deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39726
Published: 2023-10-26
Description: An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-96
References: https://dgl.cx/2023/09/ansi-terminal-security#mintty-osc50; https://dgl.cx/2023/09/ansi-terminal-security#mintty-osc50
CVE: CVE-2023-46663
Published: 2023-10-26
Description: 








Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests.




CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE: CVE-2023-46664
Published: 2023-10-26
Description: 












Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages.








CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE: CVE-2023-46665
Published: 2023-10-26
Description: 
















Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain unauthorized access to the affected device with administrative privileges.













CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE: CVE-2023-46747
Published: 2023-10-26
Description: Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html; https://my.f5.com/manage/s/article/K000137353; https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/
CVE: CVE-2023-46748
Published: 2023-10-26
Description: An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which 

may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://my.f5.com/manage/s/article/K000137365; https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/; https://my.f5.com/manage/s/article/K000137365
CVE: CVE-2018-16739
Published: 2023-10-26
Description: An issue was discovered on certain ABUS TVIP devices. Due to a path traversal in /opt/cgi/admin/filewrite, an attacker can write to files, and thus execute code arbitrarily with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://sec.maride.cc/posts/abus/; https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen; https://sec.maride.cc/posts/abus/
CVE: CVE-2018-17558
Published: 2023-10-26
Description: Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-78
References: https://sec.maride.cc/posts/abus/; https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen; https://sec.maride.cc/posts/abus/
CVE: CVE-2018-17559
Published: 2023-10-26
Description: Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59, CWE-284
References: https://sec.maride.cc/posts/abus/#cve-2018-17559; https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen; https://sec.maride.cc/posts/abus/#cve-2018-17559
CVE: CVE-2018-17878
Published: 2023-10-26
Description: Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprintf() function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://sec.maride.cc/posts/abus/#cve-2018-17878; https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen; https://sec.maride.cc/posts/abus/#cve-2018-17878
CVE: CVE-2018-17879
Published: 2023-10-26
Description: An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection points in various scripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://sec.maride.cc/posts/abus/#cve-2018-17879; https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen; https://sec.maride.cc/posts/abus/#cve-2018-17879
CVE: CVE-2023-38328
Published: 2023-10-26
Description: An issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability affects the setup panel of under setup/manageheader.php, which allows authenticated remote attackers with administrator credentials to read a cleartext database password.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2023-42406
Published: 2023-10-26
Description: SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute arbitrary code via the editrole.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/1dreamGN/CVE/blob/main/CVE-2023-42406.md; https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000_sql_:sysmanage:editrole.php.md; https://github.com/1dreamGN/CVE/blob/main/CVE-2023-42406.md
CVE: CVE-2023-43352
Published: 2023-10-26
Description: An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://github.com/sromanhu/CMSmadesimple-SSTI--Content; https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content; https://github.com/sromanhu/CMSmadesimple-SSTI--Content
CVE: CVE-2023-5805
Published: 2023-10-26
Description: A vulnerability was found in SourceCodester Simple Real Estate Portal System 1.0. It has been classified as critical. Affected is an unknown function of the file view_estate.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-243618 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/lxxcute/Bug/blob/main/Real%20Estate%20Portal%20System%20view_estate.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.243618; https://vuldb.com/?id.243618
CVE: CVE-2023-27170
Published: 2023-10-26
Description: Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://balwurk.com/cve-2023-27170-improper-limitation-of-a-pathname-to-a-restricted-directory/; https://balwurk.com/cve-2023-27170-improper-limitation-of-a-pathname-to-a-restricted-directory/
CVE: CVE-2023-43737
Published: 2023-10-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-44268
Published: 2023-10-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-42188
Published: 2023-10-27
Description: IceCMS v2.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/Thecosy/IceCMS/issues/17; https://topdayplus.github.io/2023/10/27/CVE-deatail/; https://github.com/Thecosy/IceCMS/issues/17
CVE: CVE-2023-46374
Published: 2023-10-27
Description: ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://narrow-payment-2cd.notion.site/ZenTao-4-1-3-is-vulnerable-to-Cross-Site-Scripting-xss-CVE-2023-46374-ebdc61e7a88443b481b649764ba66dee; https://narrow-payment-2cd.notion.site/ZenTao-4-1-3-is-vulnerable-to-Cross-Site-Scripting-xss-CVE-2023-46374-ebdc61e7a88443b481b649764ba66dee
CVE: CVE-2023-46491
Published: 2023-10-27
Description: ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://foremost-smash-52a.notion.site/Zentao-Authorized-XSS-Vulnerability-CVE-2023-46491-eea8cbfe2fab4ea78a174e[PII_REDACTED]; https://foremost-smash-52a.notion.site/Zentao-Authorized-XSS-Vulnerability-CVE-2023-46491-eea8cbfe2fab4ea78a174e[PII_REDACTED]
CVE: CVE-2023-46375
Published: 2023-10-27
