deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27172
Published: 2023-12-20
Description: Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sign JWT tokens via a bruteforce attack.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://balwurk.github.io/CVE-2023-27172/; https://balwurk.github.io/CVE-2023-27172/
CVE: CVE-2023-47704
Published: 2023-12-20
Description: IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository.  IBM X-Force ID:  271220.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271220; https://www.ibm.com/support/pages/node/7091157; https://exchange.xforce.ibmcloud.com/vulnerabilities/271220
CVE: CVE-2023-47706
Published: 2023-12-20
Description: IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type.  IBM X-Force ID:  271341.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271341; https://www.ibm.com/support/pages/node/7091157; https://exchange.xforce.ibmcloud.com/vulnerabilities/271341
CVE: CVE-2023-47702
Published: 2023-12-20
Description: IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view modify files on the system.  IBM X-Force ID:  271196.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271196; https://www.ibm.com/support/pages/node/7091157; https://exchange.xforce.ibmcloud.com/vulnerabilities/271196
CVE: CVE-2023-47703
Published: 2023-12-20
Description: IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  271197.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271197; https://www.ibm.com/support/pages/node/7091157; https://exchange.xforce.ibmcloud.com/vulnerabilities/271197
CVE: CVE-2023-47705
Published: 2023-12-20
Description: IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation.  IBM X-Force ID:  271228.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271228; https://www.ibm.com/support/pages/node/7091157; https://exchange.xforce.ibmcloud.com/vulnerabilities/271228
CVE: CVE-2023-47707
Published: 2023-12-20
Description: IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  271522.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271522; https://www.ibm.com/support/pages/node/7091157; https://exchange.xforce.ibmcloud.com/vulnerabilities/271522
CVE: CVE-2023-6974
Published: 2023-12-20
Description: A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/mlflow/mlflow/commit/8174250f83352a04c2d42079f[PII_REDACTED]58555; https://huntr.com/bounties/438b0524-da0e-4d08-976a-6f270c688393; https://github.com/mlflow/mlflow/commit/8174250f83352a04c2d42079f[PII_REDACTED]58555
CVE: CVE-2023-6975
Published: 2023-12-20
Description: A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-29
References: https://github.com/mlflow/mlflow/commit/b9ab9ed77e1deda9697fe472fb1079fd428149ee; https://huntr.com/bounties/029a3824-cee3-4cf1-b260-7138aa539b85; https://github.com/mlflow/mlflow/commit/b9ab9ed77e1deda9697fe472fb1079fd428149ee
CVE: CVE-2023-6976
Published: 2023-12-20
Description: This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/mlflow/mlflow/commit/5044878da0c1851ccfdd5c0a867157ed9a502fbc; https://huntr.com/bounties/2408a52b-f05b-4cac-9765-4f74bac3f20f; https://github.com/mlflow/mlflow/commit/5044878da0c1851ccfdd5c0a867157ed9a502fbc
CVE: CVE-2023-6977
Published: 2023-12-20
Description: This vulnerability enables malicious users to read sensitive files on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-29
References: https://github.com/mlflow/mlflow/commit/4bd7f27c810ba7487d53ed5ef1038fca0f8dc28c; https://huntr.com/bounties/fe53bf71-3687-4711-90df-c26172880aaf; https://github.com/mlflow/mlflow/commit/4bd7f27c810ba7487d53ed5ef1038fca0f8dc28c
CVE: CVE-2023-0011
Published: 2023-12-20
Description: A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial interface to send malicious AT commands.




Exploitation of the vulnerability gives full administrative (root) privileges to the attacker to execute any operating system command on TOBY-L2 which can lead to modification of the behavior of the module itself as well as the components connected with it (depending on its rights on other connected systems). It can further provide the ability to read system level files and hamper the availability of the module as well..




This issue affects TOBY-L2 series: TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220, TOBY-L280.


CVSS Score: 7.6 (HIGH)
CWE: CWE-20, CWE-78
References: https://www.u-blox.com/en/report-security-issues; https://www.u-blox.com/en/report-security-issues
CVE: CVE-2023-37544
Published: 2023-12-20
Description: Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.

This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.

The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.

2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5.
2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2.
3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1.
3.1 Pulsar WebSocket Proxy users are unaffected.
Any users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2023/12/20/2; https://lists.apache.org/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m; http://www.openwall.com/lists/oss-security/2023/12/20/2
CVE: CVE-2023-50044
Published: 2023-12-20
Description: Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/cesanta/mjs/issues/254; https://github.com/cesanta/mjs/pull/255; https://github.com/cesanta/mjs/issues/254
CVE: CVE-2023-50628
Published: 2023-12-20
Description: Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive information via parser.c component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/libming/libming/issues/289; https://github.com/libming/libming/pull/290; https://github.com/libming/libming/issues/289
CVE: CVE-2023-6768
Published: 2023-12-20
Description: Authentication bypass vulnerability in Amazing Little Poll affecting versions 1.3 and 1.4. This vulnerability could allow an unauthenticated user to access the admin panel without providing any credentials by simply accessing the "lp_admin.php?adminstep=" parameter.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-287
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amazing-little-poll; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amazing-little-poll
CVE: CVE-2023-6769
Published: 2023-12-20
Description: Stored XSS vulnerability in Amazing Little Poll, affecting versions 1.3 and 1.4. This vulnerability allows a remote attacker to store a malicious JavaScript payload in the "lp_admin.php" file in the "question" and "item" parameters. This vulnerability could lead to malicious JavaScript execution while the page is loading.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amazing-little-poll; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amazing-little-poll
CVE: CVE-2023-6910
Published: 2023-12-20
Description: A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point where the server can no longer serve requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://empower.m-files.com/security-advisories/CVE-2023-6910; https://product.m-files.com/security-advisories/cve-2023-6910/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6910
CVE: CVE-2023-6912
Published: 2023-12-20
Description: Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-307
References: https://empower.m-files.com/security-advisories/CVE-2023-6912; https://product.m-files.com/security-advisories/cve-2023-6912/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6912/
CVE: CVE-2023-6562
Published: 2023-12-20
Description: JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the attacker to upload a specially-crafted the image that is displayed back to the attacker.

CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-434
References: https://github.com/google/security-research/security/advisories/GHSA-g6qc-fhcq-vhf9; https://github.com/google/security-research/security/advisories/GHSA-g6qc-fhcq-vhf9
CVE: CVE-2023-37871
Published: 2023-12-20
Description: Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.
CVSS Score: 8.2 (HIGH)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/woocommerce-gateway-gocardless/wordpress-woocommerce-gocardless-gateway-plugin-2-5-6-unauthenticated-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-gateway-gocardless/wordpress-woocommerce-gocardless-gateway-plugin-2-5-6-unauthenticated-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2023-38513
Published: 2023-12-20
Description: Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media Organizer & Lightroom): from n/a through 6.2.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/wplr-sync/wordpress-photo-engine-plugin-6-2-5-insecure-direct-object-references-idor?_s_id=cve; https://patchstack.com/database/vulnerability/wplr-sync/wordpress-photo-engine-plugin-6-2-5-insecure-direct-object-references-idor?_s_id=cve
CVE: CVE-2023-38519
Published: 2023-12-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance.This issue affects MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: from n/a through 4.4.3.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/mainwp/wordpress-mainwp-plugin-4-4-3-3-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mainwp/wordpress-mainwp-plugin-4-4-3-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-40555
Published: 2023-12-20
Description: Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.
CVSS Score: 8.3 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/flatsome/wordpress-flatsome-theme-3-17-5-unauthenticated-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/flatsome/wordpress-flatsome-theme-3-17-5-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-41796
Published: 2023-12-20
Description: Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/sunshine-photo-cart/wordpress-sunshine-photo-cart-plugin-2-9-25-order-manipulation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sunshine-photo-cart/wordpress-sunshine-photo-cart-plugin-2-9-25-order-manipulation-vulnerability?_s_id=cve
CVE: CVE-2023-46147
Published: 2023-12-20
Description: Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
CVSS Score: 7.4 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/themify-ultra/wordpress-themify-ultra-theme-7-3-3-authenticated-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/themify-ultra/wordpress-themify-ultra-theme-7-3-3-authenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-46311
Published: 2023-12-20
Description: Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3.
CVSS Score: 2.7 (LOW)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-6-3-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-6-3-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2023-47236
Published: 2023-12-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum iPages Flipbook For WordPress.This issue affects iPages Flipbook For WordPress: from n/a through 1.4.8.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/ipages-flipbook/wordpress-ipages-flipbook-for-wordpress-plugin-1-4-8-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ipages-flipbook/wordpress-ipages-flipbook-for-wordpress-plugin-1-4-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-47507
Published: 2023-12-20
Description: Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/masterslider/wordpress-master-slider-pro-plugin-3-6-5-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/masterslider/wordpress-master-slider-pro-plugin-3-6-5-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-50249
Published: 2023-12-20
Description: Sentry-Javascript is official Sentry SDKs for JavaScript. A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry's Astro SDK 7.78.0-7.86.0. Under certain conditions, this vulnerability allows an attacker to cause excessive computation times on the server, leading to denial of service (DoS). This vulnerability has been patched in sentry/astro version 7.87.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://github.com/getsentry/sentry-javascript/commit/fe24eb5eefa9d27b14b2b6f9ebd1debca1c208fb; https://github.com/getsentry/sentry-javascript/pull/9815; https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-x3v3-8xg8-8v72
CVE: CVE-2023-51457
Published: 2023-12-20
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-51458
Published: 2023-12-20
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-51459
Published: 2023-12-20
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-51460
Published: 2023-12-20
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-51461
Published: 2023-12-20
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-51462
Published: 2023-12-20
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-6784
Published: 2023-12-20
Description: 
A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2023-6784-December-2023; https://www.progress.com/sitefinity-cms; https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2023-6784-December-2023
CVE: CVE-2023-28782
Published: 2023-12-20
Description: Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3.
CVSS Score: 8.3 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/gravityforms/wordpress-gravity-forms-plugin-2-7-3-unauthenticated-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gravityforms/wordpress-gravity-forms-plugin-2-7-3-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-32590
Published: 2023-12-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category.This issue affects Subscribe to Category: from n/a through 2.7.4.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/vulnerability/subscribe-to-category/wordpress-subscribe-to-category-plugin-2-7-4-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/subscribe-to-category/wordpress-subscribe-to-category-plugin-2-7-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-35876
Published: 2023-12-20
Description: Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/woocommerce-square/wordpress-woocommerce-square-plugin-3-8-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-square/wordpress-woocommerce-square-plugin-3-8-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2023-35895
Published: 2023-12-20
Description: IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API.  IBM X-Force ID:  259116.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78, CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/259116; https://www.ibm.com/support/pages/node/7099762; https://exchange.xforce.ibmcloud.com/vulnerabilities/259116
CVE: CVE-2023-36520
Published: 2023-12-20
Description: Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://patchstack.com/database/vulnerability/editorial-calendar/wordpress-editorial-calendar-plugin-3-7-12-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/editorial-calendar/wordpress-editorial-calendar-plugin-3-7-12-insecure-direct-object-references-idor-vulnerability?_s_id=cve