deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-47509
Published: 2023-04-21
Description: The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-47509; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm
CVE: CVE-2023-29924
Published: 2023-04-21
Description: PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/PowerJob/PowerJob/issues/588; https://iotaa.cn/articles/62; https://github.com/PowerJob/PowerJob/issues/588
CVE: CVE-2023-30618
Published: 2023-04-21
Description: Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. An attacker would need access to the local machine in order to gain access to these logs during an operation. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.2 (LOW)
CWE: CWE-532
References: https://github.com/newcontext-oss/kitchen-terraform/commit/3d20d60e7a891e2dd747df995a31226fa0b4ac48; https://github.com/newcontext-oss/kitchen-terraform/security/advisories/GHSA-65g2-x53q-cmf6; https://github.com/newcontext-oss/kitchen-terraform/commit/3d20d60e7a891e2dd747df995a31226fa0b4ac48
CVE: CVE-2023-30620
Published: 2023-04-21
Description: mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/mindsdb/mindsdb/commit/4419b0f0019c000db390b54d8b9d06e1d3670039; https://github.com/mindsdb/mindsdb/releases/tag/v23.2.1.0; https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx
CVE: CVE-2023-30621
Published: 2023-04-21
Description: Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The `!ping` command when provided with an IP or hostname used to run a bash `ping <IP>` without verification that the IP or hostname was legitimate. This command was executed with root permissions and may lead to arbitrary command injection on the host server. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/Curiosity-org/Gipsy/security/advisories/GHSA-6cw6-r8pg-j7wh; https://github.com/Gunivers/Gipsy/pull/24; https://github.com/Gunivers/Gipsy/pull/24/commits/716818e967069f144aae66d51464b237c22b6cdf
CVE: CVE-2023-2118
Published: 2023-04-21
Description: Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints.
CVSS Score: 5.4 (MEDIUM)
References: https://devolutions.net/security/advisories/DEVO-2023-0010; https://devolutions.net/security/advisories/DEVO-2023-0010
CVE: CVE-2023-29019
Published: 2023-04-21
Description: @fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid `sessionId` cookie in the victim's browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 8.1 (HIGH)
CWE: CWE-384, CWE-384
References: https://github.com/fastify/fastify-passport/commit/43c82c321db58ea3e375dd475de60befbfcf2a11; https://github.com/fastify/fastify-passport/security/advisories/GHSA-4m3m-ppvx-xgw9; https://owasp.org/www-community/attacks/Session_fixation
CVE: CVE-2023-29020
Published: 2023-04-21
Description: @fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affected versions, can be bypassed by network and same-site attackers. `fastify/csrf-protection` implements the synchronizer token pattern (using plugins `@fastify/session` and `@fastify/secure-session`) by storing a random value used for CSRF token generation in the `_csrf` attribute of a user's session. The `@fastify/passport` library does not clear the session object upon authentication, preserving the `_csrf` attribute between pre-login and authenticated sessions. Consequently, CSRF tokens generated before authentication are still valid. Network and same-site attackers can thus obtain a CSRF token for their pre-session, fixate that pre-session in the victim's browser via cookie tossing, and then perform a CSRF attack after the victim authenticates. As a solution, newer versions of `@fastify/passport` include the configuration options: `clearSessionOnLogin (default: true)` and `clearSessionIgnoreFields (default: ['passport', 'session'])` to clear all the session attributes by default, preserving those explicitly defined in `clearSessionIgnoreFields`.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-384, CWE-352
References: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern; https://github.com/fastify/fastify-passport/commit/07c90feab9cba0dd4779e47cfb0717a7e2f01d3d; https://github.com/fastify/fastify-passport/security/advisories/GHSA-2ccf-ffrj-m4qw
CVE: CVE-2023-2240
Published: 2023-04-22
Description: Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/microweber/microweber/commit/f43d5b767ad5814fc5f84bbaf0b77996262f3a4b; https://huntr.dev/bounties/8f595559-7b4b-4b00-954c-7a627766e203; https://github.com/microweber/microweber/commit/f43d5b767ad5814fc5f84bbaf0b77996262f3a4b
CVE: CVE-2023-0184
Published: 2023-04-22
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler which may lead to denial of service, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 8.8 (HIGH)
CWE: CWE-822
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0190
Published: 2023-04-22
Description: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a NULL pointer dereference may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0199
Published: 2023-04-22
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds write can lead to denial of service and data tampering.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0200
Published: 2023-04-22
Description: NVIDIA DGX-2 contains a vulnerability in OFBD where a user with high privileges and a pre-conditioned heap can cause an access beyond a buffers end, which may lead to code execution, escalation of privileges, denial of service, and information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-788, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5449; https://nvidia.custhelp.com/app/answers/detail/a_id/5449
CVE: CVE-2023-0201
Published: 2023-04-22
Description: NVIDIA DGX-2 SBIOS contains a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable resource, which may lead to code execution, denial of service, compromised integrity, and information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-118, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5449; https://nvidia.custhelp.com/app/answers/detail/a_id/5449
CVE: CVE-2023-0202
Published: 2023-04-22
Description: NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5449; https://nvidia.custhelp.com/app/answers/detail/a_id/5449
CVE: CVE-2023-0203
Published: 2023-04-22
Description: NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-1220
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5459; https://nvidia.custhelp.com/app/answers/detail/a_id/5459
CVE: CVE-2023-0204
Published: 2023-04-22
Description: NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can cause improper handling of exceptional conditions, which may lead to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-703, CWE-755
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5459; https://nvidia.custhelp.com/app/answers/detail/a_id/5459
CVE: CVE-2023-0205
Published: 2023-04-22
Description: NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-1220
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5459; https://nvidia.custhelp.com/app/answers/detail/a_id/5459
CVE: CVE-2023-0206
Published: 2023-04-22
Description: NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5449; https://nvidia.custhelp.com/app/answers/detail/a_id/5449
CVE: CVE-2023-0207
Published: 2023-04-22
Description: NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful exploit of this vulnerability may lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5449; https://nvidia.custhelp.com/app/answers/detail/a_id/5449
CVE: CVE-2023-0209
Published: 2023-04-22
Description: NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service, escalation of privileges assisted by a firmware implant, information disclosure assisted by a firmware implant, data tampering, and SecureBoot bypass.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287, CWE-287
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5458; https://nvidia.custhelp.com/app/answers/detail/a_id/5458
CVE: CVE-2023-25505
Published: 2023-04-22
Description: NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate level of authorization can cause a buffer overflow, which may lead to denial of service, information disclosure, or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5458; https://nvidia.custhelp.com/app/answers/detail/a_id/5458
CVE: CVE-2023-25506
Published: 2023-04-22
Description: NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, where a preconditioned heap can allow a user with elevated privileges to cause an access beyond the end of a buffer, which may lead to code execution, escalation of privileges, denial of service and information disclosure. The scope of the impact of this vulnerability can extend to other components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-788, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5458; https://nvidia.custhelp.com/app/answers/detail/a_id/5458
CVE: CVE-2023-25507
Published: 2023-04-22
Description: NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, and data tampering.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5458; https://nvidia.custhelp.com/app/answers/detail/a_id/5458
CVE: CVE-2023-25508
Published: 2023-04-22
Description: NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5458; https://nvidia.custhelp.com/app/answers/detail/a_id/5458
CVE: CVE-2023-25509
Published: 2023-04-22
Description: NVIDIA DGX-1 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, and escalation of privileges.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5458; https://nvidia.custhelp.com/app/answers/detail/a_id/5458
CVE: CVE-2023-25510
Published: 2023-04-22
Description: NVIDIA CUDA Toolkit SDK for Linux and Windows contains a NULL pointer dereference in cuobjdump, where a local user running the tool against a malformed binary may cause a limited denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5456; https://nvidia.custhelp.com/app/answers/detail/a_id/5456
CVE: CVE-2023-25511
Published: 2023-04-22
Description: NVIDIA CUDA Toolkit for Linux and Windows contains a vulnerability in cuobjdump, where a division-by-zero error may enable a user to cause a crash, which may lead to a limited denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-369, CWE-369
