deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3551
Published: 2023-07-08
Description:  Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/nilsteampassnet/teampass/commit/cc6abc76aa46ed4a27736c1d2f21e432a5d54e6f; https://huntr.dev/bounties/cf8878ff-6cd9-49be-b313-7ac2a94fc7f7; https://github.com/nilsteampassnet/teampass/commit/cc6abc76aa46ed4a27736c1d2f21e432a5d54e6f
CVE: CVE-2023-3552
Published: 2023-07-08
Description: Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-116, CWE-116
References: https://github.com/nilsteampassnet/teampass/commit/8acb4dacc2d008a4186a4e13cc143e978f113955; https://huntr.dev/bounties/aeb2f43f-0602-4ac6-9685-273e87ff4ded; https://github.com/nilsteampassnet/teampass/commit/8acb4dacc2d008a4186a4e13cc143e978f113955
CVE: CVE-2023-3553
Published: 2023-07-08
Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/nilsteampassnet/teampass/commit/e9f90b746fdde135da3c7fbe4fa22fe2bd32e66b; https://huntr.dev/bounties/857f002a-2794-4807-aa5d-2f340de01870; https://github.com/nilsteampassnet/teampass/commit/e9f90b746fdde135da3c7fbe4fa22fe2bd32e66b
CVE: CVE-2023-37286
Published: 2023-07-10
Description: SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.twcert.org.tw/tw/cp-132-7221-438c6-1.html; https://www.twcert.org.tw/tw/cp-132-7221-438c6-1.html
CVE: CVE-2023-37287
Published: 2023-07-10
Description: SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://www.twcert.org.tw/tw/cp-132-7222-cdfd0-1.html; https://www.twcert.org.tw/tw/cp-132-7222-cdfd0-1.html
CVE: CVE-2023-37288
Published: 2023-07-10
Description: SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7223-af8f8-1.html; https://www.twcert.org.tw/tw/cp-132-7223-af8f8-1.html
CVE: CVE-2015-10119
Published: 2023-07-10
Description: A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affects the function action_admin_notices_activation of the file view-all-posts-pages.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is named bf914f3a59063fa4df8fd4925ae18a5d852396d7. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-233363.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/view-all-posts-pages/commit/bf914f3a59063fa4df8fd4925ae18a5d852396d7; https://vuldb.com/?ctiid.233363; https://vuldb.com/?id.233363
CVE: CVE-2015-10120
Published: 2023-07-10
Description: A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/wds-multisite-aggregate/commit/49e0bbcb6ff70e561365d9e0d26426598f63ca12; https://vuldb.com/?ctiid.233364; https://vuldb.com/?id.233364
CVE: CVE-2015-10121
Published: 2023-07-10
Description: A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic. Affected by this vulnerability is the function embed_handler of the file beelikedmicrosite.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is d23bafb5d05fb2636a2b78331f9d3fca152903dc. It is recommended to upgrade the affected component. The identifier VDB-233365 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/beeliked-microsite/commit/d23bafb5d05fb2636a2b78331f9d3fca152903dc; https://vuldb.com/?ctiid.233365; https://vuldb.com/?id.233365
CVE: CVE-2021-42080
Published: 2023-07-10
Description: An attacker is able to launch a Reflected XSS attack using a crafted URL.

POC:

Visit the following URL
https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>
CVSS Score: 7.4 (HIGH)
CWE: CWE-79, CWE-79
References: https://csirt.divd.nl/CVE-2021-42080; https://csirt.divd.nl/DIVD-2021-00020/; https://www.osnexus.com/products/software-defined-storage
CVE: CVE-2021-42081
Published: 2023-07-10
Description: An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API.

POC
http://<IP_ADDRESS>/qstorapi/storageSystemModify?storageSystem=&newName=quantastor&newDescription=;ls${IFS}-al&newLocation=4&newEnclosureLayoutId=5&newDnsServerList=;ls${IFS}-al&externalHostName=&newNTPServerList=;ls${IFS}-al
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://csirt.divd.nl/CVE-2021-42081; https://csirt.divd.nl/DIVD-2021-00020/; https://www.osnexus.com/products/software-defined-storage
CVE: CVE-2021-42082
Published: 2023-07-10
Description: Local users are able to execute scripts under root privileges.

POC

On the local host run the following command:

curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://csirt.divd.nl/CVE-2021-42082; https://csirt.divd.nl/DIVD-2021-00020/; https://www.osnexus.com/products/software-defined-storage
CVE: CVE-2021-42083
Published: 2023-07-10
Description: An authenticated attacker is able to create alerts that trigger a stored XSS attack.

POC


  *  go to the alert manager


  *  open the ITSM tab
  *  add a webhook with the URL/service token value 

'	-h	&&	id	|	tee	/tmp/ttttttddddssss	#' (whitespaces are tab characters)


  *  click add


  *  click apply


  *  create a test alert


  *  The test alert will run the command 

“id	|	tee	/tmp/ttttttddddssss” as root.


  *  after the test alert inspect 

/tmp/ttttttddddssss it'll contain the ids of the root user.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://csirt.divd.nl/CVE-2021-42083; https://csirt.divd.nl/DIVD-2021-00020/; https://www.osnexus.com/products/software-defined-storage
CVE: CVE-2021-4406
Published: 2023-07-10
Description: An authenticated attacker is able to create alerts that trigger a stored XSS attack.

POC


  *  go to the alert manager


  *  open the ITSM tab
  *  add a webhook with the URL/service token value 

'	-h	&&	id	|	tee	/tmp/ttttttddddssss	#' (whitespaces are tab characters)


  *  click add


  *  click apply


  *  create a test alert


  *  The test alert will run the command 

“id	|	tee	/tmp/ttttttddddssss” as root.


  *  after the test alert inspect 

/tmp/ttttttddddssss it'll contain the ids of the root user.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://csirt.divd.nl/CVE-2021-4406; https://csirt.divd.nl/DIVD-2021-00020/; https://www.osnexus.com/products/software-defined-storage
CVE: CVE-2023-0359
Published: 2023-07-10
Description: A missing nullptr-check in handle_ra_input can cause a nullptr-deref.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-476
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c7fq-vqm6-v5pf; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c7fq-vqm6-v5pf
CVE: CVE-2023-1119
Published: 2023-07-10
Description: The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/2e78735a-a7fc-41fe-8284-45bf451eff06; https://wpscan.com/vulnerability/2e78735a-a7fc-41fe-8284-45bf451eff06
CVE: CVE-2023-1183
Published: 2023-07-10
Description: A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-22
References: http://www.openwall.com/lists/oss-security/2023/12/28/4; http://www.openwall.com/lists/oss-security/2024/01/03/4; https://access.redhat.com/security/cve/CVE-2023-1183
CVE: CVE-2023-1208
Published: 2023-07-10
Description: This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/e0cc6740-866a-4a81-a93d-ff486b79b7f7; https://wpscan.com/vulnerability/e0cc6740-866a-4a81-a93d-ff486b79b7f7
CVE: CVE-2023-1597
Published: 2023-07-10
Description: The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog.
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/4eafe111-8874-4560-83ff-394abe7a803b; https://wpscan.com/vulnerability/4eafe111-8874-4560-83ff-394abe7a803b
CVE: CVE-2023-1780
Published: 2023-07-10
Description: The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8176308f-f210-4109-9c88-9372415dbed3; https://wpscan.com/vulnerability/8176308f-f210-4109-9c88-9372415dbed3
CVE: CVE-2023-1901
Published: 2023-07-10
Description: The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.



CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-672
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xvvm-8mcm-9cq3; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xvvm-8mcm-9cq3
CVE: CVE-2023-1902
Published: 2023-07-10
Description: The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-416, CWE-672
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx9g-8fr2-q899; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx9g-8fr2-q899
CVE: CVE-2023-22673
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <= 1.0.29.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/website-monetization-by-magenet/wordpress-website-monetization-by-magenet-plugin-1-0-29-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/website-monetization-by-magenet/wordpress-website-monetization-by-magenet-plugin-1-0-29-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-22694
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Arian Khosravi, Norik Davtian BigContact Contact Page plugin <= 1.5.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/bigcontact/wordpress-bigcontact-contact-page-plugin-1-5-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bigcontact/wordpress-bigcontact-contact-page-plugin-1-5-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-22695
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/custom-field-template/wordpress-custom-field-template-plugin-2-5-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-field-template/wordpress-custom-field-template-plugin-2-5-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-23487
Published: 2023-07-10
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging.  IBM X-Force ID:  245918.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/245918; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010567
CVE: CVE-2023-23787
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/premmerce-redirect-manager/wordpress-premmerce-redirect-manager-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/premmerce-redirect-manager/wordpress-premmerce-redirect-manager-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-23804
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Feed plugin <= 1.2.7 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/ht-instagram/wordpress-ht-feed-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ht-instagram/wordpress-ht-feed-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-23869
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Mobile plugin <= 1.6.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/google-mobile-sitemap/wordpress-google-xml-sitemap-for-mobile-plugin-1-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/google-mobile-sitemap/wordpress-google-xml-sitemap-for-mobile-plugin-1-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-23897
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ozette Plugins Simple Mobile URL Redirect plugin <= 1.7.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/simple-mobile-url-redirect/wordpress-simple-mobile-url-redirect-plugin-1-7-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-mobile-url-redirect/wordpress-simple-mobile-url-redirect-plugin-1-7-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-23993
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.Com LionScripts: IP Blocker Lite plugin <= 11.1.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ip-address-blocker/wordpress-lionscripts-ip-blocker-lite-plugin-11-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ip-address-blocker/wordpress-lionscripts-ip-blocker-lite-plugin-11-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-24395
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <= 1.0.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/cf7-redirect-thank-you-page/wordpress-contact-form-7-redirect-thank-you-page-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cf7-redirect-thank-you-page/wordpress-contact-form-7-redirect-thank-you-page-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-24405
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin <= 1.9.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/contact-form-7-paypal-add-on/wordpress-contact-form-7-paypal-stripe-add-on-plugin-1-9-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-7-paypal-add-on/wordpress-contact-form-7-paypal-stripe-add-on-plugin-1-9-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25478
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jason Rouet Weather Station plugin <= 3.8.12 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/live-weather-station/wordpress-weather-station-plugin-3-8-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/live-weather-station/wordpress-weather-station-plugin-3-8-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27540
Published: 2023-07-10
Description: IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specific to the system to cause a denial of service.  IBM X-Force ID:  248924.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248924; https://www.ibm.com/support/pages/node/7009883; https://exchange.xforce.ibmcloud.com/vulnerabilities/248924
CVE: CVE-2023-27558
Published: 2023-07-10
Description: IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path.   A local attacker could exploit this vulnerability to gain elevated privileges by inserting an executable file in the path of the affected service.  IBM X-Force ID:  249194.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249194; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010571
CVE: CVE-2023-27867
Published: 2023-07-10
Description: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  249514.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249514; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010029
CVE: CVE-2023-27868
Published: 2023-07-10
Description: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially crafted request using the named pluginClassName class, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  249516.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249516; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010029
CVE: CVE-2023-27869
Published: 2023-07-10
Description: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted request using the named traceFile property, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  249517.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249517; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010029
CVE: CVE-2023-28953
Published: 2023-07-10
Description: IBM Cognos Analytics on Cloud Pak for Data 4.0 could allow an attacker to make system calls that might compromise the security of the containers due to misconfigured security context.  IBM X-Force ID:  251465.
CVSS Score: 3.1 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/251465; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7006413
CVE: CVE-2023-28955
Published: 2023-07-10
Description: IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service.  IBM X-Force ID:  251704.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/251704; https://www.ibm.com/support/pages/node/7009747; https://exchange.xforce.ibmcloud.com/vulnerabilities/251704
CVE: CVE-2023-28958
Published: 2023-07-10
Description: IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents.  IBM X-Force ID:  251782.
CVSS Score: 7.0 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/251782; https://www.ibm.com/support/pages/node/7009747; https://exchange.xforce.ibmcloud.com/vulnerabilities/251782
CVE: CVE-2023-28986
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/affiliates-manager/wordpress-affiliates-manager-plugin-2-9-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/affiliates-manager/wordpress-affiliates-manager-plugin-2-9-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28989
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in weDevs Happy Addons for Elementor plugin <= 3.8.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/happy-elementor-addons/wordpress-happy-addons-for-elementor-plugin-3-8-2-cross-site-request-forgery-csrf-on-collect-data-popup?_s_id=cve; https://patchstack.com/database/vulnerability/happy-elementor-addons/wordpress-happy-addons-for-elementor-plugin-3-8-2-cross-site-request-forgery-csrf-on-collect-data-popup?_s_id=cve