deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-25489
Published: 2023-10-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Update Theme and Plugins from Zip File plugin <= 2.0.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/update-theme-and-plugins-from-zip-file/wordpress-update-theme-and-plugins-from-zip-file-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/update-theme-and-plugins-from-zip-file/wordpress-update-theme-and-plugins-from-zip-file-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25788
Published: 2023-10-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Saphali Saphali Woocommerce Lite plugin <= 1.8.13 versions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/saphali-woocommerce-lite/wordpress-saphali-woocommerce-lite-plugin-1-8-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/saphali-woocommerce-lite/wordpress-saphali-woocommerce-lite-plugin-1-8-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25980
Published: 2023-10-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin <= 5.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/rvg-optimize-database/wordpress-optimize-database-after-deleting-revisions-plugin-5-0-110-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rvg-optimize-database/wordpress-optimize-database-after-deleting-revisions-plugin-5-0-110-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-2422
Published: 2023-10-04
Description: A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://access.redhat.com/errata/RHSA-2023:3883; https://access.redhat.com/errata/RHSA-2023:3884; https://access.redhat.com/errata/RHSA-2023:3885
CVE: CVE-2023-2809
Published: 2023-10-04
Description: Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. This vulnerability could be linked to known techniques to obtain remote execution of MS SQL commands and escalate privileges on Windows systems because the credentials are stored in plaintext.
CVSS Score: 7.8 (HIGH)
CWE: CWE-312, CWE-312
References: https://www.incibe.es/en/incibe-cert/notices/aviso/use-cleartext-credentials-sage-200; https://www.incibe.es/en/incibe-cert/notices/aviso/use-cleartext-credentials-sage-200
CVE: CVE-2023-37995
Published: 2023-10-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-copyprotect/wordpress-wp-copyprotect-protect-your-blog-posts-plugin-3-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-copyprotect/wordpress-wp-copyprotect-protect-your-blog-posts-plugin-3-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-3512
Published: 2023-10-04
Description: Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://https://www.incibe.es/en/incibe-cert/notices/aviso/relative-path-traversal-setelsa-security-conacwin; https://github.com/advisories/GHSA-v6jm-v768-76h2; https://https://www.incibe.es/en/incibe-cert/notices/aviso/relative-path-traversal-setelsa-security-conacwin
CVE: CVE-2023-3701
Published: 2023-10-04
Description: Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify the source and configuration files of the cloud disk platform, affecting the integrity and availability of the entire platform.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-23, CWE-22
References: https://www.incibe.es/en/incibe-cert/notices/aviso/relative-path-traversal-aqua-esolutions; https://www.incibe.es/en/incibe-cert/notices/aviso/relative-path-traversal-aqua-esolutions
CVE: CVE-2023-4586
Published: 2023-10-04
Description: A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20, CWE-295
References: https://access.redhat.com/errata/RHSA-2023:7676; https://access.redhat.com/security/cve/CVE-2023-4586; https://bugzilla.redhat.com/show_bug.cgi?id=2235564
CVE: CVE-2023-4997
Published: 2023-10-04
Description: Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users including administrators leading to a privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://cert.pl/en/posts/2023/10/CVE-2023-4997/; https://cert.pl/posts/2023/10/CVE-2023-4997/; https://cert.pl/en/posts/2023/10/CVE-2023-4997/
CVE: CVE-2022-4132
Published: 2023-10-04
Description: A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting the login page).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://access.redhat.com/security/cve/CVE-2022-4132; https://bugzilla.redhat.com/show_bug.cgi?id=2147372; https://access.redhat.com/security/cve/CVE-2022-4132
CVE: CVE-2023-22618
Published: 2023-10-04
Description: If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://nokia.com; https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/; https://nokia.com
CVE: CVE-2023-3037
Published: 2023-10-04
Description: Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to access the platform without authentication and retrieve personal data via the jsonGrid parameter.
CVSS Score: 8.6 (HIGH)
CWE: CWE-285
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-helpdezk-community; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-helpdezk-community
CVE: CVE-2023-3038
Published: 2023-10-04
Description: SQL injection vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the rows parameter of the jsonGrid route and extract all the information stored in the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-helpdezk-community; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-helpdezk-community
CVE: CVE-2023-3153
Published: 2023-10-04
Description: A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://access.redhat.com/security/cve/CVE-2023-3153; https://bugzilla.redhat.com/show_bug.cgi?id=2213279; https://github.com/ovn-org/ovn/commit/9a3f7ed905e525ebdcb14541e775211cbb0203bd
CVE: CVE-2023-3361
Published: 2023-10-04
Description: A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200, CWE-319
References: https://access.redhat.com/security/cve/CVE-2023-3361; https://bugzilla.redhat.com/show_bug.cgi?id=2216588; https://github.com/opendatahub-io/odh-dashboard/issues/1415
CVE: CVE-2023-43261
Published: 2023-10-04
Description: An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: http://milesight.com; http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html; http://ur5x.com
CVE: CVE-2023-44208
Published: 2023-10-04
Description: Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713, Acronis True Image OEM (Windows) before build 42575.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-6587; https://security-advisory.acronis.com/advisories/SEC-6587
CVE: CVE-2023-4037
Published: 2023-10-04
Description: Blind SQL injection vulnerability in the Conacwin 3.7.1.2 web interface, the exploitation of which could allow a local attacker to obtain sensitive data stored in the database by sending a specially crafted SQL query to the xml parameter.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-setelsa-security-conacwin; https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-setelsa-security-conacwin
CVE: CVE-2023-4090
Published: 2023-10-04
Description: Cross-site Scripting (XSS) reflected vulnerability on WideStand until 5.3.5 version, which generates one of the meta tags directly using the content of the queried URL, which would allow an attacker to inject HTML/Javascript code into the response.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-widestand-cms-acilia; https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-widestand-cms-acilia
CVE: CVE-2023-4491
Published: 2023-10-04
Description: Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long username string to /searchbook.ghp, asking for the name via a POST request, resulting in arbitrary code execution on the remote machine.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-119
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE: CVE-2023-4492
Published: 2023-10-04
Description: Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters (firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate and workzip) of the /addrbook.ghp file, allowing an attacker to inject a JavaScript payload specially designed to run when the application is loaded
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE: CVE-2023-4493
Published: 2023-10-04
Description: Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the users_admin.ghp file that affects multiple parameters such as (firstname, homephone, lastname, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, workzip). This vulnerability allows a remote attacker to store a malicious JavaScript payload in the application to be executed when the page is loaded, resulting in an integrity impact.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE: CVE-2023-4494
Published: 2023-10-04
Description: Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file asking for the name via a GET request resulting in arbitrary code execution on the remote machine.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-119
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE: CVE-2023-4495
Published: 2023-10-04
Description: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Resume parameter. The XSS is loaded from /register.ghp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE: CVE-2023-4496
Published: 2023-10-04
Description: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /body2.ghp (POST method), in the mtowho parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE: CVE-2023-4497
Published: 2023-10-04
Description: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Icon parameter. The XSS is loaded from /users.ghp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE: CVE-2023-5373
Published: 2023-10-04
Description: A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is the function register of the file Master.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-241254 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Szlllc/Cve/blob/main/Computer%20and%20Laptop%20Store%20System%20Master.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.241254; https://vuldb.com/?id.241254
CVE: CVE-2022-43906
Published: 2023-10-04
Description: IBM Security Guardium 11.5 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie.  IBM X-Force ID:  240897.
CVSS Score: 3.1 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240897; https://https://www.ibm.com/support/pages/node/7038019; https://exchange.xforce.ibmcloud.com/vulnerabilities/240897
CVE: CVE-2023-1832
Published: 2023-10-04
Description: An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://access.redhat.com/security/cve/CVE-2023-1832; https://bugzilla.redhat.com/show_bug.cgi?id=2184364; https://access.redhat.com/security/cve/CVE-2023-1832
CVE: CVE-2023-22515
Published: 2023-10-04
Description: Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. 

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html; https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]
CVE: CVE-2023-25025
Published: 2023-10-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-copyprotect/wordpress-wp-copyprotect-protect-your-blog-posts-plugin-3-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-copyprotect/wordpress-wp-copyprotect-protect-your-blog-posts-plugin-3-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27433
Published: 2023-10-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Make Paths Relative allows Cross Site Request Forgery.This issue affects Make Paths Relative: from n/a through 1.3.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/make-paths-relative/wordpress-make-paths-relative-plugin-1-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/make-paths-relative/wordpress-make-paths-relative-plugin-1-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-40376
Published: 2023-10-04
Description: IBM UrbanCode Deploy (UCD) 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make changes to environment variables due to improper authentication controls.  IBM X-Force ID:  263581.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/263581; https://www.ibm.com/support/pages/node/7037230; https://exchange.xforce.ibmcloud.com/vulnerabilities/263581
CVE: CVE-2023-40561
Published: 2023-10-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <= 3.7.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-ecommerce-tracking-for-google-and-facebook/wordpress-enhanced-ecommerce-google-analytics-for-woocommerce-plugin-3-7-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-ecommerce-tracking-for-google-and-facebook/wordpress-enhanced-ecommerce-google-analytics-for-woocommerce-plugin-3-7-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-40684
Published: 2023-10-04
Description: IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  264019.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/264019; https://https://www.ibm.com/support/pages/node/7046226; https://exchange.xforce.ibmcloud.com/vulnerabilities/264019
CVE: CVE-2023-4567
Published: 2023-10-04
Description: Rejected reason: Issue has been found to be non-reproducible, therefore not a viable flaw.
CVE: CVE-2023-5374
Published: 2023-10-04
Description: A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functionality of the file products.php. The manipulation of the argument c leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241255.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Computer%20and%20Laptop%20Store%20System%20products.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.241255; https://vuldb.com/?id.241255
CVE: CVE-2023-3665
Published: 2023-10-04
Description: 
A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables,
leading to denial of service and or the execution of arbitrary code.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74, CWE-94
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10405; https://kcm.trellix.com/corporate/index?page=content&id=SB10405
CVE: CVE-2023-3971
Published: 2023-10-04
Description: An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
CVSS Score: 7.3 (HIGH)
CWE: CWE-80, CWE-79
References: https://access.redhat.com/errata/RHSA-2023:4340; https://access.redhat.com/errata/RHSA-2023:4590; https://access.redhat.com/security/cve/CVE-2023-3971
CVE: CVE-2023-40559
Published: 2023-10-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <= 2.4.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-conditional-discount-rules-for-checkout/wordpress-dynamic-pricing-and-discount-rules-for-woocommerce-plugin-2-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-conditional-discount-rules-for-checkout/wordpress-dynamic-pricing-and-discount-rules-for-woocommerce-plugin-2-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-4237
Published: 2023-10-04
Description: A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-497
References: https://access.redhat.com/errata/RHBA-2023:5653; https://access.redhat.com/errata/RHBA-2023:5666; https://access.redhat.com/security/cve/CVE-2023-4237