deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-44387
Published: 2023-10-05
Description: Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file.
CVSS Score: 3.2 (LOW)
CWE: CWE-732
References: https://github.com/gradle/gradle/commit/3b406191e24d69e7e42dc3f3b5cc50625aa930b7; https://github.com/gradle/gradle/releases/tag/v7.6.3; https://github.com/gradle/gradle/releases/tag/v8.4.0
CVE: CVE-2023-4401
Published: 2023-10-05
Description: 
Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote authenticated attacker could potentially exploit this vulnerability, leading to the ability to gain root-level access.


CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-5346
Published: 2023-10-05
Description: Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html; https://crbug.com/1485829; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMFDRMWMT6ZBLGLLWSWHHRAUBOSUXQDR/
CVE: CVE-2023-5423
Published: 2023-10-05
Description: A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=confirm_order. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-241384.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.241384; https://vuldb.com/?id.241384; https://vuldb.com/?ctiid.241384
CVE: CVE-2023-32485
Published: 2023-10-05
Description: 
Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability and escalate privileges up to the highest administration level. This is a critical severity vulnerability affecting user authentication. Dell recommends customers to upgrade at the earliest opportunity.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000216587/dsa-2023-283-security-update-for-dell-smartfabric-storage-software-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000216587/dsa-2023-283-security-update-for-dell-smartfabric-storage-software-vulnerabilities
CVE: CVE-2023-40745
Published: 2023-10-05
Description: LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://access.redhat.com/errata/RHSA-2024:2289; https://access.redhat.com/security/cve/CVE-2023-40745; https://bugzilla.redhat.com/show_bug.cgi?id=2235265
CVE: CVE-2023-41175
Published: 2023-10-05
Description: A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://access.redhat.com/errata/RHSA-2024:2289; https://access.redhat.com/security/cve/CVE-2023-41175; https://bugzilla.redhat.com/show_bug.cgi?id=2235264
CVE: CVE-2023-42754
Published: 2023-10-05
Description: A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/errata/RHSA-2024:2394; https://access.redhat.com/errata/RHSA-2024:2950; https://access.redhat.com/errata/RHSA-2024:3138
CVE: CVE-2023-42755
Published: 2023-10-05
Description: A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:2950; https://access.redhat.com/errata/RHSA-2024:3138; https://access.redhat.com/security/cve/CVE-2023-42755
CVE: CVE-2023-43260
Published: 2023-10-05
Description: Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin panel.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/win3zz/c7eda501edcf5383df32fabe00938d13; https://gist.github.com/win3zz/c7eda501edcf5383df32fabe00938d13
CVE: CVE-2023-40920
Published: 2023-10-05
Description: Prixan prixanconnect up to v1.62 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::importProducts().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/05/prixanconnect.html; https://security.friendsofpresta.org/modules/2023/10/05/prixanconnect.html
CVE: CVE-2023-43284
Published: 2023-10-05
Description: D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecified manipulation of the QoS POST parameter.
CVSS Score: 8.8 (HIGH)
References: https://github.com/MateusTesser/CVE-2023-43284; https://youtu.be/Y8osw_xU6-0; https://github.com/MateusTesser/CVE-2023-43284
CVE: CVE-2023-43981
Published: 2023-10-05
Description: Presto Changeo testsitecreator up to 1.1.1 was discovered to contain a deserialization vulnerability via the component delete_excluded_folder.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://security.friendsofpresta.org/modules/2023/10/03/testsitecreator.html; https://security.friendsofpresta.org/modules/2023/10/03/testsitecreator.html
CVE: CVE-2023-43983
Published: 2023-10-05
Description: Presto Changeo attributegrid up to 2.0.3 was discovered to contain a SQL injection vulnerability via the component disable_json.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/03/attributegrid.html; https://security.friendsofpresta.org/modules/2023/10/03/attributegrid.html
CVE: CVE-2023-44024
Published: 2023-10-05
Description: SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to execute arbitrary code via a crafted request to the updateCheckoutBehaviour function in the supercheckout.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/05/supercheckout.html; https://security.friendsofpresta.org/modules/2023/10/05/supercheckout.html
CVE: CVE-2023-39323
Published: 2023-10-05
Description: Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
CVSS Score: 8.1 (HIGH)
References: https://go.dev/cl/533215; https://go.dev/issue/63211; https://groups.google.com/g/golang-announce/c/XBa1oHDevAo
CVE: CVE-2023-5441
Published: 2023-10-05
Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/vim/vim/commit/20d161ace307e28690229b68584f2d84556f8960; https://huntr.dev/bounties/b54cbdf5-3e85-458d-bb38-9ea2c0b669f2; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDDWD25AZIHBAA44HQT75OWLQ5UMDKU3/
CVE: CVE-2023-43269
Published: 2023-10-05
Description: pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/pwnero/vul/issues/1; https://github.com/pwnero/vul/issues/1
CVE: CVE-2023-43343
Published: 2023-10-05
Description: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Files - Description parameter in the Pages Menu component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sromanhu/CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files; https://github.com/sromanhu/Quick-CMS-Stored-XSS---Pages-Files; https://github.com/sromanhu/CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files
CVE: CVE-2023-44211
Published: 2023-10-05
Description: Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 31637, Acronis Cyber Protect 16 (Linux, Windows) before build 37391.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-4061; https://security-advisory.acronis.com/advisories/SEC-4061
CVE: CVE-2023-44212
Published: 2023-10-05
Description: Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 31477.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/SEC-2159; https://security-advisory.acronis.com/advisories/SEC-5528; https://security-advisory.acronis.com/SEC-2159
CVE: CVE-2023-44213
Published: 2023-10-05
Description: Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 35739, Acronis Cyber Protect 16 (Windows) before build 37391.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-359
References: https://security-advisory.acronis.com/advisories/SEC-5286; https://security-advisory.acronis.com/advisories/SEC-5286
CVE: CVE-2023-44214
Published: 2023-10-05
Description: Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-5902; https://security-advisory.acronis.com/advisories/SEC-5902
CVE: CVE-2023-45240
Published: 2023-10-05
Description: Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-5904; https://security-advisory.acronis.com/advisories/SEC-5904
CVE: CVE-2023-45241
Published: 2023-10-05
Description: Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 37391.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://security-advisory.acronis.com/advisories/SEC-5999; https://security-advisory.acronis.com/advisories/SEC-5999
CVE: CVE-2023-45242
Published: 2023-10-05
Description: Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-6018; https://security-advisory.acronis.com/advisories/SEC-6018
CVE: CVE-2023-45243
Published: 2023-10-05
Description: Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-6019; https://security-advisory.acronis.com/advisories/SEC-6019
CVE: CVE-2015-10125
Published: 2023-10-05
Description: A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/wp-plugins/wp-ultimate-csv-importer/commit/13c30af721d3f989caac72dd0f56cf0dc40fad7e; https://github.com/wp-plugins/wp-ultimate-csv-importer/releases/tag/3.7.3; https://vuldb.com/?ctiid.241317
CVE: CVE-2023-26153
Published: 2023-10-06
Description: Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value.**Note:** An attacker can use this vulnerability to execute commands on the host system.
CVSS Score: 8.3 (HIGH)
CWE: CWE-78, CWE-502
References: https://gist.github.com/CalumHutton/b7aa1c2e71c8d4386463ac14f686901d; https://github.com/geokit/geokit-rails/blob/master/lib/geokit-rails/ip_geocode_lookup.rb%23L37; https://github.com/geokit/geokit-rails/commit/7ffc5813e57f6f417987043e1039925fd0865c43
CVE: CVE-2023-40556
Published: 2023-10-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/schedule-posts-calendar/wordpress-schedule-posts-calendar-plugin-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/schedule-posts-calendar/wordpress-schedule-posts-calendar-plugin-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-5312
Published: 2023-10-06
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-43226. Reason: This candidate is a reservation duplicate of CVE-2023-43226. Notes: All CVE users should reference CVE-2023-43226 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2015-10126
Published: 2023-10-06
Description: A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The patch is identified as 503d9ee2482d27c065f78d9546f076a406189908. It is recommended to upgrade the affected component. VDB-241318 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/wp-plugins/easy2map-photos/commit/503d9ee2482d27c065f78d9546f076a406189908; https://vuldb.com/?ctiid.241318; https://vuldb.com/?id.241318
CVE: CVE-2023-45244
Published: 2023-10-06
Description: Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35895, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 37391.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-5907; https://security-advisory.acronis.com/advisories/SEC-5907
CVE: CVE-2023-45245
Published: 2023-10-06
Description: Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 36119.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-6017; https://security-advisory.acronis.com/advisories/SEC-6017
CVE: CVE-2023-4469
Published: 2023-10-06
Description: The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_export_file function in versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to expose potentially sensitive user data, including data entered into custom fields.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/2975179/profile-extra-fields; https://www.wordfence.com/threat-intel/vulnerabilities/id/916c73e8-a150-4b35-8773-ea0ec29f7fd1?source=cve; https://plugins.trac.wordpress.org/changeset/2975179/profile-extra-fields
CVE: CVE-2023-4530
Published: 2023-10-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration Panel allows SQL Injection.This issue affects Advertising Administration Panel: before 1.1.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0571; https://www.usom.gov.tr/bildirim/tr-23-0571
CVE: CVE-2023-44758
Published: 2023-10-06
Description: GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/GDidees-CMS-Stored-XSS---Title/tree/main; https://github.com/sromanhu/GDidees-CMS-Stored-XSS---Title/tree/main
CVE: CVE-2023-45246
Published: 2023-10-06
Description: Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36343, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-5903; https://security-advisory.acronis.com/advisories/SEC-5903
CVE: CVE-2023-36465
Published: 2023-10-06
Description: Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284, CWE-732
References: https://github.com/decidim/decidim/releases/tag/v0.26.8; https://github.com/decidim/decidim/releases/tag/v0.27.4; https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
CVE: CVE-2022-47175
Published: 2023-10-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/royal-elementor-addons/wordpress-royal-elementor-addons-plugin-1-3-75-multiple-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/royal-elementor-addons/wordpress-royal-elementor-addons-plugin-1-3-75-multiple-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-25033
Published: 2023-10-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sumo Social Share Boost plugin <= 4.5 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/social-share-boost/wordpress-social-share-boost-plugin-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/social-share-boost/wordpress-social-share-boost-plugin-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25480
Published: 2023-10-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.24.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/post-and-page-builder/wordpress-post-and-page-builder-by-boldgrid-plugin-1-24-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/post-and-page-builder/wordpress-post-and-page-builder-by-boldgrid-plugin-1-24-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27448
Published: 2023-10-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in MakeStories Team MakeStories (for Google Web Stories) plugin <= 2.8.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/makestories-helper/wordpress-makestories-for-google-web-stories-plugin-2-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/makestories-helper/wordpress-makestories-for-google-web-stories-plugin-2-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27615
Published: 2023-10-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Dipak C. Gajjar WP Super Minify plugin <= 1.5.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wp-super-minify/wordpress-wp-super-minify-plugin-1-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-super-minify/wordpress-wp-super-minify-plugin-1-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-40008
Published: 2023-10-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/simple-org-chart/wordpress-simple-org-chart-plugin-2-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-org-chart/wordpress-simple-org-chart-plugin-2-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve