deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39739
Published: 2023-10-25
Description: The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39739.md; https://liff.line.me/[PII_REDACTED]-EmlxqQQx; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39739.md
CVE: CVE-2023-39740
Published: 2023-10-25
Description: The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
CVSS Score: 8.2 (HIGH)
CWE: CWE-269
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39740.md; https://liff.line.me/[PII_REDACTED]-0ozj8DwJ; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39740.md
CVE: CVE-2023-39814
Published: 2023-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-39815
Published: 2023-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-39816
Published: 2023-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-39817
Published: 2023-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-39924
Published: 2023-10-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-file-list/wordpress-simple-file-list-plugin-6-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-file-list/wordpress-simple-file-list-plugin-6-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-39930
Published: 2023-10-25
Description: A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288, CWE-306
References: https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_26_rn; https://www.pingidentity.com/en/resources/downloads/pingfederate.html; https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_26_rn
CVE: CVE-2023-3010
Published: 2023-10-25
Description: Grafana is an open-source platform for monitoring and observability. 

The WorldMap panel plugin, versions before 1.0.4 contains a DOM XSS vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://grafana.com/security/security-advisories/cve-2023-3010/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://grafana.com/security/security-advisories/cve-2023-3010/
CVE: CVE-2023-3112
Published: 2023-10-25
Description: A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-128081; https://support.lenovo.com/us/en/product_security/LEN-128081
CVE: CVE-2023-41255
Published: 2023-10-25
Description: The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication 
of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol  exposed on the network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE: CVE-2023-41339
Published: 2023-10-25
Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an ``sld=<url>`` parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling".  Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. This vulnerability can be used to steal user NetNTLMv2 hashes which could be relayed or cracked externally to gain further access. This vulnerability has been patched in versions 2.22.5 and 2.23.2.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/geoserver/geoserver/releases/tag/2.22.5; https://github.com/geoserver/geoserver/releases/tag/2.23.2; https://github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmf
CVE: CVE-2023-41372
Published: 2023-10-25
Description: The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcoded RSA key pair
CVSS Score: 7.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE: CVE-2023-41721
Published: 2023-10-25
Description: Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.

Affected Products:
UDM
UDM-PRO
UDM-SE
UDR
UDW
 
Mitigation:
Update UniFi Network to Version 7.5.187 or later.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615; https://community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615
CVE: CVE-2023-41960
Published: 2023-10-25
Description: The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent application, potentially modifying sensitive settings of the Android Client application itself.
CVSS Score: 7.1 (HIGH)
CWE: CWE-926
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE: CVE-2023-42031
Published: 2023-10-25
Description: IBM TXSeries for Multiplatforms, 8.1, 8.2, and 9.1, CICS TX Standard CICS TX Advanced 10.1 and 11.1 could allow a privileged user to cause a denial of service due to uncontrolled resource consumption.  IBM X-Force ID:  266016.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266061; https://www.ibm.com/support/pages/node/7056429; https://www.ibm.com/support/pages/node/7056433
CVE: CVE-2023-42488
Published: 2023-10-25
Description:  EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-42489
Published: 2023-10-25
Description:  EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-42490
Published: 2023-10-25
Description: 

EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor


CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-42491
Published: 2023-10-25
Description: EisBaer Scada - CWE-285: Improper Authorization
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-42492
Published: 2023-10-25
Description:  EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key
CVSS Score: 7.1 (HIGH)
CWE: CWE-321, CWE-798
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-42493
Published: 2023-10-25
Description:    EisBaer Scada - CWE-256: Plaintext Storage of a Password
CVSS Score: 7.1 (HIGH)
CWE: CWE-256
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-42494
Published: 2023-10-25
Description:     EisBaer Scada - CWE-749: Exposed Dangerous Method or Function
CVSS Score: 7.5 (HIGH)
CWE: CWE-749
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-43281
Published: 2023-10-25
Description: Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbi_load_gif_main function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://gist.github.com/peccc/d8761f6ac45ad55cbd194dd7e6fdfdac; https://github.com/peccc/double-stb; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO/
CVE: CVE-2023-43360
Published: 2023-10-25
Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File Picker Menu component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CMSmadesimple-Stored-XSS---File-Picker-extension; https://github.com/sromanhu/CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension; https://github.com/sromanhu/CMSmadesimple-Stored-XSS---File-Picker-extension
CVE: CVE-2023-43488
Published: 2023-10-25
Description: The vulnerability allows a low privileged (untrusted) application to
modify a critical system property that should be denied, in order to enable the ADB (Android Debug Bridge) protocol to be exposed on the network, exploiting it to gain a privileged shell on the device without requiring the physical access through USB.
CVSS Score: 7.9 (HIGH)
CWE: CWE-862, CWE-862
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE: CVE-2023-43506
Published: 2023-10-25
Description: A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role. A successful exploit allows malicious users to execute arbitrary code with root level privileges on the Linux instance.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt
CVE: CVE-2023-43507
Published: 2023-10-25
Description: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt
CVE: CVE-2023-43508
Published: 2023-10-25
Description: Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of these vulnerabilities allow an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt
CVE: CVE-2023-43509
Published: 2023-10-25
Description: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt
CVE: CVE-2023-43510
Published: 2023-10-25
Description: A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a non-privileged user on the underlying operating system leading to partial system compromise.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt
CVE: CVE-2023-43795
Published: 2023-10-25
Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request Forgery. This vulnerability has been patched in version 2.22.5 and 2.23.2.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/geoserver/geoserver/security/advisories/GHSA-5pr3-m5hm-9956; https://github.com/geoserver/geoserver/security/advisories/GHSA-5pr3-m5hm-9956
CVE: CVE-2023-43961
Published: 2023-10-25
Description: An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/dromara/Sa-Token/issues/511; https://github.com/dromara/Sa-Token/issues/511
CVE: CVE-2023-44767
Published: 2023-10-25
Description: A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/RiteCMS-File-Upload--XSS---Filemanager/blob/main/README.md; https://github.com/sromanhu/RiteCMS-File-Upload--XSS---Filemanager/blob/main/README.md
CVE: CVE-2023-44769
Published: 2023-10-25
Description: A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CVE-2023-44769_ZenarioCMS--Reflected-XSS---Alias/tree/main; https://github.com/sromanhu/ZenarioCMS--Reflected-XSS---Alias/tree/main; https://github.com/sromanhu/CVE-2023-44769_ZenarioCMS--Reflected-XSS---Alias/tree/main
CVE: CVE-2023-44794
Published: 2023-10-25
Description: An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/dromara/Sa-Token/issues/515; https://github.com/dromara/Sa-Token/issues/515
CVE: CVE-2023-45220
Published: 2023-10-25
Description: The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve  sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE: CVE-2023-45321
Published: 2023-10-25
Description: The Android Client application, when enrolled with the define  method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user. Due to the lack of encryption of HTTP,this issue allows an attacker placed in the same subnet network of the HMI device to intercept username and password necessary to authenticate to the MQTT server responsible to implement the remote management protocol.
CVSS Score: 8.3 (HIGH)
CWE: CWE-319, CWE-319
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE: CVE-2023-45554
Published: 2023-10-25
Description: File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg,gif, and png to jpg, jpeg,gif, png, pphphp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/96xiaopang/Vulnerabilities/blob/main/zzzcms%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0_en.md; https://github.com/96xiaopang/Vulnerabilities/blob/main/zzzcms%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0_en.md
CVE: CVE-2023-45555
Published: 2023-10-25
Description: File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the down_url function in zzz.php file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://github.com/96xiaopang/Vulnerabilities/blob/main/zzzcms%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0_en.md; https://github.com/96xiaopang/Vulnerabilities/blob/main/zzzcms%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0_en.md
CVE: CVE-2023-45634
Published: 2023-10-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Biztechc Copy or Move Comments plugin <= 5.0.4 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/copy-or-move-comments/wordpress-copy-or-move-comments-plugin-5-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/copy-or-move-comments/wordpress-copy-or-move-comments-plugin-5-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45637
Published: 2023-10-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tickets plugin <= 3.1.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-3-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-3-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45640
Published: 2023-10-25
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TechnoWich WP ULike – Most Advanced WordPress Marketing Toolkit plugin <= 4.6.8 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-ulike/wordpress-wp-ulike-plugin-4-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-ulike/wordpress-wp-ulike-plugin-4-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45644
Published: 2023-10-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cpt-shortcode/wordpress-cpt-shortcode-generator-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cpt-shortcode/wordpress-cpt-shortcode-generator-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45646
Published: 2023-10-25
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Henryholtgeerts PDF Block plugin <= 1.1.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pdf-block/wordpress-pdf-block-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pdf-block/wordpress-pdf-block-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45747
Published: 2023-10-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Syed Balkhi WP Lightbox 2 plugin <= 3.0.6.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-lightbox-2/wordpress-wp-lightbox-2-plugin-3-0-6-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-lightbox-2/wordpress-wp-lightbox-2-plugin-3-0-6-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45750
Published: 2023-10-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in POSIMYTH Nexter Extension plugin <= 2.0.3 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/nexter-extension/wordpress-nexter-extension-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/nexter-extension/wordpress-nexter-extension-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45754
Published: 2023-10-25
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form allows Stored XSS.This issue affects Easy Testimonial Slider and Form: from n/a through 1.0.18.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-testimonial-rotator/wordpress-easy-testimonial-slider-and-form-plugin-1-0-18-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/easy-testimonial-rotator/wordpress-easy-testimonial-slider-and-form-plugin-1-0-18-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-45755
Published: 2023-10-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BuddyBoss BuddyPress Global Search plugin <= 1.2.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/buddypress-global-search/wordpress-buddypress-global-search-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/buddypress-global-search/wordpress-buddypress-global-search-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve