deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27396
Published: 2023-06-19
Description: FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues -- (1)Plaintext communication, and (2)No authentication required. When FINS messages are intercepted, the contents may be retrieved. When arbitrary FINS messages are injected, any commands may be executed on, or the system information may be retrieved from, the affected device. Affected products and versions are as follows: SYSMAC CS-series CPU Units, all versions, SYSMAC CJ-series CPU Units, all versions, SYSMAC CP-series CPU Units, all versions, SYSMAC NJ-series CPU Units, all versions, SYSMAC NX1P-series CPU Units, all versions, SYSMAC NX102-series CPU Units, all versions, and SYSMAC NX7 Database Connection CPU Units (Ver.1.16 or later)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://jvn.jp/en/ta/JVNTA91513661/; https://jvn.jp/ta/JVNTA91513661/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02
CVE: CVE-2023-30759
Published: 2023-06-19
Description: The driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to detect its modification and may spawn an unexpected process with the administrative privilege. If a non-administrative user modifies the driver installation package and runs it on the target PC, an arbitrary program may be executed with the administrative privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-345, CWE-352
References: https://jvn.jp/en/vu/JVNVU92207133/; https://www.ricoh.com/products/security/vulnerabilities/adv?id=ricoh-prod[PII_REDACTED]-000001; https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2023-000001
CVE: CVE-2023-31239
Published: 2023-06-19
Description: Stack-based buffer overflow vulnerability in V-Server v4.0.15.0 and V-Server Lite v4.0.15.0 and earlier allows an attacker to execute arbitrary code by having user open a specially crafted VPR file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://jvn.jp/en/vu/JVNVU98818508/; https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php; https://jvn.jp/en/vu/JVNVU98818508/
CVE: CVE-2023-32201
Published: 2023-06-19
Description: Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted SIM2 file may lead to information disclosure and/or arbitrary code execution. This vulnerability is different from CVE-2023-32538 and CVE-2023-32273.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://jvn.jp/en/vu/JVNVU98818508/; https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php; https://jvn.jp/en/vu/JVNVU98818508/
CVE: CVE-2023-32270
Published: 2023-06-19
Description: Access of memory location after end of buffer issue exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-125
References: https://jvn.jp/en/vu/JVNVU98818508/; https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php; https://jvn.jp/en/vu/JVNVU98818508/
CVE: CVE-2023-32273
Published: 2023-06-19
Description: Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted SIM2 file may lead to information disclosure and/or arbitrary code execution. This vulnerability is different from CVE-2023-32538 and CVE-2023-32201.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://jvn.jp/en/vu/JVNVU98818508/; https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php; https://jvn.jp/en/vu/JVNVU98818508/
CVE: CVE-2023-32276
Published: 2023-06-19
Description: Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://jvn.jp/en/vu/JVNVU98818508/; https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php; https://jvn.jp/en/vu/JVNVU98818508/
CVE: CVE-2023-32288
Published: 2023-06-19
Description: Out-of-bounds read vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted SIM file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://jvn.jp/en/vu/JVNVU98818508/; https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php; https://jvn.jp/en/vu/JVNVU98818508/
CVE: CVE-2023-32538
Published: 2023-06-19
Description: Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted SIM2 file may lead to information disclosure and/or arbitrary code execution. This vulnerability is different from CVE-2023-32273 and CVE-2023-32201.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://jvn.jp/en/vu/JVNVU98818508/; https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php; https://jvn.jp/en/vu/JVNVU98818508/
CVE: CVE-2023-32542
Published: 2023-06-19
Description: Out-of-bounds read vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://jvn.jp/en/vu/JVNVU98818508/; https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php; https://jvn.jp/en/vu/JVNVU98818508/
CVE: CVE-2023-34641
Published: 2023-06-19
Description: KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function window.print() which can then be used to open an unprivileged command prompt.
CVSS Score: 7.8 (HIGH)
References: https://github.com/huntergregal/CVE/tree/main/CVE-2023-34641; https://github.com/huntergregal/CVE/tree/main/TBD-KIOWARE-001; https://www.kioware.com/versionhistory.aspx?pid=15
CVE: CVE-2023-34642
Published: 2023-06-19
Description: KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function showDirectoryPicker() which can then be used to open an unprivileged command prompt.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/huntergregal/CVE/tree/main/CVE-2023-34642; https://github.com/huntergregal/CVE/tree/main/TBD-KIOWARE-002; https://www.kioware.com/versionhistory.aspx?pid=15
CVE: CVE-2023-35862
Published: 2023-06-19
Description: libcoap 4.3.1 contains a buffer over-read via the function coap_parse_oscore_conf_mem at coap_oscore.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/obgm/libcoap/issues/1117; https://github.com/obgm/libcoap/pull/1118; https://github.com/obgm/libcoap/tags
CVE: CVE-2023-34602
Published: 2023-06-19
Description: JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.SystemApiController.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/jeecgboot/jeecg-boot/issues/4983; https://github.com/jeecgboot/jeecg-boot/issues/4983
CVE: CVE-2023-34603
Published: 2023-06-19
Description: JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller.SystemApiController.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/jeecgboot/jeecg-boot/issues/4984; https://github.com/jeecgboot/jeecg-boot/issues/4984
CVE: CVE-2023-35866
Published: 2023-06-19
Description: In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is "asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/keepassxreboot/keepassxc/issues/9339; https://github.com/keepassxreboot/keepassxc/issues/9339#issuecomment[PII_REDACTED]; https://github.com/keepassxreboot/keepassxc/issues/9391
CVE: CVE-2023-35005
Published: 2023-06-19
Description: In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.

This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive.


This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.



CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/apache/airflow/pull/31788; https://github.com/apache/airflow/pull/31820; https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd
CVE: CVE-2023-29531
Published: 2023-06-19
Description: An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash.

*This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1794292; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://www.mozilla.org/security/advisories/mfsa2023-14/
CVE: CVE-2023-29532
Published: 2023-06-19
Description: A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server.

*Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.


CVSS Score: 5.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1806394; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://www.mozilla.org/security/advisories/mfsa2023-14/
CVE: CVE-2023-32208
Published: 2023-06-19
Description: Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.
CVSS Score: 5.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1646034; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-16/
CVE: CVE-2023-32209
Published: 2023-06-19
Description: A maliciously crafted favicon could have led to an out of memory crash. This vulnerability affects Firefox < 113.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1767194; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-16/
CVE: CVE-2023-32210
Published: 2023-06-19
Description: Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately privileged principal. In certain circumstances it might have been possible to cause a document to be loaded with a higher privileged principal than intended. This vulnerability affects Firefox < 113.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1776755; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-16/
CVE: CVE-2023-32214
Published: 2023-06-19
Description: Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service.
*Note: This attack only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVSS Score: 7.5 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1828716; https://security.gentoo.org/glsa/202312-03; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-32216
Published: 2023-06-19
Description: Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746479%2C1806852%2C1815987%2C1820359%2C1823568%2C1824803%2C1824834%2C1825170%2C1827020%2C1828130; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-16/
CVE: CVE-2019-25136
Published: 2023-06-19
Description: A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox escape. This vulnerability affects Firefox < 70.
CVSS Score: 10.0 (CRITICAL)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1530709; https://www.mozilla.org/security/advisories/mfsa2019-34/; https://bugzilla.mozilla.org/show_bug.cgi?id=1530709
CVE: CVE-2023-0368
Published: 2023-06-19
Description: The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b41e5c09-1034-48a7-ac0f-d4db6e7a3b3e; https://wpscan.com/vulnerability/b41e5c09-1034-48a7-ac0f-d4db6e7a3b3e
CVE: CVE-2023-0489
Published: 2023-06-19
Description: The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/238842ee-6392-4eb2-96cb-08e4ece6fca1; https://wpscan.com/vulnerability/238842ee-6392-4eb2-96cb-08e4ece6fca1
CVE: CVE-2023-25733
Published: 2023-06-19
Description: The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox < 110.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252, CWE-252
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1808632; https://www.mozilla.org/security/advisories/mfsa2023-05/; https://bugzilla.mozilla.org/show_bug.cgi?id=1808632
CVE: CVE-2023-25736
Published: 2023-06-19
Description: An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability affects Firefox < 110.
CVSS Score: 9.8 (CRITICAL)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1811331; https://www.mozilla.org/security/advisories/mfsa2023-05/; https://bugzilla.mozilla.org/show_bug.cgi?id=1811331
CVE: CVE-2023-25747
Published: 2023-06-19
Description: A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 110.1.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1815801; https://www.mozilla.org/security/advisories/mfsa2023-08/; https://bugzilla.mozilla.org/show_bug.cgi?id=1815801
CVE: CVE-2023-29534
Published: 2023-06-19
Description: Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android.  These could have led to potential user confusion and spoofing attacks.

*This bug only affects Firefox and Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.


CVSS Score: 9.1 (CRITICAL)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1816007; https://bugzilla.mozilla.org/show_bug.cgi?id=1816059; https://bugzilla.mozilla.org/show_bug.cgi?id=1821155
CVE: CVE-2023-29542
Published: 2023-06-19
Description: A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk  with .download. This could have led to accidental execution of malicious code.

*This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.


CVSS Score: 9.8 (CRITICAL)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1810793; https://bugzilla.mozilla.org/show_bug.cgi?id=1815062; https://www.mozilla.org/security/advisories/mfsa2023-13/
CVE: CVE-2023-29545
Published: 2023-06-19
Description: Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. 

*This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.


CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1823077; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://www.mozilla.org/security/advisories/mfsa2023-14/
CVE: CVE-2023-29546
Published: 2023-06-19
Description: When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive information. 

*This bug only affects Firefox for Android. Other operating systems are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.


CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1780842; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1780842
CVE: CVE-2023-2221
Published: 2023-06-19
Description: The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/6666688e-7239-4d40-a348-307cf8f3b657; https://wpscan.com/vulnerability/6666688e-7239-4d40-a348-307cf8f3b657; https://wpscan.com/vulnerability/6666688e-7239-4d40-a348-307cf8f3b657/
CVE: CVE-2023-2359
Published: 2023-06-19
Description: The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://wpscan.com/vulnerability/a8350890-e6d4-4b04-a158-2b0ee3748e65; https://wpscan.com/vulnerability/a8350890-e6d4-4b04-a158-2b0ee3748e65; https://wpscan.com/vulnerability/a8350890-e6d4-4b04-a158-2b0ee3748e65/
CVE: CVE-2023-2399
Published: 2023-06-19
Description: The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/deca3cd3-f7cf-469f-9f7e-3612f7ae514d; https://wpscan.com/vulnerability/deca3cd3-f7cf-469f-9f7e-3612f7ae514d; https://wpscan.com/vulnerability/deca3cd3-f7cf-469f-9f7e-3612f7ae514d/
CVE: CVE-2023-2401
Published: 2023-06-19
Description: The QuBot WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/0746ea56-dd88-4fc3-86a3-54408eef1f94; https://wpscan.com/vulnerability/0746ea56-dd88-4fc3-86a3-54408eef1f94
CVE: CVE-2023-2492
Published: 2023-06-19
Description: The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/fa7c54c2-5653-4d3d-8163-f3d63272c050; https://wpscan.com/vulnerability/fa7c54c2-5653-4d3d-8163-f3d63272c050; https://wpscan.com/vulnerability/fa7c54c2-5653-4d3d-8163-f3d63272c050/
CVE: CVE-2023-2527
Published: 2023-06-19
Description: The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8051142a-4e55-4dc2-9cb1-1b724c67574f; https://wpscan.com/vulnerability/8051142a-4e55-4dc2-9cb1-1b724c67574f; https://wpscan.com/vulnerability/8051142a-4e55-4dc2-9cb1-1b724c67574f/
CVE: CVE-2023-2600
Published: 2023-06-19
Description: The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/8e1d65c3-14e4-482f-ae9e-323e847a8613; https://wpscan.com/vulnerability/8e1d65c3-14e4-482f-ae9e-323e847a8613
CVE: CVE-2023-2654
Published: 2023-06-19
Description: The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/506ecee9-8e42-46de-9c5c-fc252ab2646e; https://wpscan.com/vulnerability/506ecee9-8e42-46de-9c5c-fc252ab2646e
CVE: CVE-2023-2684
Published: 2023-06-19
Description: The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/42b1f017-c497-4825-b12a-8dce3e108a55; https://wpscan.com/vulnerability/42b1f017-c497-4825-b12a-8dce3e108a55
CVE: CVE-2023-2719
Published: 2023-06-19
Description: The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/d9f6f4e7-a237-49c0-aba0-2934ab019e35; https://wpscan.com/vulnerability/d9f6f4e7-a237-49c0-aba0-2934ab019e35; https://wpscan.com/vulnerability/d9f6f4e7-a237-49c0-aba0-2934ab019e35/