deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-0990
Published: 2024-01-29
Description: A vulnerability, which was classified as critical, was found in Tenda i6 1.0.0.9(3857). This affects the function formSetAutoPing of the file /goform/setAutoPing of the component httpd. The manipulation of the argument ping1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252255. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://jylsec.notion.site/Tenda-i6-has-stack-buffer-overflow-vulnerability-in-formSetAutoPing-2e009d81eb7e45438565d5ba6794f4e3?pvs=4; https://vuldb.com/?ctiid.252255; https://vuldb.com/?id.252255
CVE: CVE-2024-0991
Published: 2024-01-29
Description: A vulnerability has been found in Tenda i6 1.0.0.9(3857) and classified as critical. This vulnerability affects the function formSetCfm of the file /goform/setcfm of the component httpd. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252256. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://jylsec.notion.site/Tenda-i6-has-stack-buffer-overflow-vulnerability-in-formSetCfm-9c9952ba7216422c8188e75c94bb531a?pvs=4; https://vuldb.com/?ctiid.252256; https://vuldb.com/?id.252256
CVE: CVE-2024-0992
Published: 2024-01-29
Description: A vulnerability was found in Tenda i6 1.0.0.9(3857) and classified as critical. This issue affects the function formwrlSSIDset of the file /goform/wifiSSIDset of the component httpd. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252257 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://jylsec.notion.site/Tenda-i6-has-stack-buffer-overflow-vulnerability-in-formwrlSSIDset-f0e8be2eb0614e03a60160b48f8527f5?pvs=4; https://vuldb.com/?ctiid.252257; https://vuldb.com/?id.252257
CVE: CVE-2024-0993
Published: 2024-01-29
Description: A vulnerability was found in Tenda i6 1.0.0.9(3857). It has been classified as critical. Affected is the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet of the component httpd. The manipulation of the argument index leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-252258 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://jylsec.notion.site/Tenda-i6-has-stack-buffer-overflow-vulnerability-in-formWifiMacFilterGet-8b2c5cb67e2a433cad62d737782a7e0f?pvs=4; https://vuldb.com/?ctiid.252258; https://vuldb.com/?id.252258
CVE: CVE-2024-0994
Published: 2024-01-29
Description: A vulnerability was found in Tenda W6 1.0.0.9(4122). It has been declared as critical. Affected by this vulnerability is the function formSetCfm of the file /goform/setcfm of the component httpd. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252259. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://jylsec.notion.site/Tenda-W6-has-stack-buffer-overflow-vulnerability-in-formSetCfm-4fab28f92ca74f519245b606d8345821?pvs=4; https://vuldb.com/?ctiid.252259; https://vuldb.com/?id.252259
CVE: CVE-2024-0995
Published: 2024-01-29
Description: A vulnerability was found in Tenda W6 1.0.0.9(4122). It has been rated as critical. Affected by this issue is the function formwrlSSIDset of the file /goform/wifiSSIDset of the component httpd. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252260. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://jylsec.notion.site/Tenda-w6-has-stack-buffer-overflow-vulnerability-in-formwrlSSIDset-e283b41905934e97b4c65632a0018eba?pvs=4; https://vuldb.com/?ctiid.252260; https://vuldb.com/?id.252260
CVE: CVE-2024-0996
Published: 2024-01-29
Description: A vulnerability classified as critical has been found in Tenda i9 1.0.0.9(4122). This affects the function formSetCfm of the file /goform/setcfm of the component httpd. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252261 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://jylsec.notion.site/Tenda-i9-has-stack-buffer-overflow-vulnerability-in-formSetCfm-c1bd9745c81e4207aceeaa1ba5e10563?pvs=4; https://vuldb.com/?ctiid.252261; https://vuldb.com/?id.252261
CVE: CVE-2024-24736
Published: 2024-01-29
Description: The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a long string to TCP port 110, a related issue to CVE-2004-1558.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://packetstormsecurity.com/files/176784/YahooPOPs-1.6-Denial-Of-Service.html; https://packetstormsecurity.com/files/176784/YahooPOPs-1.6-Denial-Of-Service.html
CVE: CVE-2023-45916
Published: 2024-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-45921
Published: 2024-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-45932
Published: 2024-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-46050
Published: 2024-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-0212
Published: 2024-01-29
Description: The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.

CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/cloudflare/Cloudflare-WordPress/releases/tag/v4.12.3; https://github.com/cloudflare/Cloudflare-WordPress/security/advisories/GHSA-h2fj-7r3m-7gf2; https://github.com/cloudflare/Cloudflare-WordPress/releases/tag/v4.12.3
CVE: CVE-2024-23790
Published: 2024-01-29
Description: Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes.
This issue affects OTRS:  from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.


CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-354
References: https://otrs.com/release-notes/otrs-security-advisory-2024-01/; https://otrs.com/release-notes/otrs-security-advisory-2024-01/
CVE: CVE-2024-23791
Published: 2024-01-29
Description: Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://otrs.com/release-notes/otrs-security-advisory-2024-02/; https://otrs.com/release-notes/otrs-security-advisory-2024-02/
CVE: CVE-2024-23792
Published: 2024-01-29
Description: When adding attachments to ticket comments, 
another user can add attachments as well impersonating the orginal user. The attack requires a 
logged-in other user to know the UUID. While the legitimate user 
completes the comment, the malicious user can add more files to the 
comment.

This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://otrs.com/release-notes/otrs-security-advisory-2024-03/; https://otrs.com/release-notes/otrs-security-advisory-2024-03/
CVE: CVE-2023-46838
Published: 2024-01-29
Description: Transmit requests in Xen's virtual network protocol can consist of
multiple parts.  While not really useful, except for the initial part
any of them may be of zero length, i.e. carry no data at all.  Besides a
certain initial portion of the to be transferred data, these parts are
directly translated into what Linux calls SKB fragments.  Such converted
request parts can, when for a particular SKB they are all of length
zero, lead to a de-reference of NULL in core networking code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html; https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGEKT4DKSDXDS34EL7M4UVJMMPH7Z3ZZ/
CVE: CVE-2023-5378
Published: 2024-01-29
Description: Improper Input Validation vulnerability in  MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://cert.pl/en/posts/2023/12/CVE-2023-5378; https://cert.pl/posts/2023/12/CVE-2023-5378; https://megabip.pl/
CVE: CVE-2023-29055
Published: 2024-01-29
Description: In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.properties and potentially the containing credentials.

To avoid this threat, users are recommended to 

  *  Always turn on HTTPS so that network payload is encrypted.

  *  Avoid putting credentials in kylin.properties, or at least not in plain text.
  *  Use network firewalls to protect the serverside such that it is not accessible to external attackers.

  *  Upgrade to version Apache Kylin 4.0.4, which filters out the sensitive content that goes to the Server Config web interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2024/01/29/1; https://lists.apache.org/thread/o1bvyv9wnfkx7dxpfjlor20nykgsoh6r; http://www.openwall.com/lists/oss-security/2024/01/29/1
CVE: CVE-2024-0997
Published: 2024-01-29
Description: A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Affected by this issue is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument pppoeUser leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252266 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setOpModeCfg-9faac02b13d84bd3b7fe84aab68c7add?pvs=4; https://vuldb.com/?ctiid.252266; https://vuldb.com/?id.252266
CVE: CVE-2024-0998
Published: 2024-01-29
Description: A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252267. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setDiagnosisCfg-b2d36451543e4c6da063646721a24604?pvs=4; https://vuldb.com/?ctiid.252267; https://vuldb.com/?id.252267
CVE: CVE-2024-0999
Published: 2024-01-29
Description: A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument eTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252268. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setParentalRules-f891c062b86349a596ee173cb456b4f6?pvs=4; https://vuldb.com/?ctiid.252268; https://vuldb.com/?id.252268
CVE: CVE-2024-1000
Published: 2024-01-29
Description: A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252269 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setTracerouteCfg-b6b3fe05b4a945a3bc460dbcb61dfc75?pvs=4; https://vuldb.com/?ctiid.252269; https://vuldb.com/?id.252269
CVE: CVE-2024-1001
Published: 2024-01-29
Description: A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected is the function main of the file /cgi-bin/cstecgi.cgi. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-252270 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-main-942df77e9c70495390e4aed2a29f3d13?pvs=4; https://vuldb.com/?ctiid.252270; https://vuldb.com/?id.252270
CVE: CVE-2024-1002
Published: 2024-01-29
Description: A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ePort leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setIpPortFilterRules-71c3f0a947e14b7f95fa19b7d6676994?pvs=4; https://vuldb.com/?ctiid.252271; https://vuldb.com/?id.252271
CVE: CVE-2024-1014
Published: 2024-01-29
Description: Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektronic-gmbh-products; https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html
CVE: CVE-2024-1015
Published: 2024-01-29
Description:  Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from the operating system to the system via the web configuration functionality of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektronic-gmbh-products; https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html
CVE: CVE-2024-22559
Published: 2024-01-29
Description: LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/eddy8/LightCMS/issues/34; https://github.com/eddy8/LightCMS/issues/34
CVE: CVE-2024-23747
Published: 2024-01-29
Description: The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability resides in the system's handling of user data access through a /Modernanet/LAUDO/LAU0000100/Laudo?id= URI. By manipulating this id parameter, an attacker can gain access to sensitive medical information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/louiselalanne/CVE-2024-23747; https://modernasistemas.com.br/sitems/; https://github.com/louiselalanne/CVE-2024-23747
CVE: CVE-2023-40548
Published: 2024-01-29
Description: A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.
CVSS Score: 7.4 (HIGH)
CWE: CWE-787, CWE-190, CWE-787
References: https://access.redhat.com/errata/RHSA-2024:1834; https://access.redhat.com/errata/RHSA-2024:1835; https://access.redhat.com/errata/RHSA-2024:1873
CVE: CVE-2023-5124
Published: 2024-01-29
Description: The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1ef86546-3467-432c-a863-1ca3e5c65bd4/; https://wpscan.com/vulnerability/1ef86546-3467-432c-a863-1ca3e5c65bd4/
CVE: CVE-2023-5943
Published: 2024-01-29
Description: The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/18fbe9d5-4829-450b-988c-8ba4becd032a/; https://wpscan.com/vulnerability/18fbe9d5-4829-450b-988c-8ba4becd032a/
CVE: CVE-2023-5956
Published: 2024-01-29
Description: The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b3d1fbae-88c9-45d1-92c6-0a529b21e3b2/; https://wpscan.com/vulnerability/b3d1fbae-88c9-45d1-92c6-0a529b21e3b2/
CVE: CVE-2023-6165
Published: 2024-01-29
Description: The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/youki992/youki992.github.io/blob/master/others/apply2.md; https://wpscan.com/vulnerability/aba62286-9a82-4d5b-9b47-1fddde5da487/; https://github.com/youki992/youki992.github.io/blob/master/others/apply2.md
CVE: CVE-2023-6278
Published: 2024-01-29
Description: The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dfe5001f-31b9-4de2-a240-f7f5a992ac49/; https://wpscan.com/vulnerability/dfe5001f-31b9-4de2-a240-f7f5a992ac49/
CVE: CVE-2023-6279
Published: 2024-01-29
Description: The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://wpscan.com/vulnerability/626bbc7d-0d0f-4418-ac61-666278a1cbdb/; https://wpscan.com/vulnerability/626bbc7d-0d0f-4418-ac61-666278a1cbdb/
CVE: CVE-2023-6389
Published: 2024-01-29
Description: The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://magos-securitas.com/txt/CVE-2023-6389.txt; https://wpscan.com/vulnerability/04dafc55-3a8d-4dd2-96da-7a8b100e5a81/; https://magos-securitas.com/txt/CVE-2023-6389.txt
CVE: CVE-2023-6390
Published: 2024-01-29
Description: The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://magos-securitas.com/txt/2023-6390.txt; https://wpscan.com/vulnerability/a0ca68d3-f885-46c9-9f6b-b77ad387d25d/; https://magos-securitas.com/txt/2023-6390.txt
CVE: CVE-2023-6391
Published: 2024-01-29
Description: The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://magos-securitas.com/txt/CVE-2023-6391.txt; https://wpscan.com/vulnerability/4098b18d-6ff3-462c-af05-48adb6599cf3/; https://magos-securitas.com/txt/CVE-2023-6391.txt