deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-0040
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0041
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0042
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0043
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0044
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0045
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0046
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0047
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0048
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0049
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0050
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0059
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0068
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0080
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0081
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0085
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0087
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0088
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0122
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0123
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0128
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0130
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0136
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0137
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0138
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0139
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0140
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0141
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0142
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0149
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0150
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0181
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0184
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0191
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0192
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-0195
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-23145
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-26946
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-33065
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-33066
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-33067
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-33070
Published: 2023-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2023-31677
Published: 2023-05-16
Description: Insecure permissions in luowice 3.5.18 allow attackers to view information for other alarm devices via modification of the eseeid parameter.
CVSS Score: 7.5 (HIGH)
References: https://github.com/zzh-newlearner/record/blob/main/luowice.md; https://github.com/zzh-newlearner/record/blob/main/luowice.md
CVE: CVE-2023-31678
Published: 2023-05-16
Description: Incorrect access control in Videogo v6.8.1 allows attackers to bind shared devices after the connection has been ended.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/zzh-newlearner/record/blob/main/yingshi_devicekey.md; https://github.com/zzh-newlearner/record/blob/main/yingshi_devicekey.md
CVE: CVE-2023-31679
Published: 2023-05-16
Description: Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter.
CVSS Score: 7.5 (HIGH)
References: https://github.com/zzh-newlearner/record/blob/main/yingshi_privacy.md; https://github.com/zzh-newlearner/record/blob/main/yingshi_privacy.md
CVE: CVE-2023-25394
Published: 2023-05-17
Description: Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition. The Updater privileged script attempts to update Videostream every 5 hours.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://danrevah.github.io/2023/05/03/CVE-2023-25394-VideoStream-LPE/; https://getvideostream.com/; https://www.kb.cert.org/vuls/id/757109
CVE: CVE-2023-2528
Published: 2023-05-17
Description: The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to execute AJAX actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/trunk/classes/frame.php?rev=2777737#L297; https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/trunk/classes/frame.php?rev=2912584#L230; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c387b07-baf6-4c62-943e-4bd121160ceb?source=cve
CVE: CVE-2023-30452
Published: 2023-05-17
Description: The MoroSystems EasyMind - Mind Maps plugin before 2.15.0 for Confluence allows persistent XSS when saving a Mind Map with the hyperlink parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://marketplace.atlassian.com/apps/1211267/easymind-mind-maps-for-confluence/version-history; https://y-security.de/news-en/easymind-cross-site-scripting-cve-2023-30452/index.html; https://marketplace.atlassian.com/apps/1211267/easymind-mind-maps-for-confluence/version-history
CVE: CVE-2023-31848
Published: 2023-05-17
Description: davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/edp963/davinci/issues/2326; https://github.com/edp963/davinci/issues/2326
CVE: CVE-2022-42336
Published: 2023-05-17
Description: Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires that the setting of SSBD is coordinated at a core level, as the setting is shared between threads. Logic was introduced to keep track of how many threads require SSBD active in order to coordinate it, such logic relies on using a per-core counter of threads that have SSBD active. When running on the mentioned hardware, it's possible for a guest to under or overflow the thread counter, because each write to VIRT_SPEC_CTRL.SSBD by the guest gets propagated to the helper that does the per-core active accounting. Underflowing the counter causes the value to get saturated, and thus attempts for guests running on the same core to set SSBD won't have effect because the hypervisor assumes it's already active.
CVSS Score: 3.3 (LOW)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTO3U3WYLAZW3KLPKJZ332FYUREXPZMQ/; https://xenbits.xenproject.org/xsa/advisory-431.txt; http://xenbits.xen.org/xsa/advisory-431.html
CVE: CVE-2022-45144
Published: 2023-05-17
Description: Algoo Tracim before 4.4.2 allows XSS via HTML file upload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/tracim/tracim/compare/release_04.04.01...release_04.04.02; https://herolab.usd.de/security-advisories/usd-2022-0048/; https://hub.docker.com/r/algoo/tracim
CVE: CVE-2023-1763
Published: 2023-05-17
Description: Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) allows an attacker to acquire sensitive information on the Wi-Fi connection setup of the printer from the software.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-549, CWE-522
References: https://psirt.canon/advisory-information/cp2023-002/; https://psirt.canon/hardening/; https://psirt.canon/advisory-information/cp2023-002/
CVE: CVE-2023-1764
Published: 2023-05-17
Description: Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) allows an attacker to acquire sensitive information on the Wi-Fi connection setup of the printer from the communication of the software.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://psirt.canon/advisory-information/cp2023-002/; https://psirt.canon/hardening/; https://psirt.canon/advisory-information/cp2023-002/
CVE: CVE-2023-31847
Published: 2023-05-17
Description: In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server by controlling the data source to read arbitrary files on the client side.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/edp963/davinci/issues/2326; https://github.com/edp963/davinci/issues/2326
CVE: CVE-2023-2608
Published: 2023-05-17
Description: The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projects_list function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries leading to resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Version 3.3.18 addresses the SQL Injection, which drastically reduced the severity.
CVSS Score: 3.1 (LOW)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/controllers/ProjectsListManage.php#L40; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2910686%40multiple-pages-generator-by-porthas%2Ftrunk&old=2905353%40multiple-pages-generator-by-porthas%2Ftrunk&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912909%40multiple-pages-generator-by-porthas&new=2912909%40multiple-pages-generator-by-porthas&sfp_email=&sfph_mail=
CVE: CVE-2023-2706
Published: 2023-05-17
Description: The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://lana.codes/lanavdb/87b5e80e-fd5b-47c3-bf82-088bdf4573b5/; https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.2/includes/class-xoo-ml-verification.php#L362; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912731%40mobile-login-woocommerce&new=2912731%40mobile-login-woocommerce&sfp_email=&sfph_mail=
CVE: CVE-2023-2509
Published: 2023-05-17
Description: A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. An attacker can exploit this vulnerability to inject malicious scripts into the target applications to access any cookies or sensitive information retained by the browser and used with that application. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below, LooksGood 2.0.0.R129 and below and SoundsGood 2.3.0.r1027 and below.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.asustor.com/security/security_advisory_detail?id=22; https://www.asustor.com/security/security_advisory_detail?id=22
CVE: CVE-2023-0863
Published: 2023-05-17
Description: Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symbiosis, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): from 1.0;0 through 1.5.5; Terra AC wallbox (UL32A) : from 1.0;0 through 1.6.5; Terra AC wallbox (CE) (Terra AC MID): from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC Juno CE: from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC PTB : from 1.0;0 through 1.5.25; Terra AC wallbox (CE) Symbiosis: from 1.0;0 through 1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5.


CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A1415&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A1415&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2023-0864
Published: 2023-05-17
Description: Cleartext Transmission of Sensitive Information vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symbiosis, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): from 1.0;0 through 1.5.5; Terra AC wallbox (UL32A) : from 1.0;0 through 1.6.5; Terra AC wallbox (CE) (Terra AC MID): from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC Juno CE: from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC PTB : from 1.0;0 through 1.5.25; Terra AC wallbox (CE) Symbiosis: from 1.0;0 through 1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5.


CVSS Score: 7.1 (HIGH)
CWE: CWE-319, CWE-319
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A1415&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A1415&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2023-2469
Published: 2023-05-17
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-2752
Published: 2023-05-17
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/e7599d49b0ece7ceef3a4e8d334782cc3df98be8; https://huntr.dev/bounties/efdf5b24-6d30-4d57-a5b0-13b253ba3ea4; https://github.com/thorsten/phpmyfaq/commit/e7599d49b0ece7ceef3a4e8d334782cc3df98be8
CVE: CVE-2023-2753
Published: 2023-05-17
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/5401ab75d022932b8d5d7adaa771acf44fed18ba; https://huntr.dev/bounties/eca2284d-e81a-4ab8-91bb-7afeca557628; https://github.com/thorsten/phpmyfaq/commit/5401ab75d022932b8d5d7adaa771acf44fed18ba
CVE: CVE-2023-2745
Published: 2023-05-17
Description: WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail=; https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/; https://www.wordfence.com/blog/2023/05/wordpress-core-6-2-1-security-maintenance-release-what-you-need-to-know/
CVE: CVE-2023-31208
Published: 2023-05-17
Description: Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users.
CVSS Score: 8.3 (HIGH)
CWE: CWE-140, CWE-77
References: https://checkmk.com/werk/15191; https://checkmk.com/werk/15191
CVE: CVE-2023-2756
Published: 2023-05-17
Description: SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe; https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44; https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe
CVE: CVE-2023-2679
Published: 2023-05-17
Description: Data leakage in Adobe connector in Snow Software SPE 9.27.0 on Windows allows privileged user to observe other users data.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-269
References: https://community.snowsoftware.com/s/feed/0D56M00009Ex9dySAB; https://community.snowsoftware.com/s/feed/0D56M00009Ex9dySAB