deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-48612
Published: 2023-10-16
Description: A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.7 allows remote attackers to inject JavaScript into any webpage, because a regular expression (validating whether a URL is controlled by ClassLink) is not present in all applicable places.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.zerdle.net/classlink/; https://blog.zerdle.net/classlink/
CVE: CVE-2023-35013
Published: 2023-10-16
Description: IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code.  IBM X-Force ID:  257769.
CVSS Score: 2.3 (LOW)
CWE: CWE-540, CWE-668
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257769; https://www.ibm.com/support/pages/node/7050358; https://exchange.xforce.ibmcloud.com/vulnerabilities/257769
CVE: CVE-2023-35018
Published: 2023-10-16
Description: IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation.  IBM X-Force ID:  259382.
CVSS Score: 3.3 (LOW)
CWE: CWE-434, CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/259382; https://www.ibm.com/support/pages/node/7050358; https://exchange.xforce.ibmcloud.com/vulnerabilities/259382
CVE: CVE-2023-33836
Published: 2023-10-16
Description: IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.  IBM X-Force ID:  256016.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://https://exchange.xforce.ibmcloud.com/vulnerabilities/256016; https://www.ibm.com/support/pages/node/7047640; https://https://exchange.xforce.ibmcloud.com/vulnerabilities/256016
CVE: CVE-2023-40377
Published: 2023-10-16
Description: Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability.  A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system.  IBM X-Force ID:  263583.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/263583; https://www.ibm.com/support/pages/node/7048121; https://exchange.xforce.ibmcloud.com/vulnerabilities/263583
CVE: CVE-2023-5591
Published: 2023-10-16
Description:  SQL Injection in GitHub repository librenms/librenms prior to 23.10.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/librenms/librenms/commit/908aef65967ce6184bdc587fd105660d5d55129e; https://huntr.dev/bounties/54813d42-5b93-440e-b9b1-c179d2cbf090; https://github.com/librenms/librenms/commit/908aef65967ce6184bdc587fd105660d5d55129e
CVE: CVE-2023-38280
Published: 2023-10-16
Description: IBM HMC (Hardware Management Console) 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell.  IBM X-Force ID:  260740.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260740; https://www.ibm.com/support/pages/node/7047713; https://exchange.xforce.ibmcloud.com/vulnerabilities/260740
CVE: CVE-2023-40790
Published: 2023-10-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-40791
Published: 2023-10-16
Description: extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_grab_page.
CVSS Score: 6.3 (MEDIUM)
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.12; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f443fd5af5dbd531f880d3645d5dd36976cf087f; https://lkml.org/lkml/2023/8/3/323
CVE: CVE-2023-45898
Published: 2023-10-16
Description: The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.4; https://github.com/torvalds/linux/commit/768d612f79822d30a1e7d132a4d4b05337ce42ec; https://lkml.org/lkml/2023/8/13/477
CVE: CVE-2023-36340
Published: 2023-10-16
Description: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/TOTOLINK-NR1800X.md; https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/TOTOLINK-NR1800X.md
CVE: CVE-2023-36947
Published: 2023-10-16
Description: TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/UploadCustomModule.md; https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/UploadCustomModule.md
CVE: CVE-2023-36952
Published: 2023-10-16
Description: TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/CP300%2B_1.md; https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/CP300%2B_1.md
CVE: CVE-2023-36950
Published: 2023-10-16
Description: TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/loginauth.md; https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/loginauth.md
CVE: CVE-2023-36953
Published: 2023-10-16
Description: TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/CP300%2B_2.md; https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/CP300%2B_2.md
CVE: CVE-2023-36954
Published: 2023-10-16
Description: TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/CP300%2B_3.md; https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/CP300%2B_3.md
CVE: CVE-2023-36955
Published: 2023-10-16
Description: TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/CP300%2B_4.md; https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/CP300%2B_4.md
CVE: CVE-2023-44808
Published: 2023-10-16
Description: D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug3.md; https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug3.md
CVE: CVE-2023-44809
Published: 2023-10-16
Description: D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug1.md; https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug1.md
CVE: CVE-2023-45572
Published: 2023-10-16
Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the fn parameter of the tgfile.htm function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug1.md; https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug1.md
CVE: CVE-2023-45573
Published: 2023-10-16
Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the n parameter of the mrclfile_del.asp function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug7.md; https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug7.md
CVE: CVE-2023-45574
Published: 2023-10-16
Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the fn parameter of the file.data function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug2.md; https://www.dlink.com/en/security-bulletin/; https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug2.md
CVE: CVE-2023-45575
Published: 2023-10-16
Description: Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the ip parameter of the ip_position.asp function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug5.md; https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug5.md
CVE: CVE-2023-21413
Published: 2023-10-16
Description: GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection allowing an attacker to run arbitrary code. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-77
References: https://www.axis.com/dam/public/ad/ff/83/cve-2023-21413pdf-en-US-412755.pdf; https://www.axis.com/dam/public/ad/ff/83/cve-2023-21413pdf-en-US-412755.pdf
CVE: CVE-2023-21414
Published: 2023-10-16
Description: NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (commonly known as Secure Boot) contains a flaw which provides an opportunity for a sophisticated attack to bypass this protection. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 7.1 (HIGH)
CWE: CWE-121
References: https://www.axis.com/dam/public/45/3c/a1/cve-2023-21414pdf-en-US-412758.pdf; https://www.axis.com/dam/public/45/3c/a1/cve-2023-21414pdf-en-US-412758.pdf
CVE: CVE-2023-21415
Published: 2023-10-16
Description: Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-35, CWE-22
References: https://www.axis.com/dam/public/b6/55/e2/cve-2023-21415pdf-en-US-416245.pdf; https://www.axis.com/dam/public/b6/55/e2/cve-2023-21415pdf-en-US-416245.pdf
CVE: CVE-2023-45576
Published: 2023-10-16
Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the remove_ext_proto/remove_ext_port parameter of the upnp_ctrl.asp function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug3.md; https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug3.md
CVE: CVE-2023-45577
Published: 2023-10-16
Description: Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the wanid parameter of the H5/speedlimit.data function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug9.md; https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug9.md
CVE: CVE-2023-45578
Published: 2023-10-16
Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the pap_en/chap_en parameter of the pppoe_base.asp function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug4.md; https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug4.md
CVE: CVE-2023-45579
Published: 2023-10-16
Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the ip/type parameter of the jingx.asp function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug8.md; https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug8.md
CVE: CVE-2023-45580
Published: 2023-10-16
Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the wild/mx and other parameters of the ddns.asp function
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug6.md; https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug6.md
CVE: CVE-2023-45158
Published: 2023-10-16
Description: An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://web2py.com/; http://web2py.com/init/default/download; https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3
CVE: CVE-2023-38059
Published: 2023-10-16
Description: The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://otrs.com/release-notes/otrs-security-advisory-2023-08/; https://otrs.com/release-notes/otrs-security-advisory-2023-08/
CVE: CVE-2023-3392
Published: 2023-10-16
Description: The Read More & Accordion WordPress plugin before 3.2.7 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/1e733ccf-8026-4831-9863-e505c2aecba6; https://wpscan.com/vulnerability/1e733ccf-8026-4831-9863-e505c2aecba6
CVE: CVE-2023-43666
Published: 2023-10-16
Description: Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, 