Description: ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://narrow-payment-2cd.notion.site/zentao-4-1-3-is-vulnerable-to-csrf-CVE-2023-46375-2d9d9fc2371f483eb436af20508df915; https://narrow-payment-2cd.notion.site/zentao-4-1-3-is-vulnerable-to-csrf-CVE-2023-46375-2d9d9fc2371f483eb436af20508df915
CVE: CVE-2023-46376
Published: 2023-10-27
Description: Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://narrow-payment-2cd.notion.site/zentao-8-7-has-information-disclosure-vulnerability-CVE-2023-46376-537fae3936b84af583b51b74e6010dd7; https://narrow-payment-2cd.notion.site/zentao-8-7-has-information-disclosure-vulnerability-CVE-2023-46376-537fae3936b84af583b51b74e6010dd7
CVE: CVE-2023-46505
Published: 2023-10-27
Description: Cross Site Scripting vulnerability in FanCMS v.1.0.0 allows an attacker to execute arbitrary code via the content1 parameter in the demo.php file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PwnCYN/FanCMS/issues/1; https://github.com/PwnCYN/FanCMS/issues/1
CVE: CVE-2023-5810
Published: 2023-10-27
Description: A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument edit_post_id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 6943991c62ed87c7a57989a0cb[PII_REDACTED]def8. It is recommended to apply a patch to fix this issue. The identifier VDB-243641 was assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/flusity/flusity-CMS/commit/6943991c62ed87c7a57989a0cb[PII_REDACTED]def8; https://github.com/flusity/flusity-CMS/issues/2; https://vuldb.com/?ctiid.243641
CVE: CVE-2023-5811
Published: 2023-10-27
Description: A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument menu_id leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 6943991c62ed87c7a57989a0cb[PII_REDACTED]def8. It is recommended to apply a patch to fix this issue. VDB-243642 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/flusity/flusity-CMS/commit/6943991c62ed87c7a57989a0cb[PII_REDACTED]def8; https://github.com/flusity/flusity-CMS/issues/3; https://vuldb.com/?ctiid.243642
CVE: CVE-2023-5812
Published: 2023-10-27
Description: A vulnerability has been found in flusity CMS and classified as critical. Affected by this vulnerability is the function handleFileUpload of the file core/tools/upload.php. The manipulation of the argument uploaded_file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-243643.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/flusity/flusity-CMS/issues/4; https://vuldb.com/?ctiid.243643; https://vuldb.com/?id.243643
CVE: CVE-2023-5813
Published: 2023-10-27
Description: A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_reminder. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-243644.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.243644; https://vuldb.com/?id.243644; https://vuldb.com/?ctiid.243644
CVE: CVE-2023-5814
Published: 2023-10-27
Description: A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /classes/Master.php?f=save_reminder. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-243645 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.243645; https://vuldb.com/?id.243645; https://vuldb.com/?ctiid.243645
CVE: CVE-2023-43738
Published: 2023-10-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-44162
Published: 2023-10-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-44375
Published: 2023-10-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46813
Published: 2023-10-27
Description: An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.
CVSS Score: 7.0 (HIGH)
References: https://bugzilla.suse.com/show_bug.cgi?id=1212649; https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.9; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=63e44bc52047f182601e7817da969a105aa1f721
CVE: CVE-2023-45498
Published: 2023-10-27
Description: VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/175397/VinChin-VMWare-Backup-7.0-Hardcoded-Credential-Remote-Code-Execution.html; http://packetstormsecurity.com/files/176289/Vinchin-Backup-And-Recovery-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Oct/31
CVE: CVE-2023-45499
Published: 2023-10-27
Description: VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/175397/VinChin-VMWare-Backup-7.0-Hardcoded-Credential-Remote-Code-Execution.html; http://packetstormsecurity.com/files/176289/Vinchin-Backup-And-Recovery-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Oct/31
CVE: CVE-2023-46503
Published: 2023-10-27
Description: Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a remote attacker to execute arbitrary code via the reader management and book input modules.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PwnCYN/YXBOOKCMS/issues/2; https://github.com/PwnCYN/YXBOOKCMS/issues/2
CVE: CVE-2023-46504
Published: 2023-10-27
Description: Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a physically proximate attacker to execute arbitrary code via the library name function in the general settings component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/PwnCYN/YXBOOKCMS/issues/1; https://github.com/PwnCYN/YXBOOKCMS/issues/1
CVE: CVE-2023-46815
Published: 2023-10-27
Description: An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP code can be injected via the Notes module because of missing input validation. An attacker with regular user privileges can exploit this.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-011/; https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-011/
CVE: CVE-2023-46816
Published: 2023-10-27
Description: An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/; https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/
CVE: CVE-2023-46818
Published: 2023-10-27
Description: An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html; http://seclists.org/fulldisclosure/2023/Dec/2; https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/
CVE: CVE-2023-5051
Published: 2023-10-27
Description: The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on the 'form_id' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/callrail-phone-call-tracking/tags/0.5.2/callrail.php#L174; https://plugins.trac.wordpress.org/changeset/2982876/callrail-phone-call-tracking#file0; https://www.wordfence.com/threat-intel/vulnerabilities/id/35def866-7460-4cad-8d86-7b9e4905cbe4?source=cve
CVE: CVE-2023-34057
Published: 2023-10-27
Description: VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges within the virtual machine.












CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://www.vmware.com/security/advisories/VMSA-2023-0024.html; https://www.vmware.com/security/advisories/VMSA-2023-0024.html
CVE: CVE-2023-34058
Published: 2023-10-27
Description: VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged  Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
CVSS Score: 7.1 (HIGH)
CWE: CWE-347, CWE-347
References: http://www.openwall.com/lists/oss-security/2023/10/27/1; https://lists.debian.org/debian-lts-announce/2023/11/msg00002.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G7G77Z76CQPGUF7VHRA6O3UFCMPPR4O2/
CVE: CVE-2023-34059
Published: 2023-10-27
Description: open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the 
/dev/uinput file descriptor allowing them to simulate user inputs.
CVSS Score: 7.4 (HIGH)
CWE: CWE-404
References: http://www.openwall.com/lists/oss-security/2023/10/27/2; http://www.openwall.com/lists/oss-security/2023/10/27/3; http://www.openwall.com/lists/oss-security/2023/11/26/1
CVE: CVE-2023-44219
Published: 2023-10-27
Description: A local privilege escalation vulnerability in SonicWall Directory Services Connector Windows MSI client 4.1.21 and earlier versions allows a local low-privileged user to gain system privileges through running the recovery feature.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0016; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0016
CVE: CVE-2023-44220
Published: 2023-10-27
Description: SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL component. Successful exploitation via a local attacker could result in command execution in the target system.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0017; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0017
CVE: CVE-2023-46091
Published: 2023-10-27
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin <= 2.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/category-seo-meta-tags/wordpress-category-seo-meta-tags-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/category-seo-meta-tags/wordpress-category-seo-meta-tags-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46093
Published: 2023-10-27
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LionScripts.Com Webmaster Tools plugin <= 2.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/webmaster-tools/wordpress-webmaster-tools-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/webmaster-tools/wordpress-webmaster-tools-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve