deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-37384
Published: 2023-07-17
Description: RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://cwe.mitre.org/data/definitions/94.html; https://gist.githubusercontent.com/LuigiPolidorio/9fe61cf2edee63152161ffc52c39f6cd/raw/529cf49103e0fdf4eeb970fa1f62fa508ebe7c3c/reference.txt; https://owasp.org/www-community/attacks/Code_Injection
CVE: CVE-2023-37265
Published: 2023-07-17
Description: CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7; https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g; https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos
CVE: CVE-2023-37266
Published: 2023-07-17
Description: CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/IceWhaleTech/CasaOS/commit/705bf1facbffd2ca40b159b0303132b6fdf657ad; https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr; https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos
CVE: CVE-2023-38403
Published: 2023-07-17
Description: iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://seclists.org/fulldisclosure/2023/Oct/24; http://seclists.org/fulldisclosure/2023/Oct/26; https://bugs.debian.org/1040830
CVE: CVE-2023-38404
Published: 2023-07-17
Description: The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the server. An authenticated attacker can then execute the malicious file to perform command execution on the remote server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.veritas.com/content/support/en_US/security/VTS23-009; https://www.veritas.com/content/support/en_US/security/VTS23-009
CVE: CVE-2023-38405
Published: 2023-07-17
Description: On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.crestron.com/release_notes/cp3n_1.8001.0187_release_notes.pdf; https://www.crestron.com/release_notes/cp3n_1.8001.0187_release_notes.pdf
CVE: CVE-2023-37476
Published: 2023-07-17
Description: OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/OpenRefine/OpenRefine/commit/e9c1e65d58b47aec8cd676bd5c07d97b002f205e; https://github.com/OpenRefine/OpenRefine/releases/tag/3.7.4; https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-m88m-crr9-jvqq
CVE: CVE-2023-38409
Published: 2023-07-17
Description: An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.12; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=fffb0b52d5258554c645c966c6cbef7de50b851d; https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.12
CVE: CVE-2023-3724
Published: 2023-07-17
Description: If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying Material) value when generating the session master secret. Using a potentially known IKM value when generating the session master secret key compromises the key generated, allowing an eavesdropper to reconstruct it and potentially allowing access to or meddling with message contents in the session. This issue does not affect client validation of connected servers, nor expose private key information, but could result in an insecure TLS 1.3 session when not controlling both sides of the connection. wolfSSL recommends that TLS 1.3 client side users update the version of wolfSSL used. 



CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-295
References: https://github.com/wolfSSL/wolfssl/pull/6412; https://www.wolfssl.com/docs/security-vulnerabilities/; https://github.com/wolfSSL/wolfssl/pull/6412
CVE: CVE-2023-37479
Published: 2023-07-17
Description: Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as Enclaves. There are two issues that are mitigated in version 0.19.3. First, Open Enclave SDK does not properly sanitize the `MXCSR` register on enclave entry. This makes applications vulnerable to MXCSR Configuration Dependent Timing (MCDT) attacks, where incorrect `MXCSR` values can impact instruction retirement by at most one cycle, depending on the (secret) data operand value. Please find more details in the guidance from Intel in the references. Second, Open Enclave SDK does not sanitize x86's alignment check flag `RFLAGS.AC` on enclave entry. This opens up the possibility for a side-channel attacker to be notified for every unaligned memory access performed by the enclave. The issue has been addressed in version 0.19.3 and the current master branch. Users will need to recompile their applications against the patched libraries to be protected from this vulnerability. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-665
References: https://github.com/openenclave/openenclave/commit/ca[PII_REDACTED]5b9beaad92c999a92b015c44b079; https://github.com/openenclave/openenclave/security/advisories/GHSA-5gfr-m6mx-p5w4; https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/mxcsr-configuration-dependent-timing.html
CVE: CVE-2023-37850
Published: 2023-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-38426
Published: 2023-07-18
Description: An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/ksmbd?id=02f76c401d17e409ed45bf7887148fcc22c93c85; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-38427
Published: 2023-07-18
Description: An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_contexts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-191, CWE-125, CWE-191
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.8; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/smb/server?id=f1a411873c85b642f13b01f21b534c2bab81fc1b; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-38428
Published: 2023-07-18
Description: An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/ksmbd?id=f0a96d1aafd8964e1f9955c830a3e5cb3c60a90f; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-38429
Published: 2023-07-18
Description: An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/ksmbd?id=443d61d1fa9faa60ef925513d[PII_REDACTED]0100f; https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4
CVE: CVE-2023-38430
Published: 2023-07-18
Description: An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.9; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/smb/server?id=1c1bcf2d3ea061613119b534f57507c377df20f9; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-38431
Published: 2023-07-18
Description: An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.8; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/smb/server?id=368ba06881c395f1c9a7ba22203cf8d78b4addc0; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-38432
Published: 2023-07-18
Description: An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.10; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/smb/server?id=2b9b8f3b68edb3d67d79962f02e26dbb5ae3808d; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-36695
Published: 2023-07-18
Description: Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hitachi Replication Manager on Linux, Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hitachi Tuning Manager - Agent for RAID, Hitachi Tuning Manager - Agent for NAS 

components), Hitachi Compute Systems Manager on Linux allows File Manipulation.This issue affects Hitachi Device Manager: before 8.8.5-02; Hitachi Tiered Storage Manager: before 8.8.5-02; Hitachi Replication Manager: before 8.8.5-02; Hitachi Tuning Manager: before 8.8.5-02; Hitachi Compute Systems Manager: before 8.8.3-08.


CVSS Score: 6.6 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-124/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-124/index.html
CVE: CVE-2021-43072
Published: 2023-07-18
Description: A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiManager version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiOS version 7.0.0 through 7.0.4, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x and FortiProxy version 7.0.0 through 7.0.3, 2.0.0 through 2.0.8, 1.2.x, 1.1.x and 1.0.x allows attacker to execute unauthorized code or commands via crafted CLI `execute restore image` and `execute certificate remote` operations with the tFTP protocol.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://fortiguard.com/advisory/FG-IR-21-206; https://www.fortiguard.com/psirt/FG-IR-21-206; https://fortiguard.com/advisory/FG-IR-21-206
CVE: CVE-2022-4146
Published: 2023-07-18
Description: Expression Language Injection vulnerability in Hitachi Replication Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Replication Manager: before 8.8.5-02.


CVSS Score: 7.3 (HIGH)
CWE: CWE-917, CWE-917
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-123/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-123/index.html
CVE: CVE-2023-31998
Published: 2023-07-18
Description: A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-120
References: https://community.ui.com/releases/Security-Advisory-Bulletin-033-033/17f7c7c0-830b-4625-a2ee-e90e514e7b0f; https://community.ui.com/releases/Security-Advisory-Bulletin-033-033/17f7c7c0-830b-4625-a2ee-e90e514e7b0f
CVE: CVE-2023-34142
Published: 2023-07-18
Description: Cleartext Transmission of Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Data Collector components) allows Interception.This issue affects Hitachi Device Manager: before 8.8.5-02.


CVSS Score: 9.0 (CRITICAL)
CWE: CWE-319, CWE-319
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-125/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-125/index.html
CVE: CVE-2023-34143
Published: 2023-07-18
Description: Improper Validation of Certificate with Host Mismatch vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Data Collector components) allows Man in the Middle Attack.This issue affects Hitachi Device Manager: before 8.8.5-02.


CVSS Score: 5.6 (MEDIUM)
CWE: CWE-297, CWE-295
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-125/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-125/index.html
CVE: CVE-2023-38434
Published: 2023-07-18
Description: xHTTP 72f812d has a double free in close_connection in xhttp.c via a malformed HTTP request method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://github.com/cozis/xHTTP/issues/1; https://github.com/cozis/xHTTP/issues/1
CVE: CVE-2023-3403
Published: 2023-07-18
Description: The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to import new users and update existing users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.4.8/admin/class-profile-magic-admin.php#L1027; https://plugins.trac.wordpress.org/changeset/2938904/profilegrid-user-profiles-groups-and-communities#file0; https://www.wordfence.com/threat-intel/vulnerabilities/id/b335fc19-2998-4711-8813-6cb68d7447bd?source=cve
CVE: CVE-2023-3459
Published: 2023-07-18
Description: The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863
References: https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.4.1/admin/modules/user/import/import.php#L446; https://plugins.trac.wordpress.org/changeset/2938705/users-customers-import-export-for-wp-woocommerce#file201; https://www.wordfence.com/threat-intel/vulnerabilities/id/47337214-9cc3-4b12-bb71-9acbab3649b7?source=cve
CVE: CVE-2023-3708
Published: 2023-07-18
Description: Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://deothemes.com/changelog/medikaid-changelog/; https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196755%40nokke&new=196755%40nokke&sfp_email=&sfph_mail=; https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196756%40arendelle&new=196756%40arendelle&sfp_email=&sfph_mail=
CVE: CVE-2023-3709
Published: 2023-07-18
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vulnerable version of this plugin with the MailChimp block enabled as the API key may have been compromised.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2938619%40royal-elementor-addons&new=2936984%40royal-elementor-addons&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/86c9bcf1-c69e-47ca-b74b-8ce6157f520b?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2938619%40royal-elementor-addons&new=2936984%40royal-elementor-addons&sfp_email=&sfph_mail=
CVE: CVE-2023-3713
Published: 2023-07-18
Description: The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily. This can be used by attackers to achieve privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.4.8/admin/class-profile-magic-admin.php#L599; https://plugins.trac.wordpress.org/changeset/2938904/profilegrid-user-profiles-groups-and-communities#file0; https://www.wordfence.com/threat-intel/vulnerabilities/id/473ba791-af99-4aae-99cb-ccf220e443e7?source=cve
CVE: CVE-2023-3714
Published: 2023-07-18
Description: The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versions up to, and including, 5.5.2. This makes it possible for authenticated attackers, with group ownership, to update group options, including the 'associate_role' parameter, which defines the member's role. This issue was partially patched in version 5.5.2 preventing privilege escalation, however, it was fully patched in 5.5.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.4.8/public/partials/profile-magic-group.php#L80; https://plugins.trac.wordpress.org/changeset/2938904/profilegrid-user-profiles-groups-and-communities#file4; https://plugins.trac.wordpress.org/changeset/2939344/profilegrid-user-profiles-groups-and-communities/trunk/public/partials/profile-magic-group.php
CVE: CVE-2015-10122
Published: 2023-07-18
Description: A vulnerability was found in wp-donate Plugin up to 1.4 on WordPress. It has been classified as critical. This affects an unknown part of the file includes/donate-display.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.5 is able to address this issue. The identifier of the patch is 019114cb788d954c5d1b36d6c62418619e93a757. It is recommended to upgrade the affected component. The identifier VDB-234249 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/wp-plugins/wp-donate/commit/019114cb788d954c5d1b36d6c62418619e93a757; https://vuldb.com/?ctiid.234249; https://vuldb.com/?id.234249
CVE: CVE-2023-2433
Published: 2023-07-18
Description: The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/yet-another-related-posts-plugin/tags/5.30.3/classes/YARPP_Core.php#L1623; https://plugins.trac.wordpress.org/changeset/2939617/yet-another-related-posts-plugin/trunk/classes/YARPP_Core.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/35bd7462-8dab-43b2-9941-fef6f826cfdc?source=cve
CVE: CVE-2022-45828
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/noo-timetable/wordpress-noo-timetable-responsive-calendar-auto-sync-wordpress-plugin-plugin-2-1-3-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/noo-timetable/wordpress-noo-timetable-responsive-calendar-auto-sync-wordpress-plugin-plugin-2-1-3-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-46857
Published: 2023-07-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in SiteAlert plugin <= 1.9.7 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/my-wp-health-check/wordpress-sitealert-uptime-speed-and-security-monitoring-for-wordpress-plugin-1-9-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/my-wp-health-check/wordpress-sitealert-uptime-speed-and-security-monitoring-for-wordpress-plugin-1-9-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve