deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2476
Published: 2023-05-02
Description: A vulnerability was found in Dromara J2eeFAST up to 2.6.0. It has been classified as problematic. Affected is an unknown function of the component Announcement Handler. The manipulation of the argument 系统工具/公告管理 leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 7a9e1a00e3329fdc0ae05f7a8257cce77037134d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-227868.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/dromara/J2EEFAST/commit/7a9e1a00e3329fdc0ae05f7a8257cce77037134d; https://gitee.com/dromara/J2EEFAST/issues/I6W380; https://vuldb.com/?ctiid.227868
CVE: CVE-2023-2477
Published: 2023-05-02
Description: A vulnerability was found in Funadmin up to 3.2.3. It has been declared as problematic. Affected by this vulnerability is the function tagLoad of the file Cx.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227869 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/funadmin/funadmin/issues/I6W2YL; https://vuldb.com/?ctiid.227869; https://vuldb.com/?id.227869
CVE: CVE-2023-29856
Published: 2023-05-02
Description: D-Link DIR-868L Hardware version A1, firmware version 1.12 is vulnerable to Buffer Overflow. The vulnerability is in scandir.sgi binary.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10325; https://www.dlink.com/en/security-bulletin/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10325
CVE: CVE-2023-2479
Published: 2023-05-02
Description: OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/appium/appium-desktop/commit/12a988aa08b9822e97056a09486c9bebb3aad8fe; https://huntr.dev/bounties/fbdeec3c-d197-4a68-a547-7f93fb9594b4; https://github.com/appium/appium-desktop/commit/12a988aa08b9822e97056a09486c9bebb3aad8fe
CVE: CVE-2023-29867
Published: 2023-05-02
Description: Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://zammad.com/en/advisories/zaa-2023-02; https://zammad.com/en/advisories/zaa-2023-02
CVE: CVE-2023-29868
Published: 2023-05-02
Description: Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized changes on articles where they only have customer permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://zammad.com/en/advisories/zaa-2023-01; https://zammad.com/en/advisories/zaa-2023-01
CVE: CVE-2023-29918
Published: 2023-05-02
Description: RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1236, CWE-1236
References: https://docs.google.com/document/d/1JAhJOlfKKD5Y5zEKo0_8a3A-nQ7Dz_GIMmlXmOvXV48/edit?usp=sharing; https://docs.google.com/document/d/1JAhJOlfKKD5Y5zEKo0_8a3A-nQ7Dz_GIMmlXmOvXV48/edit?usp=sharing
CVE: CVE-2023-30861
Published: 2023-05-02
Description: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
2. The application sets `session.permanent = True`
3. The application does not access or modify the session at any point during a request.
4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).
5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-539
References: https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b; https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965; https://github.com/pallets/flask/releases/tag/2.2.5
CVE: CVE-2022-47874
Published: 2023-05-02
Description: Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections via class 'com.jedox.etl.mngr.Connections' and method 'getGlobalConnection'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://packetstormsecurity.com/files/172156/Jedox-2020.2.5-Database-Credential-Disclosure.html; https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf; http://packetstormsecurity.com/files/172156/Jedox-2020.2.5-Database-Credential-Disclosure.html
CVE: CVE-2022-47875
Published: 2023-05-02
Description: A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/172152/Jedox-2022.4.2-Directory-Traversal-Remote-Code-Execution.html; https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf; http://packetstormsecurity.com/files/172152/Jedox-2022.4.2-Directory-Traversal-Remote-Code-Execution.html
CVE: CVE-2022-47876
Published: 2023-05-02
Description: The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/172155/Jedox-2020.2.5-Groovy-Scripts-Remote-Code-Execution.html; https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf; http://packetstormsecurity.com/files/172155/Jedox-2020.2.5-Groovy-Scripts-Remote-Code-Execution.html
CVE: CVE-2022-47877
Published: 2023-05-02
Description: A Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web script or HTML in the Logs page via the log module 'log'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/172153/Jedox-2020.2.5-Cross-Site-Scripting.html; https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf; http://packetstormsecurity.com/files/172153/Jedox-2020.2.5-Cross-Site-Scripting.html
CVE: CVE-2022-47878
Published: 2023-05-02
Description: Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify the location as Webroot directory. Consecutive file uploads can lead to the execution of arbitrary code. NOTE: The vendor states that the vulnerability affects installations running version 22.2 or earlier. The issue was resolved with the version 22.3 and later versions are not affected. Additionally, the vendor states that this vulnerability affects on-premises deployments only and that it does not impact cloud-hosted or SaaS environments.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: http://packetstormsecurity.com/files/172154/Jedox-2020.2.5-Configurable-Storage-Path-Remote-Code-Execution.html; https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf; https://jedox.mantishub.io/app/issues/57238
CVE: CVE-2023-26089
Published: 2023-05-02
Description: European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://iuclid6.echa.europa.eu; https://iuclid6.echa.europa.eu/documents/1387205/1809530/note_v6.27.6.pdf/76545a65-e6be-6486-280a-7d7c3d2ad455?t=[PII_REDACTED]69; https://iuclid6.echa.europa.eu/download
CVE: CVE-2023-26546
Published: 2023-05-02
Description: European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injection (SSTI) with a crafted template file. The attacker must have template manager permission.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://iuclid6.echa.europa.eu; https://iuclid6.echa.europa.eu/documents/1387205/1809530/note_v6.27.6.pdf/76545a65-e6be-6486-280a-7d7c3d2ad455?t=[PII_REDACTED]69; https://iuclid6.echa.europa.eu/download
CVE: CVE-2023-29778
Published: 2023-05-02
Description: GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://glinet.com; https://github.com/OlivierLaflamme/cve/blob/main/GL.iNET/MT3000/get_nginx_log_RCE.md; http://glinet.com
CVE: CVE-2023-30403
Published: 2023-05-02
Description: An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613, CWE-613
References: https://dl.packetstormsecurity.net/2305-exploits/aigitalwnr-bypass.txt; https://mandomat.github.io/2023-04-13-testing-a-cheap-wifi-repeater/; https://dl.packetstormsecurity.net/2305-exploits/aigitalwnr-bypass.txt
CVE: CVE-2023-30943
Published: 2023-05-02
Description: The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73, CWE-610
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77718; https://bugzilla.redhat.com/show_bug.cgi?id=2188605; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54TM5H5PDUDYXOQ7X7PPYWP4AJDAE73I/
CVE: CVE-2023-30944
Published: 2023-05-02
Description: The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77187; https://bugzilla.redhat.com/show_bug.cgi?id=2188606; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54TM5H5PDUDYXOQ7X7PPYWP4AJDAE73I/
CVE: CVE-2023-31433
Published: 2023-05-02
Description: A SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated attackers to execute SQL statements via the welche parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://cves.at/posts/cve-2023-31433/writeup/; https://cves.at/posts/cve-2023-31433/writeup/
CVE: CVE-2023-31434
Published: 2023-05-02
Description: The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 do not validate input, which allows authenticated attackers to inject HTML Code and XSS payloads in multiple locations.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cves.at/posts/cve-2023-31434/writeup/; https://cves.at/posts/cve-2023-31434/writeup/
CVE: CVE-2023-31435
Published: 2023-05-02
Description: Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews) in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allow authenticated attackers to read and write to unauthorized data by accessing functions directly.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863, CWE-863
References: https://cves.at/posts/cve-2023-31435/writeup/; https://cves.at/posts/cve-2023-31435/writeup/
CVE: CVE-2022-30759
Published: 2023-05-02
Description: In Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://packetstormsecurity.com/files/171971/Nokia-OneNDS-20.9-Insecure-Permissions-Privilege-Escalation.html; https://www.nokia.com/networks/products/one-nds/; https://packetstormsecurity.com/files/171971/Nokia-OneNDS-20.9-Insecure-Permissions-Privilege-Escalation.html
CVE: CVE-2023-26268
Published: 2023-05-02
Description: Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:
  *  validate_doc_update

  *  list

  *  filter

  *  filter views (using view functions as filters)

  *  rewrite

  *  update



This doesn't affect map/reduce or search (Dreyfus) index functions.

Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).

Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://docs.couchdb.org/en/stable/cve/2023-26268.html; https://lists.apache.org/thread/ldkqs0nhpmho26bdxf4fon7w75hsq5gl; https://lists.apache.org/thread/r2wvjfysg3d92lhhjd1qh3wfr8mlp0pp
CVE: CVE-2023-27892
Published: 2023-05-02
Description: Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the hardware wallet.
CVSS Score: 3.8 (LOW)
CWE: CWE-125, CWE-120
References: https://blog.inhq.net/posts/keepkey-CVE-2023-27892/; https://github.com/keepkey/keepkey-firmware/pull/337; https://blog.inhq.net/posts/keepkey-CVE-2023-27892/
CVE: CVE-2023-2459
Published: 2023-05-03
Description: Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to bypass permission restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html; https://crbug.com/1423304; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
CVE: CVE-2023-2460
Published: 2023-05-03
Description: Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to bypass file access checks via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 7.1 (HIGH)
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html; https://crbug.com/1419732; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
CVE: CVE-2023-2461
Published: 2023-05-03
Description: Use after free in OS Inputs in Google Chrome on ChromeOS prior to 113.0.5672.63 allowed a remote attacker who convinced a user to enage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html; https://crbug.com/1350561; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
CVE: CVE-2023-2462
Published: 2023-05-03
Description: Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate main origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html; https://crbug.com/1375133; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
CVE: CVE-2023-2463
Published: 2023-05-03
Description: Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html; https://crbug.com/1406120; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
CVE: CVE-2023-2464
Published: 2023-05-03
Description: Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to perform an origin spoof in the security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html; https://crbug.com/1418549; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
CVE: CVE-2023-2465
Published: 2023-05-03
Description: Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html; https://crbug.com/1399862; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
CVE: CVE-2023-2466
Published: 2023-05-03
Description: Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html; https://crbug.com/1385714; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
CVE: CVE-2023-2467
Published: 2023-05-03
Description: Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to bypass permissions restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html; https://crbug.com/1413586; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
CVE: CVE-2023-2468
Published: 2023-05-03
Description: Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the renderer process to obfuscate the security UI via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html; https://crbug.com/1416380; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
CVE: CVE-2023-29839
Published: 2023-05-03
Description: A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jichngan/CVE-2023-29839; https://github.com/jichngan/CVE-2023-29839
CVE: CVE-2023-22691
Published: 2023-05-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/category-specific-rss-feed-menu/wordpress-category-specific-rss-feed-subscription-plugin-v2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/category-specific-rss-feed-menu/wordpress-category-specific-rss-feed-subscription-plugin-v2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28070
Published: 2023-05-03
Description: 
Alienware Command Center Application, versions 5.5.43.0 and prior, contain an improper access control vulnerability. A local malicious user could potentially exploit this vulnerability during installation or update process leading to privilege escalation.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000212277/dsa-2023-135; https://www.dell.com/support/kbdoc/en-us/000212277/dsa-2023-135
CVE: CVE-2023-23790
Published: 2023-05-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/pods/wordpress-pods-custom-content-types-and-fields-plugin-2-9-10-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pods/wordpress-pods-custom-content-types-and-fields-plugin-2-9-10-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-30995
Published: 2023-05-03
Description: Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://security-advisory.acronis.com/advisories/SEC-3855; https://security-advisory.acronis.com/advisories/SEC-3855
CVE: CVE-2022-3405
Published: 2023-05-03
Description: Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://herolab.usd.de/security-advisories/usd-2022-0008/; https://security-advisory.acronis.com/advisories/SEC-4092; https://herolab.usd.de/security-advisories/usd-2022-0008/
CVE: CVE-2023-25783
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Moss FireCask Like & Share Button plugin <= 1.1.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/facebook-like-send-button/wordpress-peadig-s-like-share-button-plugin-1-1-5-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/facebook-like-send-button/wordpress-peadig-s-like-share-button-plugin-1-1-5-cross-site-scripting-xss?_s_id=cve