deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-24735
Published: 2023-03-06
Description: PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim users to an external domain via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/AetherBlack/CVE/tree/main/PMB; https://github.com/AetherBlack/CVE/tree/main/PMB
CVE: CVE-2023-24736
Published: 2023-03-06
Description: PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure_act.php.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/AetherBlack/CVE/tree/main/PMB; https://github.com/AetherBlack/CVE/tree/main/PMB
CVE: CVE-2023-24737
Published: 2023-03-06
Description: PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AetherBlack/CVE/tree/main/PMB; https://github.com/AetherBlack/CVE/tree/main/PMB
CVE: CVE-2023-26949
Published: 2023-03-06
Description: An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/keheying/onekeyadmin/issues/1; https://github.com/keheying/onekeyadmin/issues/1
CVE: CVE-2021-36397
Published: 2023-03-06
Description: In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://moodle.org/mod/forum/discuss.php?d=424803; https://moodle.org/mod/forum/discuss.php?d=424803
CVE: CVE-2021-36398
Published: 2023-03-06
Description: In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://moodle.org/mod/forum/discuss.php?d=424804; https://moodle.org/mod/forum/discuss.php?d=424804
CVE: CVE-2021-36399
Published: 2023-03-06
Description: In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://moodle.org/mod/forum/discuss.php?d=424805; https://moodle.org/mod/forum/discuss.php?d=424805
CVE: CVE-2021-36400
Published: 2023-03-06
Description: In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276, CWE-639
References: https://moodle.org/mod/forum/discuss.php?d=424806; https://moodle.org/mod/forum/discuss.php?d=424806
CVE: CVE-2021-36401
Published: 2023-03-06
Description: In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://moodle.org/mod/forum/discuss.php?d=424807; https://moodle.org/mod/forum/discuss.php?d=424807
CVE: CVE-2021-36713
Published: 2023-03-06
Description: Cross Site Scripting (XSS) vulnerability in the DataTables plug-in 1.9.2 for jQuery allows attackers to run arbitrary code via the sBaseName parameter to function _fnCreateCookie. NOTE: 1.9.2 is a version from 2012.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cdn.datatables.net/1.9.2/js/jquery.dataTables.js; https://gist.github.com/walhajri/711af9b62f6fb25e66a5d9a490deab98; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-42248
Published: 2023-03-06
Description: QlikView 12.60.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the QvsViewClient functionality.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://qlikview.com; https://github.com/Ozozuz/Qlik-View-Stored-XSS; http://qlikview.com
CVE: CVE-2023-24217
Published: 2023-03-06
Description: AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: http://packetstormsecurity.com/files/171252/Agilebio-Lab-Collector-4.234-Remote-Code-Execution.html; https://labcollector.com/labcollector-lims/add-ons/eln-electronic-lab-notebook/; http://packetstormsecurity.com/files/171252/Agilebio-Lab-Collector-4.234-Remote-Code-Execution.html
CVE: CVE-2023-26601
Published: 2023-03-06
Description: Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://manageengine.com; https://www.manageengine.com/products/service-desk/CVE-2023-26601.html; https://manageengine.com
CVE: CVE-2008-10004
Published: 2023-03-06
Description: A vulnerability was found in Email Registration 5.x-2.1 on Drupal. It has been declared as critical. This vulnerability affects the function email_registration_user of the file email_registration.module. The manipulation of the argument namenew leads to sql injection. The attack can be initiated remotely. Upgrading to version 6.x-1.0 is able to address this issue. The patch is identified as 126c141b7db038c778a2dc931d38766aad8d1112. It is recommended to upgrade the affected component. VDB-222334 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/drupalprojects/email_registration/commit/126c141b7db038c778a2dc931d38766aad8d1112; https://github.com/drupalprojects/email_registration/releases/tag/6.x-1.0; https://vuldb.com/?ctiid.222334
CVE: CVE-2019-8720
Published: 2023-03-06
Description: A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-119, CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1876611; https://webkitgtk.org/security/WSA-2019-0005.html; https://bugzilla.redhat.com/show_bug.cgi?id=1876611
CVE: CVE-2021-20251
Published: 2023-03-06
Description: A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=1929800; https://bugzilla.samba.org/show_bug.cgi?id=14611; https://security.gentoo.org/glsa/202309-06
CVE: CVE-2021-36402
Published: 2023-03-06
Description: In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://moodle.org/mod/forum/discuss.php?d=424808; https://moodle.org/mod/forum/discuss.php?d=424808
CVE: CVE-2021-36403
Published: 2023-03-06
Description: In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-912
References: https://moodle.org/mod/forum/discuss.php?d=424809; https://moodle.org/mod/forum/discuss.php?d=424809
CVE: CVE-2022-3277
Published: 2023-03-06
Description: An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://bugs.launchpad.net/neutron/+bug/1988026; https://bugzilla.redhat.com/show_bug.cgi?id=2129193; https://bugs.launchpad.net/neutron/+bug/1988026
CVE: CVE-2022-3424
Published: 2023-03-06
Description: A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2132640; https://github.com/torvalds/linux/commit/643a16a0eb1d6ac23744bb6e90a00fc21148a9dc; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE: CVE-2022-3707
Published: 2023-03-06
Description: A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could allow a local user to crash the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-460, CWE-415
References: https://bugzilla.redhat.com/show_bug.cgi?id=2137979; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE: CVE-2022-3854
Published: 2023-03-06
Description: A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-177
References: https://bugzilla.redhat.com/show_bug.cgi?id=2139925; https://bugzilla.redhat.com/show_bug.cgi?id=2139925
CVE: CVE-2022-3857
Published: 2023-03-06
Description: Rejected reason: Maintainer contacted. This is a false-positive. The flaw does not actually exist and was erroneously tested.