General user can view all user data like Admin account.

Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/8623 


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: https://lists.apache.org/thread/scbgh3ty3xcxm3q33r2t9f42gwwo1why; https://lists.apache.org/thread/scbgh3ty3xcxm3q33r2t9f42gwwo1why
CVE: CVE-2023-43667
Published: 2023-10-16
Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit
and trace malicious activities. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/8628
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://lists.apache.org/thread/spnb378g268p1f902fr9kqyph2k8n543; https://lists.apache.org/thread/spnb378g268p1f902fr9kqyph2k8n543
CVE: CVE-2023-43668
Published: 2023-10-16
Description: Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, 

some sensitive params  checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile"....

.  

Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/8604 


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://lists.apache.org/thread/16gtk7rpdm1rof075ro83fkrnhbzn5sh; https://lists.apache.org/thread/16gtk7rpdm1rof075ro83fkrnhbzn5sh
CVE: CVE-2023-45273
Published: 2023-10-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Matt McKenny Stout Google Calendar plugin <= 1.2.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/stout-google-calendar/wordpress-stout-google-calendar-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stout-google-calendar/wordpress-stout-google-calendar-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45274
Published: 2023-10-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in SendPulse SendPulse Free Web Push plugin <= 1.3.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/sendpulse-web-push/wordpress-sendpulse-free-web-push-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sendpulse-web-push/wordpress-sendpulse-free-web-push-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45605
Published: 2023-10-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Christopher Finke Feed Statistics plugin <= 4.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wordpress-feed-statistics/wordpress-feed-statistics-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wordpress-feed-statistics/wordpress-feed-statistics-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45606
Published: 2023-10-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Lasso Simple URLs plugin <= 120 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/simple-urls/wordpress-simple-urls-plugin-120-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-urls/wordpress-simple-urls-plugin-120-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45629
Published: 2023-10-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/gallery-album/wordpress-gallery-image-and-video-gallery-with-thumbnails-plugin-2-0-3-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gallery-album/wordpress-gallery-image-and-video-gallery-with-thumbnails-plugin-2-0-3-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45638
Published: 2023-10-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in euPago Eupago Gateway For Woocommerce plugin <= 3.1.9 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/eupago-gateway-for-woocommerce/wordpress-eupago-gateway-for-woocommerce-plugin-3-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/eupago-gateway-for-woocommerce/wordpress-eupago-gateway-for-woocommerce-plugin-3-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45650
Published: 2023-10-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com HTML5 Maps plugin <= 1.7.1.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/html5-maps/wordpress-html5-maps-plugin-1-7-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/html5-maps/wordpress-html5-maps-plugin-1-7-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45651
Published: 2023-10-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi WP Attachments allows Cross Site Request Forgery.This issue affects WP Attachments: from n/a through 5.0.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-attachments/wordpress-wp-attachments-plugin-5-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-attachments/wordpress-wp-attachments-plugin-5-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve