deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1122
Published: 2023-04-10
Description: The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/71f5d630-2726-48c7-b9e5-7bebc786b561; https://wpscan.com/vulnerability/71f5d630-2726-48c7-b9e5-7bebc786b561
CVE: CVE-2023-1406
Published: 2023-04-10
Description: The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://wpscan.com/vulnerability/2a81b6b1-2339-4889-9c28-1af133df8b65; https://wpscan.com/vulnerability/2a81b6b1-2339-4889-9c28-1af133df8b65
CVE: CVE-2023-1425
Published: 2023-04-10
Description: The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/578f4179-e7be-4963-9379-5e694911b451; https://wpscan.com/vulnerability/578f4179-e7be-4963-9379-5e694911b451
CVE: CVE-2023-1426
Published: 2023-04-10
Description: The WP Tiles WordPress plugin through 1.1.2 does not ensure that posts to be displayed are not draft/private, allowing any authenticated users, such as subscriber to retrieve the titles of draft and privates posts for example. AN attacker could also retrieve the title of any other type of post.
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/fdd79bb4-d434-4635-bb2b-84d079ecc746; https://wpscan.com/vulnerability/fdd79bb4-d434-4635-bb2b-84d079ecc746
CVE: CVE-2023-1478
Published: 2023-04-10
Description: The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path traversal vulnerability in the page cache module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://wpscan.com/vulnerability/512a9ba4-01c0-4614-a991-efdc7fe51abe; https://wpscan.com/vulnerability/512a9ba4-01c0-4614-a991-efdc7fe51abe
CVE: CVE-2023-24181
Published: 2023-04-10
Description: LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ABB-EL/external-vulnerability-disclosures/security/advisories/GHSA-9gqg-pp5p-q9hg; https://github.com/openwrt/luci/commit/25983b9fa572a640a7ecd077378df2790266cd61; https://github.com/openwrt/luci/commit/749268a2cad4a08722e30f66a578e254885f450f
CVE: CVE-2023-25392
Published: 2023-04-10
Description: Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://github.com/allegro/bigflow/pull/357; https://lutrasecurity.com/en/articles/cve-2023-25392/; https://github.com/allegro/bigflow/pull/357
CVE: CVE-2022-41976
Published: 2023-04-10
Description: An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build[PII_REDACTED] allows remote attackers, authenticated in the application as a low-privileged user to change role (e.g., to administrator) by updating their user profile.
CVSS Score: 9.9 (CRITICAL)
References: http://scada-lts.org/; https://github.com/SCADA-LTS/Scada-LTS/releases; https://m3n0sd0n4ld.blogspot.com/2022/11/scada-lts-privilege-escalation-cve-2022.html
CVE: CVE-2023-1381
Published: 2023-04-10
Description: The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/; https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536; https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/
CVE: CVE-2023-29375
Published: 2023-04-10
Description: An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potentially dangerous file upload through the SharePoint connector.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-April-2023; https://www.progress.com/sitefinity-cms; https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-April-2023
CVE: CVE-2023-29376
Published: 2023-04-10
Description: An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potential XSS by privileged users in Sitefinity to media libraries.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-April-2023; https://www.progress.com/sitefinity-cms; https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-April-2023
CVE: CVE-2023-1969
Published: 2023-04-10
Description: A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects unknown code of the file /admin/inventory/manage_stock.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-225406 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Gear-D/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.225406; https://vuldb.com/?id.225406
CVE: CVE-2023-1970
Published: 2023-04-10
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in yuan1994 tpAdmin 1.3.12. This issue affects the function Upload of the file application\admin\controller\Upload.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225407. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://tib36.github.io/2023/04/09/tpAdmin-RCE/; https://vuldb.com/?ctiid.225407; https://vuldb.com/?id.225407
CVE: CVE-2023-26919
Published: 2023-04-10
Description: delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74, CWE-74
References: https://github.com/javadelight/delight-nashorn-sandbox/issues/135; https://github.com/javadelight/delight-nashorn-sandbox/issues/135
CVE: CVE-2023-26986
Published: 2023-04-10
Description: An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host via user interaction with a crafted EML file sent to their OA mailbox.
