description: An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreference files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-346
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29753/CVE%20detailed.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29753/CVE%20detailed.md
CVE: CVE-2023-3187
Published: 2023-06-09
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Profile Picture Handler. The manipulation of the argument newpic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231176.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/ctflearner/Vulnerability/blob/main/Teacher_Record_Management_System/trms.md; https://vuldb.com/?ctiid.231176; https://vuldb.com/?id.231176
CVE: CVE-2023-3188
Published: 2023-06-10
Description: Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/owncast/owncast/commit/f40135dbf[PII_REDACTED]2f9662c23e478ea192b16; https://huntr.dev/bounties/0d0d526a-1c39-4e6a-b081-d3914468e495; https://github.com/owncast/owncast/commit/f40135dbf[PII_REDACTED]2f9662c23e478ea192b16
CVE: CVE-2023-26132
Published: 2023-06-10
Description: Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321, CWE-1321, CWE-1321
References: https://github.com/mickhansen/dottie.js/blob/b48e22714aae4489ea6276452f22cc61980ba5a4/dottie.js%23L107; https://github.com/mickhansen/dottie.js/commit/7d3aee1c9c3c842720506e131de7e181e5c8db68; https://security.snyk.io/vuln/SNYK-JS-DOTTIE-3332763
CVE: CVE-2023-3190
Published: 2023-06-10
Description: Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-116
References: https://github.com/nilsteampassnet/teampass/commit/241dbd4159a5d63b55af426464d30dbb53925705; https://huntr.dev/bounties/5562c4c4-0475-448f-a451-7c4666bc7180; https://github.com/nilsteampassnet/teampass/commit/241dbd4159a5d63b55af426464d30dbb53925705
CVE: CVE-2023-3191
Published: 2023-06-10
Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nilsteampassnet/teampass/commit/241dbd4159a5d63b55af426464d30dbb53925705; https://huntr.dev/bounties/19fed157-128d-4bfb-a30e-eadf748cbd1a; https://github.com/nilsteampassnet/teampass/commit/241dbd4159a5d63b55af426464d30dbb53925705
CVE: CVE-2023-3192
Published: 2023-06-11
Description: Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384
References: https://github.com/froxlor/froxlor/commit/94d9c3eedf31bc8447e3aa349e32880dde02ee52; https://huntr.dev/bounties/f3644772-9c86-4f55-a0fa-aeb11f411551; https://github.com/froxlor/froxlor/commit/94d9c3eedf31bc8447e3aa349e32880dde02ee52
CVE: CVE-2023-22582
Published: 2023-06-11
Description: The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://csirt.divd.nl/CVE-2023-22582/; https://csirt.divd.nl/DIVD-2023-00021/; https://csirt.divd.nl/DIVD-2023-00021
CVE: CVE-2023-22583
Published: 2023-06-11
Description: The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://csirt.divd.nl/CVE-2023-22583/; https://csirt.divd.nl/DIVD-2023-00021/; https://csirt.divd.nl/DIVD-2023-00021
CVE: CVE-2023-22584
Published: 2023-06-11
Description: The Danfoss AK-EM100 stores login credentials in cleartext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://csirt.divd.nl/CVE-2023-22584/; https://csirt.divd.nl/DIVD-2023-00021/; https://csirt.divd.nl/DIVD-2023-00021
CVE: CVE-2023-22585
Published: 2023-06-11
Description: The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://csirt.divd.nl/CVE-2023-22585/; https://csirt.divd.nl/DIVD-2023-00021/; https://csirt.divd.nl/DIVD-2023-00021
CVE: CVE-2023-22586
Published: 2023-06-11
Description: The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200, CWE-200
References: https://csirt.divd.nl/CVE-2023-22586/; https://csirt.divd.nl/DIVD-2023-00021/; https://csirt.divd.nl/DIVD-2023-00021
CVE: CVE-2023-25911
Published: 2023-06-11
Description: The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://csirt.divd.nl/CVE-2023-25911/; https://csirt.divd.nl/DIVD-2023-00021/; https://csirt.divd.nl/DIVD-2023-00021
CVE: CVE-2023-25912
Published: 2023-06-11
Description: The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the internal IP address, usernames and internal device values.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://csirt.divd.nl/CVE-2023-25912/; https://csirt.divd.nl/DIVD-2023-00021/; https://csirt.divd.nl/DIVD-2023-00021
CVE: CVE-2020-36732
Published: 2023-06-12
Description: The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-330, CWE-331
References: https://github.com/brix/crypto-js/compare/3.2.0...3.2.1; https://github.com/brix/crypto-js/issues/254; https://github.com/brix/crypto-js/issues/256
CVE: CVE-2023-35031
Published: 2023-06-12
Description: Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager V10 R0 allow command injection by authenticated users, aka OSFOURK-24036.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://networks.unify.com/security/advisories/OBSO-2305-01.pdf; https://www.news.de/technik/856882353/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/; https://networks.unify.com/security/advisories/OBSO-2305-01.pdf
CVE: CVE-2023-35032
Published: 2023-06-12
Description: Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow command injection by authenticated users, aka OSFOURK-23554.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://networks.unify.com/security/advisories/OBSO-2305-01.pdf; https://www.news.de/technik/856882353/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/; https://networks.unify.com/security/advisories/OBSO-2305-01.pdf
CVE: CVE-2023-35033
Published: 2023-06-12
Description: Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager V10 R0 allow command injection by authenticated users, aka OSFOURK-23556.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://networks.unify.com/security/advisories/OBSO-2305-01.pdf; https://www.news.de/technik/856882353/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/; https://networks.unify.com/security/advisories/OBSO-2305-01.pdf
CVE: CVE-2023-35034
Published: 2023-06-12
Description: Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow remote code execution by unauthenticated users, aka OSFOURK-24033.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://networks.unify.com/security/advisories/OBSO-2305-01.pdf; https://www.news.de/technik/856882353/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/; https://networks.unify.com/security/advisories/OBSO-2305-01.pdf
CVE: CVE-2023-35035
Published: 2023-06-12
Description: Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager V10 R0 allow command injection by authenticated users, aka OSFOURK-23557.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://networks.unify.com/security/advisories/OBSO-2305-01.pdf; https://www.news.de/technik/856882353/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/; https://networks.unify.com/security/advisories/OBSO-2305-01.pdf
CVE: CVE-2023-35036
Published: 2023-06-12
Description: In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://archive.is/58ty7; https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-CVE-2023-35036-June-9-2023; https://archive.is/58ty7
CVE: CVE-2023-26133
Published: 2023-06-12
Description: All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.
