deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-29074
Published: 2023-11-23
Description: A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018
CVE: CVE-2023-29075
Published: 2023-11-23
Description: A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018
CVE: CVE-2023-29076
Published: 2023-11-23
Description: A maliciously crafted MODEL, SLDASM, SAT or CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 could cause memory corruption vulnerability. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018
CVE: CVE-2023-41139
Published: 2023-11-23
Description: A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-119
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018
CVE: CVE-2023-41140
Published: 2023-11-23
Description: A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018
CVE: CVE-2023-28811
Published: 2023-11-23
Description: There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
CVSS Score: 7.4 (HIGH)
CWE: CWE-120
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/buffer-overflow-vulnerability-in-hikvision-nvr-dvr-devices/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/buffer-overflow-vulnerability-in-hikvision-nvr-dvr-devices/
CVE: CVE-2023-39253
Published: 2023-11-23
Description: 
Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator user could potentially exploit this vulnerability, leading to the elevation of privilege on the system.


CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000217699/dsa-2023-336-security-update-for-a-dell-os-recovery-tool-vulnerability; https://www.dell.com/support/kbdoc/en-us/000217699/dsa-2023-336-security-update-for-a-dell-os-recovery-tool-vulnerability
CVE: CVE-2023-43086
Published: 2023-11-23
Description: 
Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. A local malicious user could potentially modify files inside installation folder during application upgrade, leading to privilege escalation.


CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000218424/dsa-2023-387-security-update-for-a-dell-command-configure-vulnerability; https://www.dell.com/support/kbdoc/en-us/000218424/dsa-2023-387-security-update-for-a-dell-command-configure-vulnerability
CVE: CVE-2023-44289
Published: 2023-11-23
Description: 
Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit this vulnerability while repairing/changing installation, leading to privilege escalation.


CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000218628/dsa-2023-390-security-update-for-dell-command-configure-and-dell-command-monitor-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218628/dsa-2023-390-security-update-for-dell-command-configure-and-dell-command-monitor-vulnerabilities
CVE: CVE-2023-44290
Published: 2023-11-23
Description: 
Dell Command | Monitor versions prior to 10.10.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit this vulnerability while repairing/changing installation, leading to privilege escalation.


CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000218628/dsa-2023-390-security-update-for-dell-command-configure-and-dell-command-monitor-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218628/dsa-2023-390-security-update-for-dell-command-configure-and-dell-command-monitor-vulnerabilities
CVE: CVE-2023-28812
Published: 2023-11-23
Description: There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers installed with this plug-in, which could lead to arbitrary code execution or cause process exception of the plug-in.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-web-browser-plug-in-locals/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-web-browser-plug-in-locals/
CVE: CVE-2023-28813
Published: 2023-11-23
Description: An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files. 
CVSS Score: 8.1 (HIGH)
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-web-browser-plug-in-locals/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-web-browser-plug-in-locals/
CVE: CVE-2023-3377
Published: 2023-11-23
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection.This issue affects Veribase: through 20231123. 

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://https://www.usom.gov.tr/bildirim/tr-23-0655; https://https://www.usom.gov.tr/bildirim/tr-23-0655
CVE: CVE-2023-3631
Published: 2023-11-23
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Medart Health Services Medart Notification Panel allows SQL Injection.This issue affects Medart Notification Panel: through 20231123. 

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://https://www.usom.gov.tr/bildirim/tr-23-0656; https://https://www.usom.gov.tr/bildirim/tr-23-0656
CVE: CVE-2023-43123
Published: 2023-11-23
Description: On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems.

The method File.createTempFile on unix-like systems creates a file with predefined name (so easily identifiable) and by default will create this file with the permissions -rw-r--r--. Thus, if sensitive information is written to this file, other local users can read this information.

File.createTempFile(String, String) will create a temporary file in the system temporary directory if the 'java.io.tmpdir' system property is not explicitly set. 

This affects the class  https://github.com/apache/storm/blob/master/storm-core/src/jvm/org/apache/storm/utils/TopologySpoutLag.java#L99  and was introduced by  https://issues.apache.org/jira/browse/STORM-3123 

In practice, this has a very limited impact as this class is used only if ui.disable.spout.lag.monitoring

 is set to false, but its value is true by default.
Moreover, the temporary file gets deleted soon after its creation.

The solution is to use  Files.createTempFile https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/nio/file/Files.html#createTempFile(java.lang.String,java.lang.String,java.nio.file.attribute.FileAttribute...)  instead.

We recommend that all users upgrade to the latest version of Apache Storm.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2023/11/23/1; https://lists.apache.org/thread/88oc1vqfjtr29cz5xts0v2wm5pmhbm0l; http://www.openwall.com/lists/oss-security/2023/11/23/1
CVE: CVE-2023-4406
Published: 2023-11-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS.This issue affects E-Commerce Software: through 20231123. 

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.




CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://https://www.usom.gov.tr/bildirim/tr-23-0657; https://https://www.usom.gov.tr/bildirim/tr-23-0657
CVE: CVE-2023-4593
Published: 2023-11-23
Description: Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent directory via any filename, such as a multiple ..%2F value affecting the 'dodoc' parameter in the /MailAdmin_dll.htm file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail
CVE: CVE-2023-4594
Published: 2023-11-23
Description: Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in the MailAdmin_dll.htm file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail
CVE: CVE-2023-4595
Published: 2023-11-23
Description: An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the server such as credential files, configuration files, application files, etc., simply by appending any of the following parameters to the end of the URL: %00 %0a, %20, %2a, %a0, %aa, %c0 and %ca.
CVSS Score: 7.5 (HIGH)
CWE: CWE-538
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail
CVE: CVE-2023-41786
Published: 2023-11-23
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low privileges to download database backups. This issue affects Pandora FMS: from 700 through 772.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41787
Published: 2023-11-23
Description: Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows access to files with sensitive information. This issue affects Pandora FMS: from 700 through 772.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41788
Published: 2023-11-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 7.6 (HIGH)
CWE: CWE-434, CWE-434
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41789
Published: 2023-11-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allows an attacker to perform cookie hijacking and log in as that user without the need for credentials. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41790
Published: 2023-11-23
Description: Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows to access the server configuration file and to compromise the database. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 7.6 (HIGH)
CWE: CWE-427, CWE-427
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41791
Published: 2023-11-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed users with low privileges to introduce Javascript executables via a translation string that could affect the integrity of some configuration files. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41792
Published: 2023-11-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the SNMP Trap Editor. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41806
Published: 2023-11-23
Description: Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could cause a DOS attack that affects the availability of the Pandora FMS server. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 8.2 (HIGH)
CWE: CWE-269
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41807
Published: 2023-11-23
Description: Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows a user to escalate permissions on the system shell. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41808
Published: 2023-11-23
Description: Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and read sensitive files as if they were root. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 8.5 (HIGH)
CWE: CWE-269
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41810
Published: 2023-11-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in some Widgets' text box. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41811
Published: 2023-11-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the news section of the web console. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-41812
Published: 2023-11-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allowed PHP executable files to be uploaded through the file manager. This issue affects Pandora FMS: from 700 through 773.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-4677
Published: 2023-11-23
Description: Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This issue affects Pandora FMS <= 772.
CVSS Score: 7.0 (HIGH)
CWE: CWE-287, CWE-532
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-6118
Published: 2023-11-23
Description: Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal.This issue affects IP Camera: before b1130.1.0.1.


CVSS Score: 7.5 (HIGH)
CWE: CWE-25, CWE-22
References: https://www.usom.gov.tr/bildirim/tr-23-0658; https://www.usom.gov.tr/bildirim/tr-23-0658
CVE: CVE-2022-44010
Published: 2023-11-23
Description: An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP request to the HTTP Endpoint (usually listening on port 8123 by default), causing a heap-based buffer overflow that crashes the process. This does not require authentication. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://clickhouse.com/docs/en/whats-new/security-changelog; https://clickhouse.com/docs/en/whats-new/security-changelog
CVE: CVE-2022-44011
Published: 2023-11-23
Description: An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user (with the ability to load data) could cause a heap buffer overflow and crash the server by inserting a malformed CapnProto object. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://clickhouse.com; https://clickhouse.com
CVE: CVE-2023-33202
Published: 2023-11-23
Description: Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://bouncycastle.org; https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902023%E2%80%9033202; https://github.com/bcgit/bc-java/wiki/CVE-2023-33202
CVE: CVE-2023-49208
Published: 2023-11-23
Description: scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/babelouest/glewlwyd/commit/f9d8c06aae8dfe17e761b18b577ff169e059e812; https://github.com/babelouest/glewlwyd/releases/tag/v2.7.6; https://github.com/babelouest/glewlwyd/commit/f9d8c06aae8dfe17e761b18b577ff169e059e812
CVE: CVE-2023-5972
Published: 2023-11-23
Description: A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local user to crash the system or escalate their privileges on the system.
CVSS Score: 7.0 (HIGH)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/security/cve/CVE-2023-5972; https://bugzilla.redhat.com/show_bug.cgi?id=2248189; https://github.com/torvalds/linux/commit/505ce0630ad5d31185695f8a29dde8d29f28faa7
CVE: CVE-2023-49210
Published: 2023-11-23
Description: The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e; https://github.com/ossf/malicious-packages/tree/main/malicious/npm; https://www.npmjs.com/package/openssl
CVE: CVE-2023-47244
Published: 2023-11-23
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/omnisend-connect/wordpress-email-marketing-for-woocommerce-by-omnisend-plugin-1-13-7-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/omnisend-connect/wordpress-email-marketing-for-woocommerce-by-omnisend-plugin-1-13-7-sensitive-data-exposure-vulnerability?_s_id=cve