deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2828
Published: 2023-06-21
Description: Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit.

It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded.
This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2023/06/21/6; https://kb.isc.org/docs/cve-2023-2828; https://lists.debian.org/debian-lts-announce/2023/07/msg00021.html
CVE: CVE-2023-2829
Published: 2023-06-21
Description: A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record.
This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.
CVSS Score: 7.5 (HIGH)
References: https://kb.isc.org/docs/cve-2023-2829; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://kb.isc.org/docs/cve-2023-2829
CVE: CVE-2023-2911
Published: 2023-06-21
Description: If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow.
This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2023/06/21/6; https://kb.isc.org/docs/cve-2023-2911; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEFCEVCTYEMKTWA7V7EYPI5YQQ4JWDLI/
CVE: CVE-2023-0969
Published: 2023-06-21
Description: A vulnerability in SiLabs Z/IP Gateway 7.18.01 and earlier allows an authenticated attacker within Z-Wave range to manipulate an array pointer to disclose the contents of global memory.
CVSS Score: 3.5 (LOW)
CWE: CWE-125, CWE-787, CWE-119
References: https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1
CVE: CVE-2023-0970
Published: 2023-06-21
Description: Multiple buffer overflow vulnerabilities in SiLabs Z/IP Gateway SDK version 7.18.01 and earlier allow an attacker with invasive physical access to a Z-Wave controller device to overwrite global memory and potentially execute arbitrary code.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-787, CWE-120
References: https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1
CVE: CVE-2023-0971
Published: 2023-06-21
Description: A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-268, CWE-863, CWE-863
References: https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1
CVE: CVE-2023-0972
Published: 2023-06-21
Description: Description: A vulnerability in SiLabs Z/IP Gateway 7.18.01 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-125, CWE-787, CWE-119
References: https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1
CVE: CVE-2023-25435
Published: 2023-06-21
Description: libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://gitlab.com/libtiff/libtiff/-/issues/518; https://gitlab.com/libtiff/libtiff/-/issues/518
CVE: CVE-2023-33289
Published: 2023-06-21
Description: The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs. NOTE: the Supplier disputes this, taking the position that "Slow printing of URLs is not a CVE."
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://gist.github.com/6en6ar/b118888dc739e8979038f24c8ac33611; https://github.com/progscrape/urlnorm; https://lib.rs/crates/urlnorm
CVE: CVE-2023-33591
Published: 2023-06-21
Description: User Registration & Login and User Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/search-result.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/DARSHANAGUPTA10/CVE/blob/main/CVE%[PII_REDACTED]1; https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/; https://github.com/DARSHANAGUPTA10/CVE/blob/main/CVE%[PII_REDACTED]1
CVE: CVE-2023-3110
Published: 2023-06-21
Description: Description: A vulnerability in SiLabs Unify Gateway 1.3.1 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-125, CWE-787, CWE-119
References: https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1
CVE: CVE-2023-24261
Published: 2023-06-21
Description: A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://justinapplegate.me/2023/glinet-CVE-2023-24261/; https://justinapplegate.me/2023/glinet-CVE-2023-24261/
CVE: CVE-2023-33405
Published: 2023-06-21
Description: Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/hacip/CVE-2023-33405; https://github.com/hacip/CVE-2023-33405
CVE: CVE-2019-25152
Published: 2023-06-22
Description: The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2033212; https://wpscan.com/vulnerability/9229; https://www.wordfence.com/blog/2019/03/xss-flaw-in-abandoned-cart-plugin-leads-to-wordpress-site-takeovers/
CVE: CVE-2023-28956
Published: 2023-06-22
Description: IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2 may allow a local user to escalate their privileges due to improper access controls.
CVSS Score: 8.4 (HIGH)
CWE: CWE-266
References: https://www.ibm.com/support/pages/node/7005519; https://exchange.xforce.ibmcloud.com/vulnerabilities/251767; https://www.ibm.com/support/pages/node/7005519
CVE: CVE-2023-33842
Published: 2023-06-22
Description: IBM SPSS Modeler on Windows 17.0, 18.0, 18.2.2, 18.3, 18.4, and 18.5 requires the end user to have access to the server SSL key which could allow a local user to decrypt and obtain sensitive information.  IBM X-Force ID:  256117.
CVSS Score: 6.2 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/256117; https://https://www.ibm.com/support/pages/node/7004299; https://exchange.xforce.ibmcloud.com/vulnerabilities/256117
CVE: CVE-2023-26115
Published: 2023-06-22
Description: All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39; https://github.com/jonschlinkert/word-wrap/releases/tag/1.2.4; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-32449
Published: 2023-06-22
Description: 
Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability. An attacker can trick a high privileged user to install a malicious binary by bypassing the existing cryptographic signature checks


CVSS Score: 7.2 (HIGH)
CWE: CWE-347
References: https://www.dell.com/support/kbdoc/en-us/000215171/dsa-2023-173-dell-powerstore-family-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000215171/dsa-2023-173-dell-powerstore-family-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-27413
Published: 2023-06-22
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Shazzad Hossain Khan W4 Post List plugin <= 2.4.4 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/w4-post-list/wordpress-w4-post-list-plugin-2-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/w4-post-list/wordpress-w4-post-list-plugin-2-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27612
Published: 2023-06-22
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/site-reviews/wordpress-site-reviews-plugin-6-5-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/site-reviews/wordpress-site-reviews-plugin-6-5-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-27629
Published: 2023-06-22
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/site-reviews/wordpress-site-reviews-plugin-6-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/site-reviews/wordpress-site-reviews-plugin-6-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27631
Published: 2023-06-22
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.05.04 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/daily-prayer-time-for-mosques/wordpress-daily-prayer-time-plugin-2023-02-21-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/daily-prayer-time-for-mosques/wordpress-daily-prayer-time-plugin-2023-02-21-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27618
Published: 2023-06-22
Description: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in AGILELOGIX Store Locator WordPress plugin <= 1.4.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/agile-store-locator/wordpress-store-locator-wordpress-plugin-1-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/agile-store-locator/wordpress-store-locator-wordpress-plugin-1-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28166
Published: 2023-06-22
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aakif Kadiwala Tags Cloud Manager plugin <= 1.0.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/tags-cloud-manager/wordpress-tags-cloud-manager-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tags-cloud-manager/wordpress-tags-cloud-manager-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28171
Published: 2023-06-22
Description: Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Chill Brilliance theme <= 1.3.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/brilliance/wordpress-brilliance-theme-1-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/brilliance/wordpress-brilliance-theme-1-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28423
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Prism Tech Studios Modern Footnotes plugin <= 1.4.15 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/modern-footnotes/wordpress-modern-footnotes-plugin-1-4-15-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/modern-footnotes/wordpress-modern-footnotes-plugin-1-4-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28496
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SMTP2GO – Email Made Easy plugin <= 1.4.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/smtp2go/wordpress-smtp2go-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smtp2go/wordpress-smtp2go-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28534
Published: 2023-06-22
Description: Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board plugin <= 2.0.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-job-portal/wordpress-wp-job-portal-a-complete-job-board-plugin-1-1-9-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-job-portal/wordpress-wp-job-portal-a-complete-job-board-plugin-1-1-9-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-28695
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Drew Phillips VigilanTor plugin <= 1.3.10 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/vigilantor/wordpress-vigilantor-plugin-1-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/vigilantor/wordpress-vigilantor-plugin-1-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29707
Published: 2023-06-22
Description: Cross Site Scripting (XSS) vulnerability in GBCOM LAC WEB Control Center version lac-1.3.x, allows attackers to create an arbitrary device.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/shellpei/GBCOM-XSS/blob/main/CVE-2023-29707; https://holistic-height-e6d.notion.site/GBCOM-LAC-WEB-Control-Center-cross-site-scripting-vulnerability-and-device-permanent-account-creatio-a4f128d7fb8b40e5b6130c6f97e71eaf; https://github.com/shellpei/GBCOM-XSS/blob/main/CVE-2023-29707
CVE: CVE-2023-29708
Published: 2023-06-22
Description: An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/shellpei/WAVLINK-Reset/blob/main/CVE-2023-29708; https://holistic-height-e6d.notion.site/WAVLINK-Wi-Fi-APP-Arbitrary-factory-reset-vulnerability-b2d747693a7442aaa8b045e57bbd8297; https://github.com/shellpei/WAVLINK-Reset/blob/main/CVE-2023-29708
CVE: CVE-2023-29709
Published: 2023-06-22
Description: An issue was discovered in /cgi-bin/login_rj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication.
CVSS Score: 7.5 (HIGH)
References: https://github.com/shellpei/Wildix-Logical/blob/main/CVE-2023-29709; https://holistic-height-e6d.notion.site/Wildix-WSG24POE-Logical-vulnerability-7780c24cc25b40dd9d2830f7b21f04a3; https://github.com/shellpei/Wildix-Logical/blob/main/CVE-2023-29709
CVE: CVE-2023-29931
Published: 2023-06-22
Description: laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-552
References: https://github.com/hhxsv5/laravel-s/issues/437; https://github.com/hhxsv5/laravel-s/issues/437
CVE: CVE-2023-31213
Published: 2023-06-22
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPBakery Page Builder plugin <= 6.13.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/js_composer/wordpress-wpbakery-page-builder-plugin-6-13-0-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/js_composer/wordpress-wpbakery-page-builder-plugin-6-13-0-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33387
Published: 2023-06-22
Description: A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://apps.datev.de/help-center/documents/1021479; https://support.veda.net/datev.php; https://www.tuv.com/landingpage/de/schwachstelle/
CVE: CVE-2023-34601
Published: 2023-06-22
Description: Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component ${businessTable} at /act/ActDao.xml.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/thinkgem/jeesite/issues/515; https://github.com/thinkgem/jeesite/issues/515
CVE: CVE-2023-35090
Published: 2023-06-22
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.7 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-20892
Published: 2023-06-22
Description: The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1801; https://www.vmware.com/security/advisories/VMSA-2023-0014.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1801
CVE: CVE-2023-20893
Published: 2023-06-22
Description: The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1799; https://www.vmware.com/security/advisories/VMSA-2023-0014.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1799
CVE: CVE-2023-20894
Published: 2023-06-22
Description: The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1658; https://www.vmware.com/security/advisories/VMSA-2023-0014.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1658
CVE: CVE-2023-20895
Published: 2023-06-22
Description: The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1740; https://www.vmware.com/security/advisories/VMSA-2023-0014.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1740
CVE: CVE-2023-23795
Published: 2023-06-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Form Builder plugin <= 1.9.9.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/contact-form-add/wordpress-form-builder-create-responsive-contact-forms-plugin-1-9-9-0-cross-site-request-forgery-csrf-leading-to-post-page-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-add/wordpress-form-builder-create-responsive-contact-forms-plugin-1-9-9-0-cross-site-request-forgery-csrf-leading-to-post-page-deletion-vulnerability?_s_id=cve
CVE: CVE-2023-23807
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Qumos MojoPlug Slide Panel plugin <= 1.1.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mojoplug-slide-panel/wordpress-mojoplug-slide-panel-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mojoplug-slide-panel/wordpress-mojoplug-slide-panel-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23811
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Neil Gee Smoothscroller plugin <= 1.0.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/smoothscroller/wordpress-smoothscroller-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smoothscroller/wordpress-smoothscroller-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26534
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in OneWebsite WP Repost plugin <= 0.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-repost/wordpress-wp-repost-plugin-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-repost/wordpress-wp-repost-plugin-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve