deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3838
Published: 2023-07-23
Description: A vulnerability classified as problematic was found in DedeBIZ 6.2.10. Affected by this vulnerability is an unknown functionality of the file /admin/vote_edit.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235189 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/TXPH/CVE/blob/main/xss-report2.pdf; https://vuldb.com/?ctiid.235189; https://vuldb.com/?id.235189
CVE: CVE-2023-3839
Published: 2023-07-23
Description: A vulnerability, which was classified as problematic, has been found in DedeBIZ 6.2.10. Affected by this issue is some unknown functionality of the file /admin/sys_sql_query.php. The manipulation of the argument sqlquery leads to sql injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-235190 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-89
References: https://github.com/TXPH/CVE/blob/main/sqli-report.pdf; https://vuldb.com/?ctiid.235190; https://vuldb.com/?id.235190
CVE: CVE-2023-3840
Published: 2023-07-23
Description: A vulnerability, which was classified as problematic, was found in NxFilter 4.3.2.5. This affects an unknown part of the file /report,daily.jsp?stime=2023%2F07%2F12&timeOption=yesterday&. The manipulation of the argument user leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-235191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.235191; https://vuldb.com/?id.235191; https://vuldb.com/?ctiid.235191
CVE: CVE-2023-3841
Published: 2023-07-23
Description: A vulnerability has been found in NxFilter 4.3.2.5 and classified as problematic. This vulnerability affects unknown code of the file user.jsp. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The identifier of this vulnerability is VDB-235192. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://vuldb.com/?ctiid.235192; https://vuldb.com/?id.235192; https://vuldb.com/?ctiid.235192
CVE: CVE-2023-3842
Published: 2023-07-23
Description: A vulnerability was found in Pointware EasyInventory 1.0.12.0 and classified as critical. This issue affects some unknown processing of the file C:\Program Files (x86)\EasyInventory\Easy2W.exe. The manipulation leads to unquoted search path. Attacking locally is a requirement. The identifier VDB-235193 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://vuldb.com/?ctiid.235193; https://vuldb.com/?id.235193; https://vuldb.com/?ctiid.235193
CVE: CVE-2023-3843
Published: 2023-07-23
Description: A vulnerability was found in mooSocial mooDating 1.2. It has been classified as problematic. Affected is an unknown function of the file /matchmakings/question of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-235194 is the identifier assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235194; https://vuldb.com/?id.235194
CVE: CVE-2023-3844
Published: 2023-07-23
Description: A vulnerability was found in mooSocial mooDating 1.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /friends of the component URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235195. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235195; https://vuldb.com/?id.235195
CVE: CVE-2023-3845
Published: 2023-07-23
Description: A vulnerability was found in mooSocial mooDating 1.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /friends/ajax_invite of the component URL Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235196. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235196; https://vuldb.com/?id.235196
CVE: CVE-2023-3846
Published: 2023-07-23
Description: A vulnerability classified as problematic has been found in mooSocial mooDating 1.2. This affects an unknown part of the file /pages of the component URL Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235197 was assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235197; https://vuldb.com/?id.235197
CVE: CVE-2023-3847
Published: 2023-07-23
Description: A vulnerability classified as problematic was found in mooSocial mooDating 1.2. This vulnerability affects unknown code of the file /users of the component URL Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-235198 is the identifier assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235198; https://vuldb.com/?id.235198
CVE: CVE-2023-3848
Published: 2023-07-23
Description: A vulnerability, which was classified as problematic, has been found in mooSocial mooDating 1.2. This issue affects some unknown processing of the file /users/view of the component URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-235199. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235199; https://vuldb.com/?id.235199
CVE: CVE-2023-3849
Published: 2023-07-23
Description: A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-235200. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235200; https://vuldb.com/?id.235200
CVE: CVE-2023-28133
Published: 2023-07-23
Description: Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://support.checkpoint.com/results/sk/sk181276; https://support.checkpoint.com/results/sk/sk181276
CVE: CVE-2023-3850
Published: 2023-07-23
Description: A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=delete_category of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-235201 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.235201; https://vuldb.com/?id.235201; https://vuldb.com/?ctiid.235201
CVE: CVE-2023-3852
Published: 2023-07-23
Description: A vulnerability was found in OpenRapid RapidCMS up to 1.3.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/upload.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4dff[PII_REDACTED]61c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-235204.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/OpenRapid/rapidcms/commit/4dff[PII_REDACTED]61c362d50105ff8da8ea40bcbe; https://github.com/OpenRapid/rapidcms/issues/1; https://vuldb.com/?ctiid.235204
CVE: CVE-2023-3853
Published: 2023-07-23
Description: A vulnerability was found in phpscriptpoint BloodBank 1.1. It has been rated as problematic. This issue affects some unknown processing of the file page.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235205 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.235205; https://vuldb.com/?id.235205; https://vuldb.com/?ctiid.235205
CVE: CVE-2023-3854
Published: 2023-07-23
Description: A vulnerability classified as critical has been found in phpscriptpoint BloodBank 1.1. Affected is an unknown function of the file /search of the component POST Parameter Handler. The manipulation of the argument country/city/blood_group_id leads to sql injection. It is possible to launch the attack remotely. VDB-235206 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.235206; https://vuldb.com/?id.235206; https://vuldb.com/?ctiid.235206
CVE: CVE-2023-3855
Published: 2023-07-24
Description: A vulnerability classified as problematic was found in phpscriptpoint JobSeeker 1.5. Affected by this vulnerability is an unknown functionality of the file /search-result.php. The manipulation of the argument kw/lc/ct/cp/p leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235207. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.235207; https://vuldb.com/?id.235207; https://vuldb.com/?ctiid.235207
CVE: CVE-2023-3856
Published: 2023-07-24
Description: A vulnerability, which was classified as problematic, has been found in phpscriptpoint Ecommerce 1.15. Affected by this issue is some unknown functionality of the file /blog-single.php. The manipulation of the argument slug leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235208. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.235208; https://vuldb.com/?id.235208; https://vuldb.com/?ctiid.235208
CVE: CVE-2023-3857
Published: 2023-07-24
Description: A vulnerability, which was classified as problematic, was found in phpscriptpoint Ecommerce 1.15. This affects an unknown part of the file /product.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235209 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.235209; https://vuldb.com/?id.235209; https://vuldb.com/?ctiid.235209
CVE: CVE-2023-3858
Published: 2023-07-24
Description: A vulnerability has been found in phpscriptpoint Car Listing 1.6 and classified as problematic. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument country/state/city leads to cross site scripting. The attack can be initiated remotely. VDB-235210 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?ctiid.235210; https://vuldb.com/?id.235210; https://vuldb.com/?ctiid.235210
CVE: CVE-2023-3859
Published: 2023-07-24
Description: A vulnerability was found in phpscriptpoint Car Listing 1.6 and classified as critical. This issue affects some unknown processing of the file /search.php of the component GET Parameter Handler. The manipulation of the argument brand_id/model_id/car_condition/car_category_id/body_type_id/fuel_type_id/transmission_type_id/year/mileage_start/mileage_end/country/state/city leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-235211. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.235211; https://vuldb.com/?id.235211; https://vuldb.com/?ctiid.235211
CVE: CVE-2023-3860
Published: 2023-07-24
Description: A vulnerability was found in phpscriptpoint Insurance 1.2. It has been classified as problematic. Affected is an unknown function of the file /page.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-235212. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.235212; https://vuldb.com/?id.235212; https://vuldb.com/?ctiid.235212
CVE: CVE-2023-3861
Published: 2023-07-24
Description: A vulnerability was found in phpscriptpoint Insurance 1.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /search.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The identifier VDB-235213 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.235213; https://vuldb.com/?id.235213; https://vuldb.com/?ctiid.235213
CVE: CVE-2023-3862
Published: 2023-07-24
Description: A vulnerability was found in Travelmate Travelable Trek Management Solution 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Comment Box Handler. The manipulation of the argument comment leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. VDB-235214 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.235214; https://vuldb.com/?id.235214; https://vuldb.com/?ctiid.235214
CVE: CVE-2023-38056
Published: 2023-07-24
Description: Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.


CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://otrs.com/release-notes/otrs-security-advisory-2023-05/; https://otrs.com/release-notes/otrs-security-advisory-2023-05/
CVE: CVE-2023-38057
Published: 2023-07-24
Description: An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent.
This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.


CVSS Score: 4.1 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://otrs.com/release-notes/otrs-security-advisory-2023-06/; https://otrs.com/release-notes/otrs-security-advisory-2023-06/
CVE: CVE-2023-38058
Published: 2023-07-24
Description: An improper privilege check in the OTRS ticket move action in the agent interface allows   any as agent authenticated attacker to  to perform a move of an ticket without the needed permission.
This issue affects OTRS: from 8.0.X before 8.0.35.


CVSS Score: 4.1 (MEDIUM)
CWE: CWE-269, CWE-863
References: https://otrs.com/release-notes/otrs-security-advisory-2023-07/; https://otrs.com/release-notes/otrs-security-advisory-2023-07/
CVE: CVE-2023-38060
Published: 2023-07-24
Description: Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows  any authenticated attacker to  to perform an host header injection for the ContentType header of the attachment. 


This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-74
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html; https://otrs.com/release-notes/otrs-security-advisory-2023-04/; https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE: CVE-2023-2309
Published: 2023-07-24
Description: The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/1b3f4558-ea41-4749-9aa2-d3971fc9ca0d; https://wpscan.com/vulnerability/1b3f4558-ea41-4749-9aa2-d3971fc9ca0d
CVE: CVE-2023-2761
Published: 2023-07-24
Description: The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/8c82d317-f9f9-4e25-a7f1-43edb77e8aba; https://wpscan.com/vulnerability/8c82d317-f9f9-4e25-a7f1-43edb77e8aba
CVE: CVE-2023-3248
Published: 2023-07-24
Description: The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/90c7496b-552f-4566-b7ae-8c953c965352; https://wpscan.com/vulnerability/90c7496b-552f-4566-b7ae-8c953c965352
CVE: CVE-2023-3344
Published: 2023-07-24
Description: The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/d27bc628-3de1-421e-8a67-150e9d7a96dd; https://wpscan.com/vulnerability/d27bc628-3de1-421e-8a67-150e9d7a96dd
CVE: CVE-2023-3417
Published: 2023-07-24
Description: Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1.
CVSS Score: 7.5 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1835582; https://lists.debian.org/debian-lts-announce/2023/07/msg00032.html; https://www.debian.org/security/2023/dsa-5463
CVE: CVE-2022-28863
Published: 2023-07-24
Description: An issue was discovered in Nokia NetAct 22. A remote user, authenticated to the website, can visit the Site Configuration Tool section and arbitrarily upload potentially dangerous files without restrictions via the /netact/sct dir parameter in conjunction with the operation=upload value.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-28864
Published: 2023-07-24
Description: An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .xlsx file and executed on a victim machine. Here, the /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf templateName parameter is used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-28865
Published: 2023-07-24
Description: An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /netact/sct filename parameter is used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-28867
Published: 2023-07-24
Description: An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf templateName parameter is used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html; https://www.gruppotim.it/it/footer/red-team.html