deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49108
Published: 2023-12-04
Description: Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 (excluding Ver.6.1.1.3a). If this vulnerability is exploited, arbitrary files on the server may be obtained or deleted by a user of the product with specific privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN46895889/; https://rakrak.jp/RakDocSupport/rkspServlet; https://jvn.jp/en/jp/JVN46895889/
CVE: CVE-2023-49287
Published: 2023-12-04
Description: TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6.
CVSS Score: 7.7 (HIGH)
CWE: CWE-120, CWE-121, CWE-120
References: http://packetstormsecurity.com/files/176060/TinyDir-1.2.5-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2023/Dec/14; http://www.openwall.com/lists/oss-security/2023/12/04/1
CVE: CVE-2023-5332
Published: 2023-12-04
Description: Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
CVSS Score: 5.9 (MEDIUM)
References: https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8171; https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations; https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8171
CVE: CVE-2023-44291
Published: 2023-12-04
Description: 


Dell DM5500 5.14.0.0 contains an OS command injection vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.




CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities
CVE: CVE-2023-44300
Published: 2023-12-04
Description: 


Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance. A local attacker with privileges could potentially exploit this vulnerability, leading to the disclosure of certain service credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.




CVSS Score: 5.5 (MEDIUM)
CWE: CWE-256, CWE-522
References: https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities
CVE: CVE-2023-44301
Published: 2023-12-04
Description: 


Dell DM5500 5.14.0.0 and prior contain a Reflected Cross-Site Scripting Vulnerability. A network attacker with low privileges could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.




CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities
CVE: CVE-2023-44302
Published: 2023-12-04
Description: 
Dell DM5500 5.14.0.0 and prior contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access of resources or functionality that could possibly lead to execute arbitrary code.


CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities
CVE: CVE-2023-44304
Published: 2023-12-04
Description: 


Dell DM5500 contains a privilege escalation vulnerability in the appliance. A remote attacker with low privileges could potentially exploit this vulnerability to escape the restricted shell and gain root access to the appliance.




CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities
CVE: CVE-2023-44305
Published: 2023-12-04
Description: 


Dell DM5500 5.14.0.0, contains a Stack-based Buffer Overflow Vulnerability in the appliance. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially crafted input data.




CVSS Score: 8.1 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities
CVE: CVE-2023-44306
Published: 2023-12-04
Description: 


Dell DM5500 contains a path traversal vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this vulnerability to overwrite configuration files stored on the server filesystem.




CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities
CVE: CVE-2023-6481
Published: 2023-12-04
Description: A serialization vulnerability in logback receiver component part of 
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service 
attack by sending poisoned data.


CVSS Score: 7.1 (HIGH)
References: https://logback.qos.ch/news.html#1.3.12; https://logback.qos.ch/news.html#1.3.14; https://logback.qos.ch/news.html#1.3.12
CVE: CVE-2023-32804
Published: 2023-12-04
Description: Out-of-bounds Write vulnerability in Arm Ltd Midgard GPU Userspace Driver, Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a local non-privileged user to write a constant pattern to a limited amount of memory not allocated by the user space driver.This issue affects Midgard GPU Userspace Driver: from r0p0 through r32p0; Bifrost GPU Userspace Driver: from r0p0 through r44p0; Valhall GPU Userspace Driver: from r19p0 through r44p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r44p0.


CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2023-48799
Published: 2023-12-04
Description: TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution.
CVSS Score: 9.8 (CRITICAL)
References: https://palm-jump-676.notion.site/CVE-2023-48799-632dd667b4574a2c84b04035d04afb5c; https://www.notion.so/X6000R-632dd667b4574a2c84b04035d04afb5c?pvs=4; https://palm-jump-676.notion.site/CVE-2023-48799-632dd667b4574a2c84b04035d04afb5c
CVE: CVE-2023-48800
Published: 2023-12-04
Description: In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://palm-jump-676.notion.site/CVE-2023-48800-ad96548d06c645738daf3ab77575fd74; https://www.notion.so/X6000R-sub_417338-ad96548d06c645738daf3ab77575fd74?pvs=4; https://palm-jump-676.notion.site/CVE-2023-48800-ad96548d06c645738daf3ab77575fd74
CVE: CVE-2023-48863
Published: 2023-12-04
Description: SEMCMS 3.9 is vulnerable to SQL Injection. Due to the lack of security checks on the input of the application, the attacker uses the existing application to inject malicious SQL commands into the background database engine for execution, and sends some attack codes as commands or query statements to the interpreter. These malicious data can deceive the interpreter, so as to execute unplanned commands or unauthorized access to data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: http://www.sem-cms.com/; https://gitee.com/NoBlake/cve-2023-48863/; http://www.sem-cms.com/
CVE: CVE-2023-6460
Published: 2023-12-04
Description: A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-922, CWE-532
References: https://bughunters.google.com/reports/vrp/KNvgo1Wij; https://github.com/googleapis/nodejs-firestore/pull/1742; https://github.com/googleapis/nodejs-firestore/pull/1742
CVE: CVE-2023-41613
Published: 2023-12-04
Description: EzViz Studio v2.2.0 is vulnerable to DLL hijacking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://packetstormsecurity.com/files/175684/EzViz-Studio-2.2.0-DLL-Hijacking.html; https://packetstormsecurity.com/files/175684/EzViz-Studio-2.2.0-DLL-Hijacking.html
CVE: CVE-2023-48815
Published: 2023-12-04
Description: kkFileView v4.3.0 is vulnerable to Incorrect Access Control.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/kekingcn/kkFileView; https://github.com/varzhang/There-is-a-vulnerability-in-kkFileView/blob/main/README.md; https://github.com/kekingcn/kkFileView
CVE: CVE-2023-48866
Published: 2023-12-04
Description: A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 allows attackers to obtain the victim's cookies.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/grocy/grocy; https://nitipoom-jar.github.io/CVE-2023-48866/; https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48866
CVE: CVE-2023-5767
Published: 2023-12-04
Description: 
A vulnerability exists in the webserver that affects the 
RTU500 series product versions listed below. A malicious 
actor could perform cross-site scripting on the webserver 
due to an RDT language file being improperly sanitized.



CVSS Score: 6.0 (MEDIUM)
CWE: CWE-79
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000176&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000176&languageCode=en&Preview=true
CVE: CVE-2023-5768
Published: 2023-12-04
Description: A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. 
Incomplete or wrong received APDU frame layout may 
cause blocking on link layer. Error reason was an endless blocking when reading incoming frames on link layer 
with wrong length information of APDU or delayed reception 
of data octets.


Only communication link of affected HCI IEC 60870-5-104 
is blocked. If attack sequence stops the communication to 
the previously attacked link gets normal again.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000176&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000176&languageCode=en&Preview=true
CVE: CVE-2023-48965
Published: 2023-12-04
Description: An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/1dreamGN/CVE/blob/main/ThinkAdmin%20Logical%20defect%20getshell.md; https://github.com/1dreamGN/CVE/blob/main/ThinkAdmin%20Logical%20defect%20getshell.md
CVE: CVE-2023-48966
Published: 2023-12-04
Description: An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/1dreamGN/CVE/blob/main/ThinkAdmin%20directory%20traversal%2Bfile%20upload%20getshell.md; https://github.com/1dreamGN/CVE/blob/main/ThinkAdmin%20directory%20traversal%2Bfile%20upload%20getshell.md
CVE: CVE-2023-48910
Published: 2023-12-04
Description: Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://gist.github.com/b33t1e/2a2dc17cf36cd741b2c99425c892d826; https://github.com/microcks/microcks; https://github.com/orgs/microcks/discussions/892
CVE: CVE-2023-48967
Published: 2023-12-04
Description: Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/noear/solon/issues/226; https://github.com/noear/solon/issues/226
CVE: CVE-2023-47106
Published: 2023-12-04
Description: Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20
References: https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.1; https://github.com/traefik/traefik/releases/tag/v2.10.6; https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5
CVE: CVE-2023-47124
Published: 2023-12-04
Description: Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-772
References: https://doc.traefik.io/traefik/https/acme/#dnschallenge; https://doc.traefik.io/traefik/https/acme/#httpchallenge; https://doc.traefik.io/traefik/https/acme/#tlschallenge
CVE: CVE-2023-47633
Published: 2023-12-04
Description: Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/traefik/traefik/releases/tag/v2.10.6; https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5; https://github.com/traefik/traefik/security/advisories/GHSA-6fwg-jrfw-ff7p
CVE: CVE-2023-49080
Published: 2023-12-04
Description: The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit `0056c3aa52` which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-209
References: https://github.com/jupyter-server/jupyter_server/commit/0056c3aa52cbb28b263a7a609ae5f17618b36652; https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-h56g-gq9v-vc8r; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62LO7PPIAMLIDEKUOORXLHKLGA6QPL77/
CVE: CVE-2023-4460
Published: 2023-12-04
Description: The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/82f8d425-449a-471f-94df-8439924fd628; https://wpscan.com/vulnerability/82f8d425-449a-471f-94df-8439924fd628
CVE: CVE-2023-5105
Published: 2023-12-04
Description: The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as `wp-config.php`
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://wpscan.com/vulnerability/d40c7108-bad6-4ed3-8539-35c0f57e62cc; https://wpscan.com/vulnerability/d40c7108-bad6-4ed3-8539-35c0f57e62cc
CVE: CVE-2023-5108
Published: 2023-12-04
Description: The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/1b277929-e88b-4ab6-9190-526e75f5ce7a; https://wpscan.com/vulnerability/1b277929-e88b-4ab6-9190-526e75f5ce7a
CVE: CVE-2023-5137
Published: 2023-12-04
Description: The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/79b79e9c-ea4f-4188-a1b5-61dda0b5d434; https://wpscan.com/vulnerability/79b79e9c-ea4f-4188-a1b5-61dda0b5d434
CVE: CVE-2023-5141
Published: 2023-12-04
Description: The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9997fe8d-8027-4ae0-9885-a1f5565f2d1a; https://wpscan.com/vulnerability/9997fe8d-8027-4ae0-9885-a1f5565f2d1a
CVE: CVE-2023-5210
Published: 2023-12-04
Description: The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1c3ff47a-12a5-49c1-a166-2c57e5c0d0aa; https://wpscan.com/vulnerability/1c3ff47a-12a5-49c1-a166-2c57e5c0d0aa
CVE: CVE-2023-5762
Published: 2023-12-04
Description: The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://wpscan.com/vulnerability/6ad99725-eccc-4b61-bce2-668b62619deb; https://wpscan.com/vulnerability/6ad99725-eccc-4b61-bce2-668b62619deb
CVE: CVE-2023-5809
Published: 2023-12-04
Description: The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f1eb05e8-1b7c-45b1-912d-f668bd68e265; https://wpscan.com/vulnerability/f1eb05e8-1b7c-45b1-912d-f668bd68e265
CVE: CVE-2023-5874
Published: 2023-12-04
Description: The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ebe3e873-1259-43b9-a027-daa4dbd937f3; https://wpscan.com/vulnerability/ebe3e873-1259-43b9-a027-daa4dbd937f3
CVE: CVE-2023-5884
Published: 2023-12-04
Description: The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/f4a7937c-6f4b-49dd-b88a-67ebe718ad19; https://wpscan.com/vulnerability/f4a7937c-6f4b-49dd-b88a-67ebe718ad19
CVE: CVE-2023-5951
Published: 2023-12-04
Description: The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/81dc093a-545d-4bcd-ab85-ee9472d709e5; https://wpscan.com/vulnerability/81dc093a-545d-4bcd-ab85-ee9472d709e5
CVE: CVE-2023-5952
Published: 2023-12-04
Description: The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/0acd613e-dbd6-42ae-9f3d-6d6e77a4c1b7; https://wpscan.com/vulnerability/0acd613e-dbd6-42ae-9f3d-6d6e77a4c1b7
CVE: CVE-2023-5953
Published: 2023-12-04
Description: The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://wpscan.com/vulnerability/6d29ba12-f14a-4cee-baae-a6049d83bce6; https://wpscan.com/vulnerability/6d29ba12-f14a-4cee-baae-a6049d83bce6