CVE: CVE-2022-45141
Published: 2023-03-06
Description: Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-328, CWE-326, CWE-326
References: https://security.gentoo.org/glsa/202309-06; https://www.samba.org/samba/security/CVE-2022-45141.html; https://security.gentoo.org/glsa/202309-06
CVE: CVE-2022-45142
Published: 2023-03-06
Description: The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-354, CWE-354
References: https://security.gentoo.org/glsa/202310-06; https://www.openwall.com/lists/oss-security/2023/02/08/1; https://security.gentoo.org/glsa/202310-06
CVE: CVE-2022-4134
Published: 2023-03-06
Description: A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.
CVSS Score: 2.8 (LOW)
CWE: CWE-829, CWE-829, CWE-829
References: https://bugs.launchpad.net/glance/+bug/1990157; https://bugzilla.redhat.com/show_bug.cgi?id=2147462; https://wiki.openstack.org/wiki/OSSN/OSSN-0090
CVE: CVE-2022-4904
Published: 2023-03-06
Description: A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-1284
References: https://bugzilla.redhat.com/show_bug.cgi?id=2168631; https://github.com/c-ares/c-ares/issues/496; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33LDNS6RPOPP36Z4MPWXALUQZXJCWJS2/
CVE: CVE-2023-0330
Published: 2023-03-06
Description: A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://access.redhat.com/security/cve/CVE-2023-0330; https://bugzilla.redhat.com/show_bug.cgi?id=2160151; https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html
CVE: CVE-2023-27891
Published: 2023-03-06
Description: rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://pretix.eu/about/en/blog/20230306-release-4171/; https://pretix.eu/about/en/blog/20230306-release-4171/
CVE: CVE-2017-20181
Published: 2023-03-07
Description: A vulnerability classified as critical was found in hgzojer Vocable Trainer up to 1.3.0 on Android. This vulnerability affects unknown code of the file src/at/hgz/vocabletrainer/VocableTrainerProvider.java. The manipulation leads to path traversal. Attacking locally is a requirement. Upgrading to version 1.3.1 is able to address this issue. The name of the patch is accf6838078f8eb105cfc7865aba5c705fb68426. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222328.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/hgzojer/vocabletrainer/commit/accf6838078f8eb105cfc7865aba5c705fb68426; https://github.com/hgzojer/vocabletrainer/releases/tag/v1.3.1; https://vuldb.com/?ctiid.222328
CVE: CVE-2023-1211
Published: 2023-03-07
Description: SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/phpipam/phpipam/commit/16e7a94fb69412e569ccf6f2fe0a1f847309c922; https://huntr.dev/bounties/ed569124-2aeb-4b0d-a[PII_REDACTED]92afd; https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2023-1211.md
CVE: CVE-2023-1212
Published: 2023-03-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpipam/phpipam/commit/78e0470100a6cb143fe9af2e336dce80e4620960; https://huntr.dev/bounties/3d5199d6-9bb2-4f7b-bd81-bded704da499; https://github.com/phpipam/phpipam/commit/78e0470100a6cb143fe9af2e336dce80e4620960
CVE: CVE-2023-22847
Published: 2023-03-07
Description: Information disclosure vulnerability exists in pg_ivm versions prior to 1.5.1. An Incrementally Maintainable Materialized View (IMMV) created by pg_ivm may reflect rows with Row-Level Security that the owner of the IMMV should not have access to. As a result, information in tables protected by Row-Level Security may be retrieved by a user who is not authorized to access it.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/sraoss/pg_ivm; https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1; https://jvn.jp/en/jp/JVN19872280/
CVE: CVE-2023-23554
Published: 2023-03-07
Description: Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm executes functions without specifying schema names. Under certain conditions, pg_ivm may be tricked to execute unexpected functions from other schemas with the IMMV owner's privilege. If this vulnerability is exploited, an unexpected function provided by an attacker may be executed with the privilege of the materialized view owner.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://github.com/sraoss/pg_ivm; https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1; https://jvn.jp/en/jp/JVN19872280/
CVE: CVE-2023-1237
Published: 2023-03-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/0566894a2c0e13cf07d877f41467e2e21529fee8; https://huntr.dev/bounties/cc2aa618-05da-495d-a5cd-51c40557d481; https://github.com/answerdev/answer/commit/0566894a2c0e13cf07d877f41467e2e21529fee8
CVE: CVE-2023-1238
Published: 2023-03-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/answerdev/answer/commit/0566894a2c0e13cf07d877f41467e2e21529fee8; https://huntr.dev/bounties/52f97267-1439-4bb6-862b-89b8fafce50d; https://github.com/answerdev/answer/commit/0566894a2c0e13cf07d877f41467e2e21529fee8
CVE: CVE-2023-1239
Published: 2023-03-07
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository answerdev/answer prior to 1.0.6.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/9870ed87fb24ed468aaf1e169c2d028e0f375106; https://huntr.dev/bounties/3a22c609-d2d8-4613-815d-58f5990b8bd8; https://github.com/answerdev/answer/commit/9870ed87fb24ed468aaf1e169c2d028e0f375106
CVE: CVE-2023-1240
Published: 2023-03-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/90bfa0dcc7b49482f1d1e31aee3ab073f3c13dd9; https://huntr.dev/bounties/a24f57a4-22e3-4a17-8227-6a410a11498a; https://github.com/answerdev/answer/commit/90bfa0dcc7b49482f1d1e31aee3ab073f3c13dd9
CVE: CVE-2023-1241
Published: 2023-03-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/90bfa0dcc7b49482f1d1e31aee3ab073f3c13dd9; https://huntr.dev/bounties/e0e9b1bb-3025-4b9f-acb4-16a5da28aa3c; https://github.com/answerdev/answer/commit/90bfa0dcc7b49482f1d1e31aee3ab073f3c13dd9
CVE: CVE-2023-1242
Published: 2023-03-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/90bfa0dcc7b49482f1d1e31aee3ab073f3c13dd9; https://huntr.dev/bounties/71c24c5e-ceb2-45cf-bda7-fa195d37e289; https://github.com/answerdev/answer/commit/90bfa0dcc7b49482f1d1e31aee3ab073f3c13dd9
CVE: CVE-2023-1243
Published: 2023-03-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/9870ed87fb24ed468aaf1e169c2d028e0f375106; https://huntr.dev/bounties/1d62d35a-b096-4b76-a021-347c3f1c570c; https://github.com/answerdev/answer/commit/9870ed87fb24ed468aaf1e169c2d028e0f375106
CVE: CVE-2023-1244
Published: 2023-03-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/9870ed87fb24ed468aaf1e169c2d028e0f375106; https://huntr.dev/bounties/bcab9555-8a35-42b2-a7de-0a79fd710b52; https://github.com/answerdev/answer/commit/9870ed87fb24ed468aaf1e169c2d028e0f375106
CVE: CVE-2023-1245
Published: 2023-03-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/71a4cdac[PII_REDACTED]9129d308899edd155c0e80; https://huntr.dev/bounties/f8011bb3-8212-4937-aa58-79f4b73be004; https://github.com/answerdev/answer/commit/71a4cdac[PII_REDACTED]9129d308899edd155c0e80
CVE: CVE-2022-3760
Published: 2023-03-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mia Technology Mia-Med.This issue affects Mia-Med: before 1.0.0.58.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0130; https://www.usom.gov.tr/bildirim/tr-23-0130
CVE: CVE-2023-1247
Published: 2023-03-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-26954
Published: 2023-03-07
Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/keheying/onekeyadmin/issues/11; https://github.com/keheying/onekeyadmin/issues/11
CVE: CVE-2023-26955
Published: 2023-03-07
Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin Group module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/keheying/onekeyadmin/issues/6; https://github.com/keheying/onekeyadmin/issues/6
CVE: CVE-2020-36667
Published: 2023-03-07
Description: The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability checking on the backup_guard_cloud_dropbox, backup_guard_cloud_gdrive, and backup_guard_cloud_oneDrive functions. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to change to location of back-ups and potentially steal sensitive information from them.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2348984%40backup&new=2348984%40backup&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/59532447-1d74-4d34-85f5-d89b65a001d8?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2348984%40backup&new=2348984%40backup&sfp_email=&sfph_mail=
CVE: CVE-2020-36668
Published: 2023-03-07
Description: The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level attackers, and above, to invoke the function and obtain database table information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2348984%40backup&new=2348984%40backup&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3e2a9d71-21ef-45a1-99ed-477066ce9620?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2348984%40backup&new=2348984%40backup&sfp_email=&sfph_mail=
CVE: CVE-2020-36669
Published: 2023-03-07
Description: The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backup_guard_get_import_backup() function. This makes it possible for unauthenticated attackers to upload arbitrary files to the vulnerable site's server via a forged request, granted they can trick a site's administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/2341420; https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae8de00-ba4c-48d2-a566-13dac0bc4312?source=cve; https://plugins.trac.wordpress.org/changeset/2341420
CVE: CVE-2021-44196
Published: 2023-03-07
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management System.This issue affects Student Information Management System: before 20211126.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0131; https://www.usom.gov.tr/bildirim/tr-23-0131