CVSS Score: 8.2 (HIGH)
CWE: CWE-1321, CWE-1321, CWE-1321
References: https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L18; https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20; https://security.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152
CVE: CVE-2015-10118
Published: 2023-06-12
Description: A vulnerability classified as problematic was found in cchetanonline WP-CopyProtect up to 3.0.0. This vulnerability affects the function CopyProtect_options_page of the file wp-copyprotect.php. The manipulation of the argument CopyProtect_nrc_text leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.1.0 is able to address this issue. The patch is identified as 8b8fe4102886b326330dc1ff06b17313fb10aee5. It is recommended to upgrade the affected component. VDB-231202 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/wp-copyprotect/commit/8b8fe4102886b326330dc1ff06b17313fb10aee5; https://vuldb.com/?ctiid.231202; https://vuldb.com/?id.231202
CVE: CVE-2022-45827
Published: 2023-06-12
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GalleryPlugins Video Contest plugin <= 3.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/video-contest/wordpress-video-contest-wordpress-plugin-plugin-3-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/video-contest/wordpress-video-contest-wordpress-plugin-plugin-3-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-47140
Published: 2023-06-12
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23818
Published: 2023-06-12
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Aviplugins.Com WP Register Profile With Shortcode plugin <= 3.5.7 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-register-profile-with-shortcode/wordpress-wp-register-profile-with-shortcode-plugin-3-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-register-profile-with-shortcode/wordpress-wp-register-profile-with-shortcode-plugin-3-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33253
Published: 2023-06-12
Description: LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file (such as shell.jpg.php.shell) being sent.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/Toxich4/CVE-2023-33253; https://labcollector.com/; https://labcollector.com/changelog-labcollector/
CVE: CVE-2023-33290
Published: 2023-06-12
Description: The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issue to CVE-2023-32758 (Python).
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/tjtelan/git-url-parse-rs/issues/51; https://lib.rs/crates/git-url-parse; https://github.com/tjtelan/git-url-parse-rs/issues/51
CVE: CVE-2023-33492
Published: 2023-06-12
Description: EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/42; https://github.com/weng-xianhu/eyoucms/issues/42
CVE: CVE-2023-34855
Published: 2023-06-12
Description: A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /upfile.cgi.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/hashshfza/Vulnerability/issues/1; https://github.com/hashshfza/Vulnerability/issues/1
CVE: CVE-2022-38156
Published: 2023-06-12
Description: A remote command injection issues exists in the web server of the Kratos SpectralNet device with SpectralNet Narrowband (NB) before 1.7.5. As an admin user, an attacker can send a crafted password in order to execute Linux commands as the root user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.kratosdefense.com/-/media/k/pdf/s/sy/os-011-spectralnet-narrowband.pdf; https://www.kratosdefense.com/-/media/k/pdf/s/sy/os-011-spectralnet-narrowband.pdf
CVE: CVE-2023-23819
Published: 2023-06-12
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Rolands Umbrovskis itemprop WP for SERP/SEO Rich snippets plugin <= 3.5.201706131 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/itempropwp/wordpress-itemprop-wp-for-serp-seo-rich-snippets-plugin-3-5-201706131-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/itempropwp/wordpress-itemprop-wp-for-serp-seo-rich-snippets-plugin-3-5-201706131-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23822
Published: 2023-06-12
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ludwig Media UTM Tracker plugin <= 1.3.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/utm-tracker/wordpress-utm-tracker-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/utm-tracker/wordpress-utm-tracker-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30745
Published: 2023-06-12
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <= 2.1.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ip-metaboxes/wordpress-ip-metaboxes-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ip-metaboxes/wordpress-ip-metaboxes-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30753
Published: 2023-06-12
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <= 2.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ip-metaboxes/wordpress-ip-metaboxes-plugin-2-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ip-metaboxes/wordpress-ip-metaboxes-plugin-2-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34488
Published: 2023-06-12
Description: NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes malformed messages.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-122
References: https://github.com/emqx/nanomq/issues/1181; https://github.com/emqx/nanomq/issues/1181
CVE: CVE-2023-34494
Published: 2023-06-12
Description: NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/emqx/nanomq/issues/1180; https://github.com/emqx/nanomq/issues/1180