deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-25473
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/flickr-justified-gallery/wordpress-flickr-justified-gallery-plugin-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/flickr-justified-gallery/wordpress-flickr-justified-gallery-plugin-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25475
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Smart YouTube PRO plugin <= 4.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/smart-youtube/wordpress-smart-youtube-pro-plugin-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smart-youtube/wordpress-smart-youtube-pro-plugin-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25482
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mike Martel WP Tiles plugin <= 1.1.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-tiles/wordpress-wp-tiles-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-tiles/wordpress-wp-tiles-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-3743
Published: 2023-07-18
Description: Ap Page Builder, in versions lower than 1.7.8.2, could allow a remote attacker to send a specially crafted SQL query to the product_one_img parameter to retrieve the information stored in the database.

CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-leothemes-ap-page-builder; https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-leothemes-ap-page-builder
CVE: CVE-2018-25088
Published: 2023-07-18
Description: A vulnerability, which was classified as critical, was found in Blue Yonder postgraas_server up to 2.0.0b2. Affected is the function _create_pg_connection/create_postgres_db of the file postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py of the component PostgreSQL Backend Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 7cd8d016edc74a78af0d81c948bfafbcc93c937c. It is recommended to upgrade the affected component. VDB-234246 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/blue-yonder/postgraas_server/commit/7cd8d016edc74a78af0d81c948bfafbcc93c937c; https://github.com/blue-yonder/postgraas_server/releases/tag/v2.0.0; https://vuldb.com/?ctiid.234246
CVE: CVE-2022-47169
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in StaxWP Visibility Logic for Elementor plugin <= 2.3.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/visibility-logic-elementor/wordpress-visibility-logic-for-elementor-plugin-2-3-4-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/visibility-logic-elementor/wordpress-visibility-logic-for-elementor-plugin-2-3-4-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-23660
Published: 2023-07-18
Description: Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP MainWP Maintenance Extension plugin <= 4.1.1 versions.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/articles/multiple-vulnerabilities-affecting-mainwp-extensions?_s_id=cve; https://patchstack.com/database/vulnerability/mainwp-maintenance-extension/wordpress-mainwp-maintenance-extension-plugin-4-1-1-subscriber-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/articles/multiple-vulnerabilities-affecting-mainwp-extensions?_s_id=cve
CVE: CVE-2023-25036
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <= 1.6 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/spoontalk-social-media-icons-widget/wordpress-social-media-icons-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/spoontalk-social-media-icons-widget/wordpress-social-media-icons-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-37386
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/media-library-helper/wordpress-media-library-helper-by-codexin-plugin-1-2-0-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/media-library-helper/wordpress-media-library-helper-by-codexin-plugin-1-2-0-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-37387
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/classified-listing/wordpress-classified-listing-plugin-2-4-5-cross-site-request-forgery-csrf-leading-to-thumbnail-removal-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/classified-listing/wordpress-classified-listing-plugin-2-4-5-cross-site-request-forgery-csrf-leading-to-thumbnail-removal-vulnerability?_s_id=cve
CVE: CVE-2023-37889
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPAdmin WPAdmin AWS CDN plugin <= 2.0.13 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/aws-cdn-by-wpadmin/wordpress-wpadmin-aws-cdn-plugin-2-0-13-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/aws-cdn-by-wpadmin/wordpress-wpadmin-aws-cdn-plugin-2-0-13-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-37892
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin <= 6.0.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/shortcode-imdb/wordpress-shortcode-imdb-plugin-6-0-8-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/shortcode-imdb/wordpress-shortcode-imdb-plugin-6-0-8-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-37973
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in David Pokorny Replace Word plugin <= 2.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/replace-word/wordpress-replace-word-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/replace-word/wordpress-replace-word-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-38326
Published: 2023-07-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2020-23909
Published: 2023-07-18
Description: Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://sourceforge.net/p/advancemame/bugs/285/; https://sourceforge.net/p/advancemame/bugs/285/
CVE: CVE-2020-23910
Published: 2023-07-18
Description: Stack-based buffer overflow vulnerability in asn1c through v0.9.28 via function genhash_get in genhash.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/vlm/asn1c/issues/396; https://github.com/vlm/asn1c/issues/396
CVE: CVE-2020-23911
Published: 2023-07-18
Description: An issue was discovered in asn1c through v0.9.28. A NULL pointer dereference exists in the function _default_error_logger() located in asn1fix.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/vlm/asn1c/issues/394; https://github.com/vlm/asn1c/issues/394
CVE: CVE-2021-32256
Published: 2023-07-18
Description: An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1927070; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1927070
CVE: CVE-2021-33294
Published: 2023-07-18
Description: In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://sourceware.org/bugzilla/show_bug.cgi?id=27501; https://sourceware.org/pipermail/elfutils-devel/2021q1/003607.html; https://sourceware.org/bugzilla/show_bug.cgi?id=27501
CVE: CVE-2021-34119
Published: 2023-07-18
Description: A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/michaelrsweet/htmldoc/commit/85fa76d77ed69927d24decf476e69bedc7691f48; https://github.com/michaelrsweet/htmldoc/issues/431; https://github.com/michaelrsweet/htmldoc/commit/85fa76d77ed69927d24decf476e69bedc7691f48
CVE: CVE-2021-34121
Published: 2023-07-18
Description: An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/michaelrsweet/htmldoc/commit/c67bbd8756f015e33e4ba639a40c7f9d8bd9e8ab; https://github.com/michaelrsweet/htmldoc/issues/433; https://github.com/michaelrsweet/htmldoc/commit/c67bbd8756f015e33e4ba639a40c7f9d8bd9e8ab
CVE: CVE-2021-34123
Published: 2023-07-18
Description: An issue was discovered on atasm, version 1.09. A stack-buffer-overflow vulnerability in function aprintf() in asm.c allows attackers to execute arbitrary code on the system via a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://sourceforge.net/p/atasm/bugs/23/; https://sourceforge.net/p/atasm/bugs/23/
CVE: CVE-2022-26563
Published: 2023-07-18
Description: An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authorization.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://bitbucket.org/tildeslash/monit/commits/6ecaab1d375f33165fe98d06d92f36c949c0ea11; https://man7.org/linux/man-pages/man3/pam_acct_mgmt.3.html; https://bitbucket.org/tildeslash/monit/commits/6ecaab1d375f33165fe98d06d92f36c949c0ea11
CVE: CVE-2022-33064
Published: 2023-07-18
Description: An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193
References: https://github.com/libsndfile/libsndfile/issues/832; https://github.com/libsndfile/libsndfile/issues/832
CVE: CVE-2022-33065
Published: 2023-07-18
Description: Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other unspecified impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://github.com/libsndfile/libsndfile/issues/789; https://github.com/libsndfile/libsndfile/issues/833; https://github.com/libsndfile/libsndfile/issues/789
CVE: CVE-2022-34155
Published: 2023-07-18
Description: Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://lana.codes/lanavdb/071fa6eb-2e54-43a1-b37f-1e562988b7d4?_s_id=cve; https://patchstack.com/database/vulnerability/miniorange-login-with-eve-online-google-facebook/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-6-23-3-broken-authentication-vulnerability?_s_id=cve; https://lana.codes/lanavdb/071fa6eb-2e54-43a1-b37f-1e562988b7d4?_s_id=cve
CVE: CVE-2022-41409
Published: 2023-07-18
Description: Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35; https://github.com/PCRE2Project/pcre2/issues/141; https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35
CVE: CVE-2022-47085
Published: 2023-07-18
Description: An issue was discovered in ostree before 2022.7 allows attackers to cause a denial of service or other unspecified impacts via the print_panic function in repo_checkout_filter.rs.
CVSS Score: 7.5 (HIGH)
References: https://doc.rust-lang.org/std/macro.eprintln.html; https://github.com/ostreedev/ostree/issues/2775; https://doc.rust-lang.org/std/macro.eprintln.html
CVE: CVE-2023-30906
Published: 2023-07-18
Description: The vulnerability could be locally exploited to allow escalation of privilege.


CVSS Score: 7.5 (HIGH)
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04486en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04486en_us
CVE: CVE-2023-32965
Published: 2023-07-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CRUDLab Jazz Popups plugin <= 1.8.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/jazz-popups/wordpress-jazz-popups-plugin-1-8-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jazz-popups/wordpress-jazz-popups-plugin-1-8-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2020-36762
Published: 2023-07-18
Description: A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENT_BODY leads to os command injection. Upgrading to version 2.0.28 is able to address this issue. The name of the patch is dcaad2540f7d50c512ff2e031d3778dd9337db2b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-234248.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-78
References: https://github.com/ONSdigital/ras-collection-instrument/commit/dcaad2540f7d50c512ff2e031d3778dd9337db2b; https://github.com/ONSdigital/ras-collection-instrument/pull/199; https://github.com/ONSdigital/ras-collection-instrument/releases/tag/2.0.28
CVE: CVE-2022-47421
Published: 2023-07-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-4-stored-cross-site-scripting-xss-on-common-messages-settings?_s_id=cve; https://patchstack.com/database/vulnerability/armember/wordpress-armember-premium-wordpress-membership-plugin-plugin-5-8-stored-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-4-stored-cross-site-scripting-xss-on-common-messages-settings?_s_id=cve
CVE: CVE-2023-24390
Published: 2023-07-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WeSecur Security plugin <= 1.2.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wesecur-security/wordpress-wesecur-security-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wesecur-security/wordpress-wesecur-security-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-31441
Published: 2023-07-18
Description: In NATO Communications and Information Agency anet (aka Advisor Network) through 3.3.0, an attacker can provide a crafted JSON file to sanitizeJson and cause an exception. This is related to the U+FFFD Unicode replacement character. A for loop does not consider that a data structure is being modified during loop execution.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/NCI-Agency/anet/blob/0662b99dfdec1ce07439eb7bed02d90320acc721/src/main/java/mil/dds/anet/utils/Utils.java; https://github.com/NCI-Agency/anet/issues/4408; https://github.com/NCI-Agency/anet/blob/0662b99dfdec1ce07439eb7bed02d90320acc721/src/main/java/mil/dds/anet/utils/Utils.java
CVE: CVE-2023-36120
Published: 2023-07-18
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-36383
Published: 2023-07-18
Description: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.9.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mage-eventpress/wordpress-event-manager-and-tickets-selling-plugin-for-woocommerce-plugin-3-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mage-eventpress/wordpress-event-manager-and-tickets-selling-plugin-for-woocommerce-plugin-3-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-36384
Published: 2023-07-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <= 1.2.40 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/booking-calendar-contact-form/wordpress-booking-calendar-contact-form-plugin-1-2-40-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/booking-calendar-contact-form/wordpress-booking-calendar-contact-form-plugin-1-2-40-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-2263
Published: 2023-07-18
Description: 
The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing.  The new ENIP connections cannot be established if impacted by this vulnerability,  which prohibits operational capabilities of the device resulting in a denial-of-service attack.



CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140029; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140029
CVE: CVE-2023-33265
Published: 2023-07-18
Description: In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://github.com/hazelcast/hazelcast; https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265; https://github.com/hazelcast/hazelcast
CVE: CVE-2023-34035
Published: 2023-07-18
Description: Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)

Specifically, an application is vulnerable when all of the following are true:

  *  Spring MVC is on the classpath
  *  Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet)
  *  The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints


An application is not vulnerable if any of the following is true:

  *  The application does not have Spring MVC on the classpath
  *  The application secures no servlets other than Spring MVC’s DispatcherServlet
  *  The application uses requestMatchers(String) only for Spring MVC endpoints




CVSS Score: 7.3 (HIGH)
CWE: CWE-863
References: https://spring.io/security/cve-2023-34035; https://spring.io/security/cve-2023-34035
CVE: CVE-2021-4428
Published: 2023-07-18
Description: A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: https://github.com/what3words/wordpress-autosuggest-plugin/commit/dd59cbac5f86057d6a73b87007c08b8bfa0c32ac; https://github.com/what3words/wordpress-autosuggest-plugin/pull/20; https://github.com/what3words/wordpress-autosuggest-plugin/releases/tag/v4.0.1
CVE: CVE-2023-0160
Published: 2023-07-18
Description: A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-833, CWE-667
References: https://access.redhat.com/security/cve/CVE-2023-0160; https://bugzilla.redhat.com/show_bug.cgi?id=2159764; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ed17aa92dc56
CVE: CVE-2023-33231
Published: 2023-07-18
Description: XSS attack was possible in DPA 2023.2 due to insufficient input validation
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-2-100_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-33231; https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-2-100_release_notes.htm
CVE: CVE-2023-37259
Published: 2023-07-18
Description: matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/matrix-org/matrix-react-sdk/commit/22fcd34c606f32129ebc967fc21f24fb708a98b8; https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-c9vx-2g7w-rp65; https://github.com/matrix-org/matrix-react-sdk/commit/22fcd34c606f32129ebc967fc21f24fb708a98b8