deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-46750
Published: 2023-12-14
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro.
Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://lists.apache.org/thread/hoc9zdyzmmrfj1zhctsvvtx844tcq6w9; https://lists.apache.org/thread/hoc9zdyzmmrfj1zhctsvvtx844tcq6w9; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-48925
Published: 2023-12-14
Description: SQL injection vulnerability in Buy Addons bavideotab before version 1.0.6, allows attackers to escalate privileges and obtain sensitive information via the component BaVideoTabSaveVideoModuleFrontController::run().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/12/07/bavideotab.html; https://security.friendsofpresta.org/modules/2023/12/07/bavideotab.html
CVE: CVE-2023-49707
Published: 2023-12-14
Description: SQLi vulnerability in S5 Register module for Joomla.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://extensions.joomla.org/extension/s5-register/; https://extensions.joomla.org/extension/s5-register/
CVE: CVE-2023-49708
Published: 2023-12-14
Description: SQLi vulnerability in Starshop component for Joomla.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://extensions.joomla.org/extension/starshop/; https://extensions.joomla.org/extension/starshop/
CVE: CVE-2023-48631
Published: 2023-12-14
Description: @adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-1333
References: https://github.com/adobe/css-tools/security/advisories/GHSA-prr3-c3m5-p7q2; https://github.com/adobe/css-tools/security/advisories/GHSA-prr3-c3m5-p7q2
CVE: CVE-2023-50371
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress allows Stored XSS.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a through 8.0.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-page-visit-counter/wordpress-advanced-page-visit-counter-plugin-8-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-page-visit-counter/wordpress-advanced-page-visit-counter-plugin-8-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-6569
Published: 2023-12-14
Description: External Control of File Name or Path in h2oai/h2o-3
CVSS Score: 8.2 (HIGH)
CWE: CWE-73, CWE-610
References: https://huntr.com/bounties/a5d003dc-c23e-4c98-8dcf-35ba9252fa3c; https://huntr.com/bounties/a5d003dc-c23e-4c98-8dcf-35ba9252fa3c
CVE: CVE-2023-6570
Published: 2023-12-14
Description: Server-Side Request Forgery (SSRF) in kubeflow/kubeflow
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://huntr.com/bounties/82d6e853-013b-4029-a23f-8b50ec56602a; https://huntr.com/bounties/82d6e853-013b-4029-a23f-8b50ec56602a
CVE: CVE-2023-6571
Published: 2023-12-14
Description: Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://huntr.com/bounties/f02781e7-2a53-4c66-aa32-babb16434632; https://huntr.com/bounties/f02781e7-2a53-4c66-aa32-babb16434632
CVE: CVE-2023-0757
Published: 2023-12-14
Description: Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://cert.vde.com/en/advisories/VDE-2023-051/; https://cert.vde.com/en/advisories/VDE-2023-051/
CVE: CVE-2023-45182
Published: 2023-12-14
Description: 
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow gaining access to the encrypted password, a local attacker could exploit this vulnerability to obtain the password to other systems. IBM X-Force ID: 268265.


CVSS Score: 7.4 (HIGH)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/268265; https://www.ibm.com/support/pages/node/7091942; https://exchange.xforce.ibmcloud.com/vulnerabilities/268265
CVE: CVE-2023-45185
Published: 2023-12-14
Description: IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code.  Due to improper authority checks the attacker could perform operations on the PC under the user's authority.  IBM X-Force ID:  268273.
CVSS Score: 7.4 (HIGH)
CWE: CWE-863, CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/268273; https://www.ibm.com/support/pages/node/7091942; https://exchange.xforce.ibmcloud.com/vulnerabilities/268273
CVE: CVE-2023-46141
Published: 2023-12-14
Description: Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://cert.vde.com/en/advisories/VDE-2023-055/; https://cert.vde.com/en/advisories/VDE-2023-055/
CVE: CVE-2023-46142
Published: 2023-12-14
Description: A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://https://cert.vde.com/en/advisories/VDE-2023-056/; https://https://cert.vde.com/en/advisories/VDE-2023-056/
CVE: CVE-2023-46143
Published: 2023-12-14
Description: Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.
CVSS Score: 7.5 (HIGH)
CWE: CWE-494
References: https://cert.vde.com/en/advisories/VDE-2023-057/; https://cert.vde.com/en/advisories/VDE-2023-057/
CVE: CVE-2023-46144
Published: 2023-12-14
Description: A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-494
References: https://https://cert.vde.com/en/advisories/VDE-2023-056/; https://https://cert.vde.com/en/advisories/VDE-2023-056/
CVE: CVE-2023-48676
Published: 2023-12-14
Description: Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36943.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-5905; https://security-advisory.acronis.com/advisories/SEC-5905
CVE: CVE-2023-49836
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brontobytes Cookie Bar allows Stored XSS.This issue affects Cookie Bar: from n/a through 2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cookie-bar/wordpress-cookie-bar-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cookie-bar/wordpress-cookie-bar-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49846
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through 2.1.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/author-avatars/wordpress-author-avatars-list-block-plugin-2-1-16-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/author-avatars/wordpress-author-avatars-list-block-plugin-2-1-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49847
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue affects Annual Archive: from n/a through 1.6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/anual-archive/wordpress-annual-archive-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/anual-archive/wordpress-annual-archive-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50368
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Shortcodes and extra features for Phlox theme allows Stored XSS.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/auxin-elements/wordpress-shortcodes-and-extra-features-for-phlox-theme-plugin-2-15-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/auxin-elements/wordpress-shortcodes-and-extra-features-for-phlox-theme-plugin-2-15-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50369
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alma Alma – Pay in installments or later for WooCommerce allows Stored XSS.This issue affects Alma – Pay in installments or later for WooCommerce: from n/a through 5.1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/alma-gateway-for-woocommerce/wordpress-alma-plugin-5-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/alma-gateway-for-woocommerce/wordpress-alma-plugin-5-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50370
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons by Livemesh allows Stored XSS.This issue affects WPBakery Page Builder Addons by Livemesh: from n/a through 3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/addons-for-visual-composer/wordpress-livemesh-addons-for-wpbakery-page-builder-plugin-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/addons-for-visual-composer/wordpress-livemesh-addons-for-wpbakery-page-builder-plugin-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5592
Published: 2023-12-14
Description: Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-494
References: https://cert.vde.com/en/advisories/VDE-2023-054/; https://cert.vde.com/en/advisories/VDE-2023-054/
CVE: CVE-2023-6545
Published: 2023-12-14
Description: The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to another site. This may have limited impact to integrity and does solely affect anthelia-bhf the Beckhoff fork of authelia.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://cert.vde.com/en/advisories/VDE-2023-067/; https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2023-001.pdf; https://cert.vde.com/en/advisories/VDE-2023-067/
CVE: CVE-2023-6572
Published: 2023-12-14
Description: Command Injection in GitHub repository gradio-app/gradio prior to main.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77, CWE-77
References: https://github.com/gradio-app/gradio/commit/5b5af1899dd98d63e1f9b48a93601c2db1f56520; https://huntr.com/bounties/21d2ff0c-d43a-4afd-bb4d-049ee8da5b5c; https://github.com/gradio-app/gradio/commit/5b5af1899dd98d63e1f9b48a93601c2db1f56520
CVE: CVE-2022-45365
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Stock Ticker allows Reflected XSS.This issue affects Stock Ticker: from n/a through 3.23.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-44277
Published: 2023-12-14
Description: 
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in the CLI. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker. 


CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2023-49168
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss allows Stored XSS.This issue affects Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: from n/a through 2.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-bp-better-messages-plugin-2-3-12-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-bp-better-messages-plugin-2-3-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49739
Published: 2023-12-14
Description: Vulnerability in IdeaBox Creations PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a through 2.9.23.
CVSS Score: 7.1 (HIGH)
References: https://patchstack.com/database/wordpress/plugin/powerpack-elements/vulnerability/wordpress-powerpack-pro-for-elementor-plugin-2-9-23-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/powerpack-elements/wordpress-powerpack-pro-for-elementor-plugin-2-9-23-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49740
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seraphinite Solutions Seraphinite Accelerator allows Reflected XSS.This issue affects Seraphinite Accelerator: from n/a through 2.20.28.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/seraphinite-accelerator/wordpress-seraphinite-accelerator-plugin-2-20-28-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seraphinite-accelerator/wordpress-seraphinite-accelerator-plugin-2-20-28-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49743
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Dashboard Widgets Suite allows Stored XSS.This issue affects Dashboard Widgets Suite: from n/a through 3.4.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/dashboard-widgets-suite/wordpress-dashboard-widgets-suite-plugin-3-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dashboard-widgets-suite/wordpress-dashboard-widgets-suite-plugin-3-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49745
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through 4.9.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49827
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/soledad/wordpress-soledad-theme-8-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/soledad/wordpress-soledad-theme-8-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49828
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo allows Stored XSS.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-payments/wordpress-woopayments-plugin-6-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-payments/wordpress-woopayments-plugin-6-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49833
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks allows Stored XSS.This issue affects Spectra – WordPress Gutenberg Blocks: from n/a through 2.7.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-plugin-2-7-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-plugin-2-7-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50011
Published: 2023-12-14
Description: PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.
CVSS Score: 7.2 (HIGH)
References: https://packetstormsecurity.com/files/175924/PopojiCMS-2.0.1-Remote-Command-Execution.html; https://packetstormsecurity.com/files/175924/PopojiCMS-2.0.1-Remote-Command-Execution.html
CVE: CVE-2023-50073
Published: 2023-12-14
Description: EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/leadscloud/EmpireCMS/issues/7; https://github.com/leadscloud/EmpireCMS/issues/7
CVE: CVE-2023-50563
Published: 2023-12-14
Description: Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/SecBridge/Cms_Vuls_test/blob/main/Semcms/Semcms_Sql_Inject.md; https://github.com/SecBridge/Cms_Vuls_test/blob/main/Semcms/Semcms_Sql_Inject.md
CVE: CVE-2023-50564
Published: 2023-12-14
Description: An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/SecBridge/Cms_Vuls_test/blob/main/Pluckcms/Pluck_v4.7.18_Any_File_Upload_Getshell.md; https://github.com/SecBridge/Cms_Vuls_test/blob/main/Pluckcms/Pluck_v4.7.18_Any_File_Upload_Getshell.md
CVE: CVE-2023-50565
Published: 2023-12-14
Description: A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ralap-z/rpcms/issues/7; https://github.com/ralap-z/rpcms/issues/7
CVE: CVE-2023-50566
Published: 2023-12-14
Description: A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/56; https://github.com/weng-xianhu/eyoucms/issues/56
CVE: CVE-2023-44278
Published: 2023-12-14
Description: 
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110  contain a path traversal vulnerability. A local high privileged attacker could potentially exploit this vulnerability, to gain unauthorized read and write access to the OS files stored on the server filesystem, with the privileges of the running application. 


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2023-44279
Published: 2023-12-14
Description: 
Dell PowerProtect DD , versions prior to 7.13.0.10,  LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. A local high privileged attacker could potentially exploit this vulnerability, to bypass security restrictions. Exploitation may lead to a system take over by an attacker


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2023-44284
Published: 2023-12-14
Description: 
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing unauthorized read access to application data. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities