deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27105
Published: 2023-04-25
Description: A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player with Shanling MTouch OS v3.3 allows attackers to arbitrarily read, delete, or modify any critical system files via directory traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://en.shanling.com/; https://hexavector.github.io/4bf46f12/; https://en.shanling.com/
CVE: CVE-2022-31244
Published: 2023-04-25
Description: Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://packetstormsecurity.com/files/171970/Nokia-OneNDS-17-Insecure-Permissions-Privilege-Escalation.html; https://www.nokia.com/networks/products/one-nds/; https://packetstormsecurity.com/files/171970/Nokia-OneNDS-17-Insecure-Permissions-Privilege-Escalation.html
CVE: CVE-2023-25313
Published: 2023-04-25
Description: OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/WWBN/AVideo/security/advisories/GHSA-pgvh-p3g4-86jw; https://github.com/WWBN/AVideo/security/advisories/GHSA-pgvh-p3g4-86jw
CVE: CVE-2023-25314
Published: 2023-04-25
Description: Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WWBN/AVideo/commit/2b44dee815b208da85e1dcafa9839391c3de2655; https://github.com/WWBN/AVideo/commit/2b44dee815b208da85e1dcafa9839391c3de2655
CVE: CVE-2023-29552
Published: 2023-04-25
Description: The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
CVSS Score: 7.5 (HIGH)
References: https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html; https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html; https://datatracker.ietf.org/doc/html/rfc2608
CVE: CVE-2023-30402
Published: 2023-04-25
Description: YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/yasm/yasm/issues/206; https://github.com/yasm/yasm/issues/206
CVE: CVE-2022-47608
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/quick-contact-form/wordpress-quick-contact-form-plugin-8-0-3-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/quick-contact-form/wordpress-quick-contact-form-plugin-8-0-3-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25484
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-yearly-archive/wordpress-simple-yearly-archive-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-yearly-archive/wordpress-simple-yearly-archive-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28847
Published: 2023-04-25
Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11, and 25.0.0 prior to 25.0.5; an attacker is not restricted in verifying passwords of share links so they can just start brute forcing the password. Nextcloud Server 24.0.11 and 25.0.5 and Nextcloud Enterprise Server 23.0.12.6, 24.0.11, and 25.0.5 contain a fix for this issue. No known workarounds are available.
CVSS Score: 3.1 (LOW)
CWE: CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r5wf-xj97-3w7w; https://github.com/nextcloud/server/pull/35057; https://hackerone.com/reports/1894653
CVE: CVE-2023-23837
Published: 2023-04-25
Description: No exception handling vulnerability which revealed sensitive or excessive information to users.


CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-209
References: https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-2_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2023-23837; https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-2_release_notes.htm
CVE: CVE-2023-23838
Published: 2023-04-25
Description: Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-2_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2023-23838; https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-2_release_notes.htm
CVE: CVE-2023-29200
Published: 2023-04-25
Description: Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager; https://github.com/contao/contao/commit/6f3e705f4ff23f4419563d09d[PII_REDACTED]f31df; https://github.com/contao/contao/security/advisories/GHSA-fp7q-xhhw-6rj3
CVE: CVE-2023-30177
Published: 2023-04-25
Description: CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e; https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e
CVE: CVE-2023-30545
Published: 2023-04-25
Description: PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9

