deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2427
Published: 2023-05-05
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/514f4df2ad918e69575028d58b2e33aaf536e59b; https://huntr.dev/bounties/89005a6d-d019-4cb7-ae88-486d2d44190d; https://github.com/thorsten/phpmyfaq/commit/514f4df2ad918e69575028d58b2e33aaf536e59b
CVE: CVE-2023-2516
Published: 2023-05-05
Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nilsteampassnet/teampass/commit/39b774cba118ca5383b0a51a71b1e7dea2761927; https://huntr.dev/bounties/19470f0b-7094-4339-8d4a-4b5570b54716; https://github.com/nilsteampassnet/teampass/commit/39b774cba118ca5383b0a51a71b1e7dea2761927
CVE: CVE-2023-2550
Published: 2023-05-05
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/20ac51594db11604a4518aacc28a51f67d4f11bf; https://huntr.dev/bounties/840c8d91-c97e-4116-a9f8-4ab1a38d239b; https://github.com/thorsten/phpmyfaq/commit/20ac51594db11604a4518aacc28a51f67d4f11bf
CVE: CVE-2023-2551
Published: 2023-05-05
Description: PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98, CWE-829
References: https://github.com/unilogies/bumsys/commit/86e29dd23df348ec6075f0c0de8e06b8d9fb0a9a; https://huntr.dev/bounties/5723613c-55c6-4f18-9ed3-61ad44f5de9c; https://github.com/unilogies/bumsys/commit/86e29dd23df348ec6075f0c0de8e06b8d9fb0a9a
CVE: CVE-2023-2552
Published: 2023-05-05
Description: Cross-Site Request Forgery (CSRF) in GitHub repository unilogies/bumsys prior to 2.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/unilogies/bumsys/commit/86e29dd23df348ec6075f0c0de8e06b8d9fb0a9a; https://huntr.dev/bounties/ab0b4655-f57a-4113-849b-2237eeb75b32; https://github.com/unilogies/bumsys/commit/86e29dd23df348ec6075f0c0de8e06b8d9fb0a9a
CVE: CVE-2023-2553
Published: 2023-05-05
Description: Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to 2.2.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/unilogies/bumsys/commit/1b426f58a513194206d0ea8ab58baf1461e54978; https://huntr.dev/bounties/4e1f5b56-e846-40d8-a83c-533efd56aacf; https://github.com/unilogies/bumsys/commit/1b426f58a513194206d0ea8ab58baf1461e54978
CVE: CVE-2023-2554
Published: 2023-05-05
Description: External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-73
References: https://github.com/unilogies/bumsys/commit/1b426f58a513194206d0ea8ab58baf1461e54978; https://huntr.dev/bounties/396785a0-7bb6-4db4-b4cb-607b0fd4ab4b; https://github.com/unilogies/bumsys/commit/1b426f58a513194206d0ea8ab58baf1461e54978
CVE: CVE-2023-30065
Published: 2023-05-05
Description: MitraStar GPT-2741GNAC-N2 with firmware BR_g5.9_1.11(WVK.0)b32 was discovered to contain a remote code execution (RCE) vulnerability in the ping function.
CVSS Score: 8.8 (HIGH)
References: https://github.com/Sigmw/mitrastar-code-execution/blob/main/README.md; https://github.com/Sigmw/mitrastar-code-execution/blob/main/README.md
CVE: CVE-2023-29350
Published: 2023-05-05
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29350; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29350; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-29354
Published: 2023-05-05
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29354; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29354; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-29963
Published: 2023-05-05
Description: S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/superjock1988/debug/blob/main/s-cms_rce.md; https://github.com/superjock1988/debug/blob/main/s-cms_rce.md
CVE: CVE-2016-15031
Published: 2023-05-06
Description: A vulnerability was found in PHP-Login 1.0. It has been declared as critical. This vulnerability affects the function checkLogin of the file login/scripts/class.loginscript.php of the component POST Parameter Handler. The manipulation of the argument myusername leads to sql injection. The attack can be initiated remotely. Upgrading to version 2.0 is able to address this issue. The patch is identified as 0083ec652786ddbb81335ea20da590df40035679. It is recommended to upgrade the affected component. VDB-228022 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ipoelnet/php-login/commit/0083ec652786ddbb81335ea20da590df40035679; https://github.com/ipoelnet/php-login/releases/tag/v2.0; https://vuldb.com/?ctiid.228022
CVE: CVE-2022-22313
Published: 2023-05-06
Description: IBM QRadar Data Synchronization App 1.0 through 3.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  217370.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/217370; https://www.ibm.com/support/pages/node/6980797; https://exchange.xforce.ibmcloud.com/vulnerabilities/217370
CVE: CVE-2022-43877
Published: 2023-05-06
Description: IBM UrbanCode Deploy (UCD) versions up to 7.3.0.1 could disclose sensitive password information during a manual edit of the agentrelay.properties file.  IBM X-Force ID:  240148.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240148; https://www.ibm.com/support/pages/node/6967351; https://exchange.xforce.ibmcloud.com/vulnerabilities/240148
CVE: CVE-2023-24957
Published: 2023-05-06
Description: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  246115.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/246115; https://www.ibm.com/support/pages/node/6965776; https://exchange.xforce.ibmcloud.com/vulnerabilities/246115
CVE: CVE-2023-26517
Published: 2023-05-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeff Starr Dashboard Widgets Suite plugin <= 3.2.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/dashboard-widgets-suite/wordpress-dashboard-widgets-suite-plugin-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dashboard-widgets-suite/wordpress-dashboard-widgets-suite-plugin-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26519
Published: 2023-05-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Benfica Publish to Schedule plugin <= 4.5.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/publish-to-schedule/wordpress-publish-to-schedule-plugin-4-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/publish-to-schedule/wordpress-publish-to-schedule-plugin-4-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-2560
Published: 2023-05-06
Description: A vulnerability was found in jja8 NewBingGoGo up to 2023.5.5.2. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228167.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/jja8/NewBingGoGo/issues/I6WH2E; https://vuldb.com/?ctiid.228167; https://vuldb.com/?id.228167
CVE: CVE-2023-25491
Published: 2023-05-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Samuel Marshall JCH Optimize plugin <= 3.2.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/jch-optimize/wordpress-jch-optimize-plugin-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jch-optimize/wordpress-jch-optimize-plugin-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24400
Published: 2023-05-07
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Hu-manity.Co Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.4.6 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cookie-notice/wordpress-cookie-notice-compliance-for-gdpr-ccpa-plugin-2-4-6-cross-site-scripting-xss-vulnerability; https://patchstack.com/database/vulnerability/cookie-notice/wordpress-cookie-notice-compliance-for-gdpr-ccpa-plugin-2-4-6-cross-site-scripting-xss-vulnerability
CVE: CVE-2023-31047
Published: 2023-05-07
Description: In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-862
References: https://docs.djangoproject.com/en/4.2/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW/
CVE: CVE-2023-32290
Published: 2023-05-07
Description: The myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is expected by a server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311, CWE-319
References: https://apps.apple.com/fm/app/mymail-email-app-for-gmail/id722120997; https://mailbox.org/en/post/mailbox-org-discovers-unencrypted-password-transmission-in-mymail; https://news.ycombinator.com/item?id=35845308
CVE: CVE-2023-2564
Published: 2023-05-07
Description: OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0.


CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://github.com/sbs20/scanservjs/pull/606/commits/d51fd52c[PII_REDACTED]b8f74e64ae6979c665dca1; https://huntr.dev/bounties/d13113ad-a107-416b-acc1-01e4c16ec461; https://github.com/sbs20/scanservjs/pull/606/commits/d51fd52c[PII_REDACTED]b8f74e64ae6979c665dca1
CVE: CVE-2023-2565
Published: 2023-05-07
Description: A vulnerability has been found in SourceCodester Multi Language Hotel Management Software 1.0 and classified as problematic. This vulnerability affects unknown code of the file ajax.php of the component POST Parameter Handler. The manipulation of the argument complaint_type with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228172.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/admin-passwd/bug_report/blob/main/XSS-1.md; https://vuldb.com/?ctiid.228172; https://vuldb.com/?id.228172
CVE: CVE-2023-29944
Published: 2023-05-08
Description: Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet function of the metersphere system workbench
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/metersphere/metersphere; https://hacku.top/wl/?id=N67LxQL238Tsw9PDok5fy8tihEO0jI7L; https://github.com/metersphere/metersphere
CVE: CVE-2023-30185
Published: 2023-05-08
Description: CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://crmeb.com; https://github.com/c7w1n/CVE-2023-30185/blob/main/CVE-2023-30185.md; https://www.crmeb.com/
CVE: CVE-2023-30257
Published: 2023-05-08
Description: A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/stigward/PoCs-and-Exploits/tree/main/fiio_LPE_0day; https://stigward.github.io/posts/fiio-m6-exploit/; https://github.com/stigward/PoCs-and-Exploits/tree/main/fiio_LPE_0day
CVE: CVE-2023-30018
Published: 2023-05-08
Description: Judging Management System v1.0 is vulnerable to SQL Injection. via /php-jms/review_se_result.php?mainevent_id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/10F26/bug_report/blob/main/judging-management-system/SQLi-1.md; https://github.com/10F26/bug_report/blob/main/judging-management-system/SQLi-1.md
CVE: CVE-2023-2566
Published: 2023-05-08
Description: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/openemr/openemr/commit/a2adac7320dfc631b1da688c3b04f54b8240fc7b; https://huntr.dev/bounties/47d6fc2a-989a-44eb-9cb7-ab4f8bd44496; https://github.com/openemr/openemr/commit/a2adac7320dfc631b1da688c3b04f54b8240fc7b
CVE: CVE-2023-2534
Published: 2023-05-08
Description: Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into overall system usage. User IDs can easily be correlated with real names e. g. via
ticket histories by any user. (Fuzzing for garnering other adjacent user/sensitive data). Subscribing to all possible push events could also lead to performance implications on the server side, depending on the size of the installation
and the number of active users. (Flooding)This issue affects OTRS: from 8.0.X before 8.0.32.


CVSS Score: 7.6 (HIGH)
CWE: CWE-285, CWE-863
References: https://otrs.com/release-notes/otrs-security-advisory-2023-03/; https://otrs.com/release-notes/otrs-security-advisory-2023-03/
CVE: CVE-2023-31038
Published: 2023-05-08
Description: SQL injection in Log4cxx when using the ODBC appender to send log messages to a database.  No fields sent to the database were properly escaped for SQL injection.  This has been the case since at least version 0.9.0(released 2003-08-06)




Note that Log4cxx is a C++ framework, so only C++ applications are affected.

Before version 1.1.0, the ODBC appender was automatically part of Log4cxx if the library was found when compiling the library.  As of version 1.1.0, this must be both explicitly enabled in order to be compiled in.




Three preconditions must be met for this vulnerability to be possible:

1. Log4cxx compiled with ODBC support(before version 1.1.0, this was auto-detected at compile time)

2. ODBCAppender enabled for logging messages to, generally done via a config file

3. User input is logged at some point. If your application does not have user input, it is unlikely to be affected.





Users are recommended to upgrade to version 1.1.0 which properly binds the parameters to the SQL statement, or migrate to the new DBAppender class which supports an ODBC connection in addition to other databases. 
Note that this fix does require a configuration file update, as the old configuration files will not configure properly.  An example is shown below, and more information may be found in the Log4cxx documentation on the ODBCAppender.





Example of old configuration snippet:

<appender name="SqlODBCAppender" class="ODBCAppender">

    <param name="sql" value="INSERT INTO logs (message) VALUES ('%m')" />

    ... other params here ...

</appender>




The migrated configuration snippet with new ColumnMapping parameters:


<appender name="SqlODBCAppender" class="ODBCAppender">




    <param name="sql" value="INSERT INTO logs (message) VALUES (?)" />

    <param name="ColumnMapping" value="message"/>
    ... other params here ...


</appender>






CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://lists.apache.org/thread/vgjlpdf353vv91gryspwxrzj6p0fbjd9; https://lists.apache.org/thread/vgjlpdf353vv91gryspwxrzj6p0fbjd9
CVE: CVE-2023-31039
Published: 2023-05-08
Description: Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file.
An attacker that can influence the ServerOptions pid_file parameter with which the bRPC server is started can execute arbitrary code with the permissions of the bRPC process.

Solution:
1. upgrade to bRPC >= 1.5.0, download link:  https://dist.apache.org/repos/dist/release/brpc/1.5.0/ https://dist.apache.org/repos/dist/release/brpc/1.5.0/ 
2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch:  https://github.com/apache/brpc/pull/2218 https://github.com/apache/brpc/pull/2218
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2023/05/08/1; https://lists.apache.org/thread/jqpttrqbc38yhckgp67xk399hqxnz7jn; http://www.openwall.com/lists/oss-security/2023/05/08/1
CVE: CVE-2023-29247
Published: 2023-05-08
Description: Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0.



CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/apache/airflow/pull/30447; https://github.com/apache/airflow/pull/30779; https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl
CVE: CVE-2022-46799
Published: 2023-05-08
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form plugin <= 1.0.15 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-testimonial-rotator/wordpress-easy-testimonial-slider-and-form-plugin-1-0-15-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/easy-testimonial-rotator/wordpress-easy-testimonial-slider-and-form-plugin-1-0-15-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23668
Published: 2023-05-08
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25021
Published: 2023-05-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FareHarbor FareHarbor for WordPress plugin <= 3.6.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/fareharbor/wordpress-fareharbor-for-wordpress-plugin-3-6-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fareharbor/wordpress-fareharbor-for-wordpress-plugin-3-6-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25754
Published: 2023-05-08
Description: Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-270
References: http://www.openwall.com/lists/oss-security/2023/05/08/2; https://github.com/apache/airflow/pull/29506; https://lists.apache.org/thread/3y83gr0qb8t49ppfk4fb2yk7md8ltq4v
CVE: CVE-2022-45812
Published: 2023-05-08
Description: Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Lees Exxp plugin <= 2.6.8 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/exxp-wp/wordpress-exxp-plugin-2-6-8-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/exxp-wp/wordpress-exxp-plugin-2-6-8-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25052
Published: 2023-05-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa Yandex.News Feed by Teplitsa plugin <= 1.12.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/yandexnews-feed-by-teplitsa/wordpress-yandex-news-feed-by-teplitsa-plugin-1-12-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yandexnews-feed-by-teplitsa/wordpress-yandex-news-feed-by-teplitsa-plugin-1-12-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25452
Published: 2023-05-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Pretty (prettyboymp) CMS Press plugin <= 0.2.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cms-press/wordpress-cms-press-plugin-0-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cms-press/wordpress-cms-press-plugin-0-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28169
Published: 2023-05-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CoreFortress Easy Event calendar plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-event-calendar/wordpress-easy-event-calendar-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-event-calendar/wordpress-easy-event-calendar-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-2573
Published: 2023-05-08
Description: Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be triggered by authenticated users via a crafted POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: http://packetstormsecurity.com/files/172307/Advantech-EKI-15XX-Series-Command-Injection-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2023/May/4; https://cyberdanube.com/en/multiple-vulnerabilities-in-advantech-eki-15xx-series/
CVE: CVE-2023-2574
Published: 2023-05-08
Description: Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be triggered by authenticated users via a crafted POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: http://packetstormsecurity.com/files/172307/Advantech-EKI-15XX-Series-Command-Injection-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2023/May/4; https://cyberdanube.com/en/multiple-vulnerabilities-in-advantech-eki-15xx-series/
CVE: CVE-2023-2575
Published: 2023-05-08
Description: Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stack-based Buffer Overflow vulnerability, which can be triggered by authenticated users via a crafted POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: http://packetstormsecurity.com/files/172307/Advantech-EKI-15XX-Series-Command-Injection-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2023/May/4; https://cyberdanube.com/en/multiple-vulnerabilities-in-advantech-eki-15xx-series/