deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4555
Published: 2023-08-27
Description: A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file suppliar_data.php. The manipulation of the argument name/company leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238153 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/TheCyberDiver/Public-Disclosures-CVE-/blob/main/Inventory-Management-System-XSS.md; https://vuldb.com/?ctiid.238153; https://vuldb.com/?id.238153
CVE: CVE-2023-4556
Published: 2023-08-27
Description: A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. Affected by this issue is the function mysqli_query of the file sexit.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-238154 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/weixin_43864034/article/details/132508000; https://vuldb.com/?ctiid.238154; https://vuldb.com/?id.238154
CVE: CVE-2022-43907
Published: 2023-08-27
Description: IBM Security Guardium 11.4 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  IBM X-Force ID:  240901.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240901; https://www.ibm.com/support/pages/node/7028511; https://exchange.xforce.ibmcloud.com/vulnerabilities/240901
CVE: CVE-2022-43909
Published: 2023-08-27
Description: IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  240905.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240905; https://www.ibm.com/support/pages/node/7028511; https://exchange.xforce.ibmcloud.com/vulnerabilities/240905
CVE: CVE-2023-30435
Published: 2023-08-27
Description: IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  252291.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/252291; https://www.ibm.com/support/pages/node/7028506; https://exchange.xforce.ibmcloud.com/vulnerabilities/252291
CVE: CVE-2023-30436
Published: 2023-08-27
Description: IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID: 252292.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/252292; https://www.ibm.com/support/pages/node/7028506; https://exchange.xforce.ibmcloud.com/vulnerabilities/252292
CVE: CVE-2023-30437
Published: 2023-08-27
Description: IBM Security Guardium 11.3, 11.4, and 11.5 could allow an unauthorized user to enumerate usernames by sending a specially crafted HTTP request.  IBM X-Force ID:  252293.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/252293; https://www.ibm.com/support/pages/node/7028506; https://exchange.xforce.ibmcloud.com/vulnerabilities/252293
CVE: CVE-2023-33852
Published: 2023-08-27
Description: IBM Security Guardium 11.4 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.  IBM X-Force ID:  257614.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257614; https://www.ibm.com/support/pages/node/7028514; https://exchange.xforce.ibmcloud.com/vulnerabilities/257614
CVE: CVE-2023-38730
Published: 2023-08-27
Description: IBM Storage Copy Data Management 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  262268.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262268; https://www.ibm.com/support/pages/node/7028841; https://exchange.xforce.ibmcloud.com/vulnerabilities/262268
CVE: CVE-2023-4557
Published: 2023-08-27
Description: A vulnerability classified as critical has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/search_purchase_paymen_report.php. The manipulation of the argument customer leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238158 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/ZhangXiaoDan1/cve_hub/blob/main/Free%20and%20Open%20Source%20inventory%20management%20system%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.238158; https://vuldb.com/?id.238158
CVE: CVE-2023-4558
Published: 2023-08-27
Description: A vulnerability classified as critical was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file staff_data.php. The manipulation of the argument columns[0][data] leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238159.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/TheCyberDiver/Public-Disclosures-CVE-/blob/main/Inventory%20Management%20System%20SQLi%20staff_data.md; https://vuldb.com/?ctiid.238159; https://vuldb.com/?id.238159
CVE: CVE-2023-4559
Published: 2023-08-27
Description: A vulnerability, which was classified as critical, has been found in Bettershop LaikeTui. Affected by this issue is some unknown functionality of the file index.php?module=api&action=user&m=upload of the component POST Request Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-238160.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://vuldb.com/?ctiid.238160; https://vuldb.com/?id.238160; https://vuldb.com/?ctiid.238160
CVE: CVE-2022-43904
Published: 2023-08-28
Description: IBM Security Guardium 11.3 and 11.4 could disclose sensitive information to an attacker due to improper restriction of excessive authentication attempts.  IBM X-Force ID:  240895.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240895; https://https://www.ibm.com/support/pages/node/7028509; https://exchange.xforce.ibmcloud.com/vulnerabilities/240895
CVE: CVE-2023-22877
Published: 2023-08-28
Description: IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents.  IBM X-Force ID:  244368.
CVSS Score: 7.0 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244368; https://www.ibm.com/support/pages/node/6988623; https://exchange.xforce.ibmcloud.com/vulnerabilities/244368
CVE: CVE-2023-23473
Published: 2023-08-28
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  245400.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/245400; https://www.ibm.com/support/pages/node/6988169; https://exchange.xforce.ibmcloud.com/vulnerabilities/245400
CVE: CVE-2023-24959
Published: 2023-08-28
Description: IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration.  IBM X-Force ID:  246332.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/246332; https://www.ibm.com/support/pages/node/6988615; https://exchange.xforce.ibmcloud.com/vulnerabilities/246332
CVE: CVE-2023-26270
Published: 2023-08-28
Description: IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  248119.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248119; https://www.ibm.com/support/pages/node/6995161; https://exchange.xforce.ibmcloud.com/vulnerabilities/248119
CVE: CVE-2023-26271
Published: 2023-08-28
Description: IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.  IBM X-Force ID:  248126.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248126; https://www.ibm.com/support/pages/node/6995161; https://exchange.xforce.ibmcloud.com/vulnerabilities/248126
CVE: CVE-2023-26272
Published: 2023-08-28
Description: IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  248133.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248133; https://www.ibm.com/support/pages/node/6995161; https://exchange.xforce.ibmcloud.com/vulnerabilities/248133
CVE: CVE-2023-4560
Published: 2023-08-28
Description: Improper Authorization of Index Containing Sensitive Information in GitHub repository omeka/omeka-s prior to 4.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-612
References: https://github.com/omeka/omeka-s/commit/b3d8871f22e50ff96a7070fd0be18a0df7b6cbe7; https://huntr.dev/bounties/86f06e28-ed8d-4f96-b4ad-e47f2fe94ba6; https://github.com/omeka/omeka-s/commit/b3d8871f22e50ff96a7070fd0be18a0df7b6cbe7
CVE: CVE-2023-4561
Published: 2023-08-28
Description: Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.4.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/omeka/omeka-s/commit/4482f4fc0f3a66c5ef058c4be9fabf3c29a105af; https://huntr.dev/bounties/d4302a0d-db62-4d76-93dd-e6e6473e057a; https://github.com/omeka/omeka-s/commit/4482f4fc0f3a66c5ef058c4be9fabf3c29a105af
CVE: CVE-2016-15035
Published: 2023-08-28
Description: A vulnerability was found in Doc2k RE-Chat 1.0. It has been classified as problematic. This affects an unknown part of the file js_on_radio-emergency.de_/re_chat.js. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named bd17d497ddd3bab4ef9c6831c747c37cc016c570. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-238155.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Doc2k/re-chat/commit/bd17d497ddd3bab4ef9c6831c747c37cc016c570; https://vuldb.com/?ctiid.238155; https://vuldb.com/?id.238155
CVE: CVE-2023-38024
Published: 2023-08-28
Description: 
SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.twcert.org.tw/tw/cp-132-7331-9099e-1.html; https://www.twcert.org.tw/tw/cp-132-7331-9099e-1.html
CVE: CVE-2023-38025
Published: 2023-08-28
Description: 
SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7332-ee011-1.html; https://www.twcert.org.tw/tw/cp-132-7332-ee011-1.html
CVE: CVE-2023-38026
Published: 2023-08-28
Description: 
SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html; https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html
CVE: CVE-2023-38027
Published: 2023-08-28
Description: SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system commands or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-77
References: https://www.twcert.org.tw/tw/cp-132-7334-351fb-1.html; https://www.twcert.org.tw/tw/cp-132-7334-351fb-1.html
CVE: CVE-2023-38028
Published: 2023-08-28
Description: 
Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data,  but can’t control system or disrupt service.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.twcert.org.tw/tw/cp-132-7335-d300a-1.html; https://www.twcert.org.tw/tw/cp-132-7335-d300a-1.html
CVE: CVE-2023-38029
Published: 2023-08-28
Description: 
Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html; https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html
CVE: CVE-2023-38030
Published: 2023-08-28
Description: 
Saho’s attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can execute system commands in partial website URLs to read sensitive device information without permissions.


CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.twcert.org.tw/tw/cp-132-7337-501df-1.html; https://www.twcert.org.tw/tw/cp-132-7337-501df-1.html
CVE: CVE-2023-27604
Published: 2023-08-28
Description: Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections.

 It is recommended to upgrade to a version that is not affected.
This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/apache/airflow/pull/33039; https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd; https://github.com/apache/airflow/pull/33039
CVE: CVE-2023-40195
Published: 2023-08-28
Description: Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.

When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users.

To view the warning in the docs please visit  https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html 


CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-829
References: https://github.com/apache/airflow/pull/33233; https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24; https://github.com/apache/airflow/pull/33233
CVE: CVE-2022-46783
Published: 2023-08-28
Description: An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access the other encrypted address book.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-326
References: https://advisories.stormshield.eu/; https://advisories.stormshield.eu/2022-029/; https://advisories.stormshield.eu/
CVE: CVE-2023-26095
Published: 2023-08-28
Description: ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://advisories.stormshield.eu/2023-007/; https://advisories.stormshield.eu/2023-007/
CVE: CVE-2023-34758
Published: 2023-08-28
Description: Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses.
CVSS Score: 8.1 (HIGH)
CWE: CWE-327
References: https://github.com/BishopFox/sliver/releases/tag/v1.5.40; https://github.com/advisories/GHSA-8jxm-xp43-qh3q; https://github.com/tangent65536/Slivjacker
CVE: CVE-2023-36481
Published: 2023-08-28
Description: An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, and W920. Improper handling of PPP length parameter inconsistency can cause an infinite loop.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2017-20186
Published: 2023-08-28
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in nikooo777 ckSurf up to 1.19.2. It has been declared as problematic. This vulnerability affects the function SpecListMenuDead of the file csgo/addons/sourcemod/scripting/ckSurf/misc.sp of the component Spectator List Name Handler. The manipulation of the argument cleanName leads to denial of service. Upgrading to version 1.21.0 is able to address this issue. The name of the patch is fd6318d99083a[PII_REDACTED]1a0614bd2f21068e6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-238156. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-404
References: https://forums.alliedmods.net/showthread.php?t=297179; https://github.com/nikooo777/ckSurf/commit/fd6318d99083a[PII_REDACTED]1a0614bd2f21068e6; https://github.com/nikooo777/ckSurf/releases/tag/1.21.0
CVE: CVE-2018-25089
Published: 2023-08-28
Description: A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with window.opener access. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 850c726d6bbfe0bf270801fbb92a30babea4155c. It is recommended to upgrade the affected component. The identifier VDB-238157 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-1022
References: https://github.com/glb/mediawiki-tag-extension-meetup/commit/850c726d6bbfe0bf270801fbb92a30babea4155c; https://github.com/glb/mediawiki-tag-extension-meetup/releases/tag/v0.2; https://vuldb.com/?ctiid.238157
CVE: CVE-2023-40748
Published: 2023-08-28
Description: PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f; https://www.phpjabbers.com/food-delivery-script/; https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
CVE: CVE-2023-40749
Published: 2023-08-28
Description: PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f; https://www.phpjabbers.com/food-delivery-script/; https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
CVE: CVE-2023-40750
Published: 2023-08-28
Description: There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Yacht Listing Script v1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f; https://www.phpjabbers.com/yacht-listing-script/; https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
CVE: CVE-2023-40751
Published: 2023-08-28
Description: PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the "action" parameter of index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f; https://www.phpjabbers.com/fundraising-script/; https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
CVE: CVE-2023-40752
Published: 2023-08-28
Description: There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f; https://www.phpjabbers.com/make-an-offer-widget; https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
CVE: CVE-2023-40753
Published: 2023-08-28
Description: There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f; https://www.phpjabbers.com/ticket-support-script; https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
CVE: CVE-2023-40754
Published: 2023-08-28
Description: In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f; https://www.phpjabbers.com/car-rental-script/; https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f