CVSS Score: 7.7 (HIGH)
CWE: CWE-89
References: https://github.com/PrestaShop/PrestaShop/commit/cddac4198a47c602878a787280d813f60c6c0630; https://github.com/PrestaShop/PrestaShop/commit/d900806e1841a31f26ff0a1843a6888fc1bb7f81; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-8r4m-5p6p-52rp
CVE: CVE-2021-23166
Published: 2023-04-25
Description: A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server.
CVSS Score: 8.7 (HIGH)
CWE: CWE-267, CWE-276
References: https://github.com/odoo/odoo/issues/107687; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107687
CVE: CVE-2021-23176
Published: 2023-04-25
Description: Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/odoo/odoo/issues/107682; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107682
CVE: CVE-2021-23178
Published: 2023-04-25
Description: Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/odoo/odoo/issues/107690; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107690
CVE: CVE-2021-23186
Published: 2023-04-25
Description: A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database contents of other tenants, in a multi-tenant system.
CVSS Score: 8.7 (HIGH)
CWE: CWE-267
References: https://github.com/odoo/odoo/issues/107688; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107688
CVE: CVE-2021-23203
Published: 2023-04-25
Description: Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-863
References: https://github.com/odoo/odoo/issues/107695; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107695
CVE: CVE-2021-26263
Published: 2023-04-25
Description: Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/odoo/odoo/issues/107693; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107693
CVE: CVE-2021-26947
Published: 2023-04-25
Description: Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/odoo/odoo/issues/107694; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107694
CVE: CVE-2021-44460
Published: 2023-04-25
Description: Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/odoo/odoo/issues/107685; https://github.com/odoo/odoo/issues/107685
CVE: CVE-2021-44461
Published: 2023-04-25
Description: Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/odoo/odoo/issues/107686; https://github.com/odoo/odoo/issues/107686
CVE: CVE-2021-44465
Published: 2023-04-25
Description: Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://github.com/odoo/odoo/issues/107692; https://github.com/odoo/odoo/issues/107692
CVE: CVE-2021-44476
Published: 2023-04-25
Description: A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-267
References: https://github.com/odoo/odoo/issues/107684; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107684
CVE: CVE-2021-44547
Published: 2023-04-25
Description: A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-267
References: https://github.com/odoo/odoo/issues/107696; https://github.com/odoo/odoo/issues/107696
CVE: CVE-2021-44775
Published: 2023-04-25
Description: Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/odoo/odoo/issues/107691; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107691
CVE: CVE-2021-45071
Published: 2023-04-25
Description: Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/odoo/odoo/issues/107697; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107697
CVE: CVE-2021-45111
Published: 2023-04-25
Description: Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstration data, including user accounts with known credentials.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/odoo/odoo/issues/107683; https://www.debian.org/security/2023/dsa-5399; https://github.com/odoo/odoo/issues/107683
CVE: CVE-2022-23721
Published: 2023-04-25
Description: PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times.
CVSS Score: 3.8 (LOW)
CWE: CWE-694, CWE-74
References: https://docs.pingidentity.com/r/en-us/pingid/davinci_pingid_windows_login_relnotes_2.9; https://docs.pingidentity.com/r/en-us/pingid/davinci_pingid_windows_login_relnotes_2.9
CVE: CVE-2022-40482
Published: 2023-04-25
Description: The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://ephort.dk/blog/laravel-timing-attack-vulnerability/; https://github.com/ephort/laravel-user-enumeration-demo; https://github.com/laravel/framework/pull/44069
CVE: CVE-2022-40722
Published: 2023-04-25
Description: A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
CVSS Score: 7.7 (HIGH)
CWE: CWE-780, CWE-327
References: https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa; https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn; https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa
CVE: CVE-2022-40723
Published: 2023-04-25
Description: The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-305, CWE-287
References: https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rn; https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rn
CVE: CVE-2022-40724
Published: 2023-04-25
Description: The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://docs.pingidentity.com/r/en-us/pingfederate-110/fll[PII_REDACTED]50; https://docs.pingidentity.com/r/en-us/pingfederate-110/fll[PII_REDACTED]50
CVE: CVE-2022-40725
Published: 2023-04-25
Description: PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated.
CVSS Score: 7.3 (HIGH)
CWE: CWE-288, CWE-306
References: https://docs.pingidentity.com/r/en-us/pingid/desktop_app_1.7.4; https://docs.pingidentity.com/r/en-us/pingid/desktop_app_1.7.4
CVE: CVE-2022-45291
Published: 2023-04-25
Description: PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attacks can use the PWS_printfile.php, PWS_frame_text.php, PWS_listfile.php, PWS_winter.php, and PWS_easyweathersetup.php endpoints. A contributing factor is a hardcoded login password of support, which is not documented. (This is not the same as the documented setup password, which is 12345.) The issue was fixed in late 2022.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798, CWE-798
References: https://cavefxa.com/posts/cve-2022-45291/; https://pwsdashboard.com/; https://cavefxa.com/posts/cve-2022-45291/
CVE: CVE-2023-25485
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/json-content-importer/wordpress-json-content-importer-plugin-1-3-15-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/json-content-importer/wordpress-json-content-importer-plugin-1-3-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25793
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <= 2.0.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/link-juice-keeper/wordpress-link-juice-keeper-plugin-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/link-juice-keeper/wordpress-link-juice-keeper-plugin-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28086
Published: 2023-04-25
Description: An HPE OneView appliance dump may expose proxy credential settings
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE: CVE-2023-28087
Published: 2023-04-25
Description: An HPE OneView appliance dump may expose OneView user accounts
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE: CVE-2023-28088
Published: 2023-04-25
Description: An HPE OneView appliance dump may expose SAN switch administrative credentials
CVSS Score: 7.8 (HIGH)
CWE: CWE-522, CWE-522
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE: CVE-2023-28089
Published: 2023-04-25
Description: An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules
CVSS Score: 7.1 (HIGH)
CWE: CWE-522, CWE-522
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE: CVE-2023-28090
Published: 2023-04-25
Description: An HPE OneView appliance dump may expose SNMPv3 read credentials
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE: CVE-2023-2282
Published: 2023-04-25
Description: Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector.

CVSS Score: 6.5 (MEDIUM)
References: https://devolutions.net/security/advisories/DEVO-2023-0012; https://devolutions.net/security/advisories/DEVO-2023-0012
CVE: CVE-2023-30838
Published: 2023-04-25
Description: PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pre-setup `@keyframes` methods. This XSS, which hijacks HTML attributes, can be triggered without any interaction by the visitor/administrator, which makes it as dangerous as a trivial XSS attack. Contrary to other attacks which target HTML attributes and are triggered without user interaction (such as onload / onerror which suffer from a very limited scope), this one can hijack every HTML element, which increases the danger due to a complete HTML elements scope. Versions 8.0.4 and 1.7.8.9 contain a fix for this issue.
CVSS Score: 8.5 (HIGH)
CWE: CWE-79
References: https://github.com/PrestaShop/PrestaShop/commit/46408ae4b02f3b8b1bb6e9dc63af5bcd858abd9c; https://github.com/PrestaShop/PrestaShop/commit/dc682192df0e4b0d656a8e645b29ca1b9dbe3693; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fh7r-996q-gvcp
CVE: CVE-2023-30839
Published: 2023-04-25
Description: PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/PrestaShop/PrestaShop/commit/0f2a9b7fdd42d1dd3b21d4fad586a849642f3c30; https://github.com/PrestaShop/PrestaShop/commit/d1d27dc371599713c912b71bc2a455cacd7f2149; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-p379-cxqh-q822
CVE: CVE-2023-23710
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/miniorange-login-openid/wordpress-wordpress-social-login-and-register-discord-google-twitter-linkedin-plugin-7-5-14-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/miniorange-login-openid/wordpress-wordpress-social-login-and-register-discord-google-twitter-linkedin-plugin-7-5-14-cross-site-scripting-xss-vulnerability?_s_id=cve