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5456; https://nvidia.custhelp.com/app/answers/detail/a_id/5456
CVE: CVE-2023-25512
Published: 2023-04-22
Description: NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds memory read by running cuobjdump on a malformed input file. A successful exploit of this vulnerability may lead to limited denial of service, code execution, and limited information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5456; https://nvidia.custhelp.com/app/answers/detail/a_id/5456
CVE: CVE-2023-25513
Published: 2023-04-22
Description: NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds read by tricking a user into running cuobjdump on a malformed input file. A successful exploit of this vulnerability may lead to limited denial of service, code execution, and limited information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5456; https://nvidia.custhelp.com/app/answers/detail/a_id/5456
CVE: CVE-2023-25514
Published: 2023-04-22
Description: NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds read by tricking a user into running cuobjdump on a malformed input file. A successful exploit of this vulnerability may lead to limited denial of service, code execution, and limited information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5456; https://nvidia.custhelp.com/app/answers/detail/a_id/5456
CVE: CVE-2023-2241
Published: 2023-04-22
Description: A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 535a786f124b739e3c857529cecc29e4eeb79778. It is recommended to apply a patch to fix this issue. VDB-227226 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-122, CWE-787, CWE-120
References: https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778; https://github.com/podofo/podofo/files/11260976/poc-file.zip; https://github.com/podofo/podofo/issues/69
CVE: CVE-2023-2242
Published: 2023-04-22
Description: A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component GET Parameter Handler. The manipulation of the argument c/s leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227227.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://docs.google.com/document/d/1GZt9MKB2K-nDrg0cnrnU6_z9wDd9xPE-YJbPV2Qgqg4/edit; https://vuldb.com/?ctiid.227227; https://vuldb.com/?id.227227
CVE: CVE-2023-2239
Published: 2023-04-22
Description: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-359
References: https://github.com/microweber/microweber/commit/b0644cb3411b36b6ccc2ff7cdf7af3fa49525baa; https://huntr.dev/bounties/edeff16b-fc71-4e26-8d2d-dfe7bb5e7868; https://github.com/microweber/microweber/commit/b0644cb3411b36b6ccc2ff7cdf7af3fa49525baa
CVE: CVE-2023-2243
Published: 2023-04-22
Description: A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file users/registration.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227228.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/HibuMk/bug_report/blob/main/SQLi.md; https://vuldb.com/?ctiid.227228; https://vuldb.com/?id.227228
CVE: CVE-2023-2244
Published: 2023-04-22
Description: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects an unknown part of the file /admin/orders/update_status.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227229 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/T4y1oR/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.227229; https://vuldb.com/?id.227229
CVE: CVE-2023-2245
Published: 2023-04-22
Description: A vulnerability was found in hansunCMS 1.4.3. It has been declared as critical. This vulnerability affects unknown code of the file /ueditor/net/controller.ashx?action=catchimage. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227230 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/MorStardust/hansuncmswebshell/blob/main/README.md; https://vuldb.com/?ctiid.227230; https://vuldb.com/?id.227230
CVE: CVE-2022-4944
Published: 2023-04-22
Description: A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.50 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227000.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/kalcaddle/KodExplorer/issues/512; https://github.com/kalcaddle/KodExplorer/releases/tag/4.50; https://vuldb.com/?ctiid.227000
CVE: CVE-2023-1875
Published: 2023-04-22
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/dcf7dd43a3412aa951d7087b86a8b917fae2133a; https://huntr.dev/bounties/39715aaf-e798-4c60-97c4-45f4f2cd5c61; https://github.com/thorsten/phpmyfaq/commit/dcf7dd43a3412aa951d7087b86a8b917fae2133a
CVE: CVE-2022-44582
Published: 2023-04-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apptivo Apptivo Business Site CRM plugin <= 3.0.12 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/apptivo-business-site/wordpress-apptivo-business-site-crm-plugin-3-0-12-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/apptivo-business-site/wordpress-apptivo-business-site-crm-plugin-3-0-12-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve