deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1140
Published: 2023-03-27
Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauthenticated remote code execution in the context of an administrator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1141
Published: 2023-03-27
Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a command injection vulnerability that could allow an attacker to inject arbitrary commands, which could result in remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1142
Published: 2023-03-27
Description: In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1143
Published: 2023-03-27
Description: In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
CVSS Score: 8.8 (HIGH)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1144
Published: 2023-03-27
Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1145
Published: 2023-03-27
Description: 






Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.






CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1655
Published: 2023-03-27
Description: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4; https://huntr.dev/bounties/05f1d1de-bbfd-43fe-bdf9-7f73419ce7c9; https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4
CVE: CVE-2023-1659
Published: 2023-03-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-22707
Published: 2023-03-27
Description: Auth. (author+) Cross-Site Scripting (XSS) vulnerability in Wpsoul Greenshift – animation and page builder blocks plugin <= 4.9.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/greenshift-animation-and-page-builder-blocks/wordpress-greenshift-animation-and-page-builder-blocks-plugin-4-9-9-svg-upload-to-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/greenshift-animation-and-page-builder-blocks/wordpress-greenshift-animation-and-page-builder-blocks-plugin-4-9-9-svg-upload-to-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27296
Published: 2023-03-27
Description: Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.

It could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability.

This issue affects Apache InLong: from 1.1.0 through 1.5.0.  Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it.



[1]  https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html

 https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html 

[2]  https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422 




CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://lists.apache.org/thread/xbvtjw9bwzgbo9fp1by8o3p49nf59xzt; https://lists.apache.org/thread/xbvtjw9bwzgbo9fp1by8o3p49nf59xzt
CVE: CVE-2020-36666
Published: 2023-03-27
Description: The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
CVSS Score: 8.8 (HIGH)
References: https://codecanyon.net/user/e-plugins; https://wpscan.com/vulnerability/d079cb16-ead5-4bc8-b0b8-4a4dc2a54c96; https://codecanyon.net/user/e-plugins
CVE: CVE-2022-48426
Published: 2023-03-27
Description: In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-48429
Published: 2023-03-27
Description: In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible

CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-0272
Published: 2023-03-27
Description: The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/047b50c0-0eb3-4371-9e5d-3778fdafc66b; https://wpscan.com/vulnerability/047b50c0-0eb3-4371-9e5d-3778fdafc66b
CVE: CVE-2023-0335
Published: 2023-03-27
Description: The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://wpscan.com/vulnerability/f7a20bea-c3d5-431b-bdcf-e189c81a561a; https://wpscan.com/vulnerability/f7a20bea-c3d5-431b-bdcf-e189c81a561a
CVE: CVE-2023-0336
Published: 2023-03-27
Description: The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://wpscan.com/vulnerability/ac74df9a-6fbf-4411-a501-97eba1ad1895; https://wpscan.com/vulnerability/ac74df9a-6fbf-4411-a501-97eba1ad1895
CVE: CVE-2023-0395
Published: 2023-03-27
Description: The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/3f2565cd-7050-4ebd-9a50-cd9b9f7c3341; https://wpscan.com/vulnerability/3f2565cd-7050-4ebd-9a50-cd9b9f7c3341
CVE: CVE-2023-0441
Published: 2023-03-27
Description: The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.
CVSS Score: 8.1 (HIGH)
References: https://wpscan.com/vulnerability/11703e49-c042-4eb6-9a5f-6e006e3725a0; https://wpscan.com/vulnerability/11703e49-c042-4eb6-9a5f-6e006e3725a0
CVE: CVE-2023-0467
Published: 2023-03-27
Description: The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://wpscan.com/vulnerability/8eb431a6-59a5-4cee-84e0-156c0b31cfc4; https://wpscan.com/vulnerability/8eb431a6-59a5-4cee-84e0-156c0b31cfc4
CVE: CVE-2023-0484
Published: 2023-03-27
Description: The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/e61fb245-0d7f-42b0-9b96-c17ade8c04c5; https://wpscan.com/vulnerability/e61fb245-0d7f-42b0-9b96-c17ade8c04c5
CVE: CVE-2023-0491
Published: 2023-03-27
Description: The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/b1a7e8fc-ffcf-493b-9f2d-ffa5d2348b60; https://wpscan.com/vulnerability/b1a7e8fc-ffcf-493b-9f2d-ffa5d2348b60
CVE: CVE-2023-0495
Published: 2023-03-27
Description: The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/2e3af480-b1a4-404c-b0fc-2b7b6a6b9c27; https://wpscan.com/vulnerability/2e3af480-b1a4-404c-b0fc-2b7b6a6b9c27
CVE: CVE-2023-0496
Published: 2023-03-27
Description: The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/451b47d5-7bd2-4a82-9c8e-fe6601bcd2ab; https://wpscan.com/vulnerability/451b47d5-7bd2-4a82-9c8e-fe6601bcd2ab
CVE: CVE-2023-0497
Published: 2023-03-27
Description: The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/ae5b7776-9d0d-4db8-81c3-237b16cd9c62; https://wpscan.com/vulnerability/ae5b7776-9d0d-4db8-81c3-237b16cd9c62
CVE: CVE-2023-0498
Published: 2023-03-27
Description: The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/8fa051ad-5b35-46d8-be95-0ac4e73d5eff; https://wpscan.com/vulnerability/8fa051ad-5b35-46d8-be95-0ac4e73d5eff
CVE: CVE-2023-0499
Published: 2023-03-27
Description: The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/9342470a-a0ad-4f0b-b95f-7daa39a6362b; https://wpscan.com/vulnerability/9342470a-a0ad-4f0b-b95f-7daa39a6362b
CVE: CVE-2023-0500
Published: 2023-03-27
Description: The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/95a6a11e-da5d-4fac-aff6-a3f7624682b7; https://wpscan.com/vulnerability/95a6a11e-da5d-4fac-aff6-a3f7624682b7
CVE: CVE-2023-0501
Published: 2023-03-27
Description: The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/36fd6c0d-3f0c-4f7d-aa17-5b2d084ab94c; https://wpscan.com/vulnerability/36fd6c0d-3f0c-4f7d-aa17-5b2d084ab94c
CVE: CVE-2023-0502
Published: 2023-03-27
Description: The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/c959f4ce-b6ea-4aee-9a98-aa98d2a62138; https://wpscan.com/vulnerability/c959f4ce-b6ea-4aee-9a98-aa98d2a62138
CVE: CVE-2023-0503
Published: 2023-03-27
Description: The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/3cb148fb-1f30-4316-a421-10da51d849f3; https://wpscan.com/vulnerability/3cb148fb-1f30-4316-a421-10da51d849f3
CVE: CVE-2023-0504
Published: 2023-03-27
Description: The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/b427841d-a3ad-4e3a-8964-baad90a9aedb; https://wpscan.com/vulnerability/b427841d-a3ad-4e3a-8964-baad90a9aedb
CVE: CVE-2023-0505
Published: 2023-03-27
Description: The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/dbabff3e-b021-49ed-aaf3-b73a77d4b354; https://wpscan.com/vulnerability/dbabff3e-b021-49ed-aaf3-b73a77d4b354
CVE: CVE-2023-0589
Published: 2023-03-27
Description: The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/58649228-69a6-4028-8487-166b0a07fcf7; https://wpscan.com/vulnerability/58649228-69a6-4028-8487-166b0a07fcf7
CVE: CVE-2023-0660
Published: 2023-03-27
Description: The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/3fe712bc-ce7f-4b30-9fc7-1ff15aa5b6ce; https://wpscan.com/vulnerability/3fe712bc-ce7f-4b30-9fc7-1ff15aa5b6ce
CVE: CVE-2023-0816
Published: 2023-03-27
Description: The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://wpscan.com/vulnerability/a281f63f-e295-4666-8a08-01b23cd5a744; https://wpscan.com/vulnerability/a281f63f-e295-4666-8a08-01b23cd5a744
CVE: CVE-2023-0823
Published: 2023-03-27
Description: The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/83f23a9f-9ace-47d2-a5f3-a4915129b16c; https://wpscan.com/vulnerability/83f23a9f-9ace-47d2-a5f3-a4915129b16c
CVE: CVE-2023-0955
Published: 2023-03-27
Description: The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/18b7e93f-b038-4f28-918b-4015d62f0eb8; https://wpscan.com/vulnerability/18b7e93f-b038-4f28-918b-4015d62f0eb8
CVE: CVE-2023-1025
Published: 2023-03-27
Description: The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/13621b13-8d31-4214-a665-cb15981f3ec1; https://wpscan.com/vulnerability/13621b13-8d31-4214-a665-cb15981f3ec1
CVE: CVE-2023-1069
Published: 2023-03-27
Description: The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/caacc50c-822e-46e9-bc0b-681349fd0dda; https://wpscan.com/vulnerability/caacc50c-822e-46e9-bc0b-681349fd0dda
CVE: CVE-2023-1086
Published: 2023-03-27
Description: The Preview Link Generator WordPress plugin before 1.0.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/e2bda716-76dc-4a26-b26a-7a2a764757b0; https://wpscan.com/vulnerability/e2bda716-76dc-4a26-b26a-7a2a764757b0
CVE: CVE-2023-1087
Published: 2023-03-27
Description: The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/356c89a1-81b6-4600-9291-1a74788af7f9; https://wpscan.com/vulnerability/356c89a1-81b6-4600-9291-1a74788af7f9
CVE: CVE-2023-1088
Published: 2023-03-27
Description: The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/a956f1cd-fce4-4235-b1af-4b7675a60ca2; https://wpscan.com/vulnerability/a956f1cd-fce4-4235-b1af-4b7675a60ca2
CVE: CVE-2023-1089
Published: 2023-03-27
Description: The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/9787e26f-33fe-4c65-abb3-7f5c76ae8d6f; https://wpscan.com/vulnerability/9787e26f-33fe-4c65-abb3-7f5c76ae8d6f
CVE: CVE-2023-1092
Published: 2023-03-27
Description: The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7; https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09c; https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31b
CVE: CVE-2023-1093
Published: 2023-03-27
Description: The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d; https://wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d
CVE: CVE-2023-1399
Published: 2023-03-27
Description: 
N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate privileges in the affected device’s default configuration and achieve remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-01
CVE: CVE-2023-1400
Published: 2023-03-27
Description: The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/c7feceef-28f1-4cac-b124-4b95e3f17b07; https://wpscan.com/vulnerability/c7feceef-28f1-4cac-b124-4b95e3f17b07
CVE: CVE-2023-1654
Published: 2023-03-27
Description: Denial of Service in GitHub repository gpac/gpac prior to 2.4.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-400
References: https://github.com/gpac/gpac/commit/2c055153d401b8c49422971e3a[PII_REDACTED]d3da; https://huntr.dev/bounties/33652b56-128f-41a7-afcc-10641f69ff14; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2023-27847
Published: 2023-03-27
Description: SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://friends-of-presta.github.io/security-advisories/modules/2023/03/23/xipblog.html; https://github.com/xpert-idea/xipblog/; https://friends-of-presta.github.io/security-advisories/modules/2023/03/23/xipblog.html