deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-41343
Published: 2023-11-03
Description: Rogic No-Code Database Builder's file uploading function has insufficient filtering for special characters. A remote attacker with regular user privilege can inject JavaScript to perform XSS (Stored Cross-Site Scripting) attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-7509-5b734-1.html; https://www.twcert.org.tw/tw/cp-132-7509-5b734-1.html
CVE: CVE-2023-41345
Published: 2023-11-03
Description: ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7496-96e2c-1.html; https://www.twcert.org.tw/tw/cp-132-7496-96e2c-1.html
CVE: CVE-2023-41346
Published: 2023-11-03
Description: ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7497-f92ac-1.html; https://www.twcert.org.tw/tw/cp-132-7497-f92ac-1.html
CVE: CVE-2023-41347
Published: 2023-11-03
Description: ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7498-18012-1.html; https://www.twcert.org.tw/tw/cp-132-7498-18012-1.html
CVE: CVE-2023-41348
Published: 2023-11-03
Description: ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7499-63907-1.html; https://www.twcert.org.tw/tw/cp-132-7499-63907-1.html
CVE: CVE-2023-41350
Published: 2023-11-03
Description: Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypass the captcha check and more susceptible to brute force attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-307
References: https://www.twcert.org.tw/tw/cp-132-7500-0c544-1.html; https://www.twcert.org.tw/tw/cp-132-7500-0c544-1.html
CVE: CVE-2023-41914
Published: 2023-11-03
Description: SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or deleting files.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OWKTCYZT3DXEH66QXQJYB7NI7ONDRS4M/; https://lists.schedmd.com/pipermail/slurm-announce/2023/000100.html; https://schedmd.com/security.php
CVE: CVE-2023-43665
Published: 2023-11-03
Description: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: http://www.openwall.com/lists/oss-security/2024/03/04/1; https://docs.djangoproject.com/en/4.2/releases/security/; https://groups.google.com/forum/#%21forum/django-announce
CVE: CVE-2023-43982
Published: 2023-11-03
Description: Bon Presta boninstagramcarousel between v5.2.1 to v7.0.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at insta_parser.php. This vulnerability allows attackers to use the vulnerable website as proxy to attack other websites or exfiltrate data via a HTTP call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://security.friendsofpresta.org/modules/2023/11/02/boninstagramcarousel.html; https://security.friendsofpresta.org/modules/2023/11/02/boninstagramcarousel.html
CVE: CVE-2023-44271
Published: 2023-11-03
Description: An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://devhub.checkmarx.com/cve-details/CVE-2023-44271/; https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7; https://github.com/python-pillow/Pillow/pull/7244
CVE: CVE-2023-45024
Published: 2023-11-03
Description: Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://docs.bestpractical.com/release-notes/rt/5.0.5; https://docs.bestpractical.com/release-notes/rt/index.html; https://docs.bestpractical.com/release-notes/rt/5.0.5
CVE: CVE-2023-45360
Published: 2023-11-03
Description: An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is XSS in youhavenewmessagesmanyusers and youhavenewmessages i18n messages. This is related to MediaWiki:Youhavenewmessagesfromusers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/; https://phabricator.wikimedia.org/T340221; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
CVE: CVE-2023-45362
Published: 2023-11-03
Description: An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi-sameuser (aka "X intermediate revisions by the same user not shown") ignores username suppression. This is an information leak.
CVSS Score: 4.3 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/; https://phabricator.wikimedia.org/T341529
CVE: CVE-2023-46517
Published: 2023-11-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-46817
Published: 2023-11-03
Description: An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://seclists.org/fulldisclosure/2023/Oct/30; https://docs.phpfox.com/display/FOX4MAN/phpFox+4.8.14; https://karmainsecurity.com/KIS-2023-12
CVE: CVE-2023-41351
Published: 2023-11-03
Description: Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remote attackers to log in as any existing users, such as an administrator, to perform arbitrary system operations or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://www.twcert.org.tw/tw/cp-132-7501-6155a-1.html; https://www.twcert.org.tw/tw/cp-132-7501-6155a-1.html
CVE: CVE-2023-41352
Published: 2023-11-03
Description: Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7502-287ec-1.html; https://www.twcert.org.tw/tw/cp-132-7502-287ec-1.html
CVE: CVE-2023-41353
Published: 2023-11-03
Description: Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing arbitrary system operations or disrupt service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-521, CWE-521
References: https://www.twcert.org.tw/tw/cp-132-7503-a27ed-1.html; https://www.twcert.org.tw/tw/cp-132-7503-a27ed-1.html
CVE: CVE-2023-41354
Published: 2023-11-03
Description: Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulnerability by sending a crafted package, resulting in partially sensitive information exposed to an actor.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://www.twcert.org.tw/tw/cp-132-7504-c6a5e-1.html; https://www.twcert.org.tw/tw/cp-132-7504-c6a5e-1.html
CVE: CVE-2023-41355
Published: 2023-11-03
Description: Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted package to modify the network routing table, resulting in a denial of service or sensitive information leaking.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-940, CWE-20
References: https://www.twcert.org.tw/tw/cp-132-7505-a0c94-1.html; https://www.twcert.org.tw/tw/cp-132-7505-a0c94-1.html
CVE: CVE-2023-41344
Published: 2023-11-03
Description: NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7507-55b28-1.html; https://www.twcert.org.tw/tw/cp-132-7507-55b28-1.html
CVE: CVE-2023-41356
Published: 2023-11-03
Description: NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-639
References: https://www.twcert.org.tw/tw/cp-132-7506-b4e29-1.html; https://www.twcert.org.tw/tw/cp-132-7506-b4e29-1.html
CVE: CVE-2023-41357
Published: 2023-11-03
Description: Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operations or disrupt service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.twcert.org.tw/tw/cp-132-7508-6d1ef-1.html; https://www.twcert.org.tw/tw/cp-132-7508-6d1ef-1.html
CVE: CVE-2023-5763
Published: 2023-11-03
Description: In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.

CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-913, CWE-913
References: https://gitlab.eclipse.org/security/cve-assignement/-/issues/14; https://glassfish.org/docs/latest/security-guide.html#securing-glassfish-server; https://gitlab.eclipse.org/security/cve-assignement/-/issues/14
CVE: CVE-2023-5948
Published: 2023-11-03
Description: Improper Authorization in GitHub repository teamamaze/amazefileutilities prior to 1.91.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285
References: https://github.com/teamamaze/amazefileutilities/commit/62d02204d452603ab85c50d43c7c680e4256c7d7; https://huntr.com/bounties/ac1363b5-207b-40d9-aac5-e66d6213f692; https://github.com/teamamaze/amazefileutilities/commit/62d02204d452603ab85c50d43c7c680e4256c7d7
CVE: CVE-2023-1194
Published: 2023-11-03
Description: An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command with a malformed payload to KSMBD, due to a missing check of `NameOffset` in the `parse_lease_state()` function, the `create_context` object can access invalid memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416, CWE-125
References: https://access.redhat.com/security/cve/CVE-2023-1194; https://bugzilla.redhat.com/show_bug.cgi?id=2154176; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-42670
Published: 2023-11-03
Description: A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as "The procedure number is out of range" when using tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://access.redhat.com/security/cve/CVE-2023-42670; https://bugzilla.redhat.com/show_bug.cgi?id=2241885; https://bugzilla.samba.org/show_bug.cgi?id=15473
CVE: CVE-2023-46846
Published: 2023-11-03
Description: SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-444, CWE-444
References: https://access.redhat.com/errata/RHSA-2023:6266; https://access.redhat.com/errata/RHSA-2023:6267; https://access.redhat.com/errata/RHSA-2023:6268
CVE: CVE-2023-46847
Published: 2023-11-03
Description: Squid is vulnerable to a Denial of Service,  where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.
CVSS Score: 8.6 (HIGH)
CWE: CWE-120, CWE-120
References: https://access.redhat.com/errata/RHSA-2023:6266; https://access.redhat.com/errata/RHSA-2023:6267; https://access.redhat.com/errata/RHSA-2023:6268
CVE: CVE-2023-46848
Published: 2023-11-03
Description: Squid is vulnerable to Denial of Service,  where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
CVSS Score: 8.6 (HIGH)
CWE: CWE-681, CWE-681
References: https://access.redhat.com/errata/RHSA-2023:6266; https://access.redhat.com/errata/RHSA-2023:6268; https://access.redhat.com/errata/RHSA-2023:6748
CVE: CVE-2023-4091
Published: 2023-11-03
Description: A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://access.redhat.com/errata/RHSA-2023:6209; https://access.redhat.com/errata/RHSA-2023:6744; https://access.redhat.com/errata/RHSA-2023:7371
CVE: CVE-2023-5824
Published: 2023-11-03
Description: A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://access.redhat.com/errata/RHSA-2023:7465; https://access.redhat.com/errata/RHSA-2023:7668; https://access.redhat.com/errata/RHSA-2024:0072
CVE: CVE-2023-1476
Published: 2023-11-03
Description: A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/errata/RHSA-2023:1659; https://access.redhat.com/security/cve/CVE-2023-1476; https://bugzilla.redhat.com/show_bug.cgi?id=2176035
CVE: CVE-2023-4043
Published: 2023-11-03
Description: In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.


To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.



CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-834, CWE-834
References: https://github.com/eclipse-ee4j/parsson/pull/100; https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/13; https://github.com/eclipse-ee4j/parsson/pull/100
CVE: CVE-2023-4767
Published: 2023-11-03
Description: A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/[PII_REDACTED]28/InvSWMetering.csv.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93, CWE-74
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-manageengine-desktop-central; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-manageengine-desktop-central
CVE: CVE-2023-4768
Published: 2023-11-03
Description: A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/[PII_REDACTED]28/InvSWMetering.pdf.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-manageengine-desktop-central; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-manageengine-desktop-central
CVE: CVE-2023-4769
Published: 2023-11-03
Description: A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability could allow an authenticated attacker to launch targeted attacks, such as a cross-port attack, service enumeration and other attacks via HTTP requests.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-918
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-manageengine-desktop-central; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-manageengine-desktop-central
CVE: CVE-2022-47588
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1.8.1.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/simple-photo-gallery/wordpress-simple-photo-gallery-plugin-v1-8-1-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/simple-photo-gallery/wordpress-simple-photo-gallery-plugin-v1-8-1-sql-injection?_s_id=cve
CVE: CVE-2023-34383
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This issue affects WP Project Manager: from n/a through 2.6.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/vulnerability/wedevs-project-manager/wordpress-wp-project-manager-task-team-and-project-management-plugin-featuring-kanban-board-and-gantt-charts-plugin-2-6-0-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wedevs-project-manager/wordpress-wp-project-manager-task-team-and-project-management-plugin-featuring-kanban-board-and-gantt-charts-plugin-2-6-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-3277
Published: 2023-11-03
Description: The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L821; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2988788%40mstore-api%2Ftrunk&old=2985882%40mstore-api%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c7c0c35-5f44-488f-9fe1-269ea4a73854?source=cve
CVE: CVE-2023-41652
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 10.6.6.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-6-6-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-6-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-4591
Published: 2023-11-03
Description: A local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local file inclusion (LFI) via the /tools/webinterface/index.php?page parameter by sending a GET request. This vulnerability could lead to the loading of a PHP file on the server, leading to a critical webshell exploit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-829
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wpn-xm-serverstack; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wpn-xm-serverstack