CVSS Score: 7.8 (HIGH)
References: https://gist.github.com/YZLCQX/0da0a438292a5479470c52dad8210462; https://github.com/YZLCQX/Mailbox-remote-command-execution; https://gist.github.com/YZLCQX/0da0a438292a5479470c52dad8210462
CVE: CVE-2023-1971
Published: 2023-04-10
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225408. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://tib36.github.io/2023/04/09/tpAdmin-SSRF/; https://vuldb.com/?ctiid.225408; https://vuldb.com/?id.225408
CVE: CVE-2023-27650
Published: 2023-04-10
Description: An issue found in APUS Group Launcher v.3.10.73 and v.3.10.88 allows a remote attacker to execute arbitrary code via the FONT_FILE parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27650/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.apusapps.launcher; https://www.apusapps.com/en/launcher
CVE: CVE-2015-10100
Published: 2023-04-10
Description: A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The identifier of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/wp-plugins/dynamic-widgets/commit/d0a19c6efcdc86d7093b369bc9e29a0629e57795; https://github.com/wp-plugins/dynamic-widgets/releases/tag/1.5.11; https://vuldb.com/?ctiid.225353
CVE: CVE-2018-25084
Published: 2023-04-10
Description: A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is some unknown functionality of the file src/main/java/com/unboundid/webapp/ssam/SSAMController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.1.3 is able to address this issue. The patch is identified as f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251. It is recommended to upgrade the affected component. VDB-225362 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/pingidentity/ssam/commit/f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251; https://github.com/pingidentity/ssam/releases/tag/ssam-1.1.3; https://vuldb.com/?ctiid.225362
CVE: CVE-2022-32871
Published: 2023-04-10
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16. A person with physical access to a device may be able to use Siri to access private calendar information
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-42858
Published: 2023-04-10
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213532; https://support.apple.com/en-us/HT213532
CVE: CVE-2022-46703
Published: 2023-04-10
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. An app may be able to read sensitive location information
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213530; https://support.apple.com/en-us/HT213531; https://support.apple.com/en-us/HT213532
CVE: CVE-2022-46709
Published: 2023-04-10
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, iOS 16. An app may be able to execute arbitrary code with kernel privileges
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-46716
Published: 2023-04-10
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. Private Relay functionality did not match system settings
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT213530; https://support.apple.com/en-us/HT213532; https://support.apple.com/en-us/HT213530
CVE: CVE-2022-46717
Published: 2023-04-10
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2. A user with physical access to a locked Apple Watch may be able to view user photos via accessibility features
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/en-us/HT213530; https://support.apple.com/kb/HT213536; https://support.apple.com/en-us/HT213530
CVE: CVE-2023-28205
Published: 2023-04-10
Description: A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://support.apple.com/en-us/HT213720; https://support.apple.com/en-us/HT213721; https://support.apple.com/en-us/HT213722
CVE: CVE-2023-28206
Published: 2023-04-10
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213720; https://support.apple.com/en-us/HT213721; https://support.apple.com/en-us/HT213723
CVE: CVE-2023-26063
Published: 2023-04-10
Description: Certain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843, CWE-843
References: https://publications.lexmark.com/publications/security-alerts/CVE-2023-26063.pdf; https://support.lexmark.com/alerts/; https://publications.lexmark.com/publications/security-alerts/CVE-2023-26063.pdf
CVE: CVE-2023-26064
Published: 2023-04-10
Description: Certain Lexmark devices through 2023-02-19 have an Out-of-bounds Write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://publications.lexmark.com/publications/security-alerts/CVE-2023-26064.pdf; https://support.lexmark.com/alerts/; https://publications.lexmark.com/publications/security-alerts/CVE-2023-26064.pdf
CVE: CVE-2023-26065
Published: 2023-04-10
Description: Certain Lexmark devices through 2023-02-19 have an Integer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://publications.lexmark.com/publications/security-alerts/CVE-2023-26065.pdf; https://support.lexmark.com/alerts/; https://publications.lexmark.com/publications/security-alerts/CVE-2023-26065.pdf
CVE: CVE-2023-26066
Published: 2023-04-10
Description: Certain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-129
References: https://publications.lexmark.com/publications/security-alerts/CVE-2023-26066.pdf; https://support.lexmark.com/alerts/; https://publications.lexmark.com/publications/security-alerts/CVE-2023-26066.pdf
CVE: CVE-2023-26067
Published: 2023-04-10
Description: Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-20
References: http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html; https://publications.lexmark.com/publications/security-alerts/CVE-2023-26067.pdf; https://support.lexmark.com/alerts/
CVE: CVE-2023-26068
Published: 2023-04-10
Description: Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html; https://publications.lexmark.com/publications/security-alerts/CVE-2023-26068.pdf; https://support.lexmark.com/alerts/
CVE: CVE-2023-26069
Published: 2023-04-10
Description: Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 3 of 4).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://publications.lexmark.com/publications/security-alerts/CVE-2023-26069.pdf; https://support.lexmark.com/alerts/; https://publications.lexmark.com/publications/security-alerts/CVE-2023-26069.pdf
CVE: CVE-2023-26070
Published: 2023-04-10
Description: Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 4 of 4).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://publications.lexmark.com/publications/security-alerts/CVE-2023-26070.pdf; https://support.lexmark.com/alerts/; https://publications.lexmark.com/publications/security-alerts/CVE-2023-26070.pdf
CVE: CVE-2023-26495
Published: 2023-04-10
Description: An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reuse an object that has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.opendesign.com/security-advisories; https://www.opendesign.com/security-advisories
CVE: CVE-2023-26466
Published: 2023-04-10
Description: A user with non-Admin access can change a configuration file on the client to modify the Server URL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-285
References: https://support.pega.com/support-doc/pega-security-advisory-b23-robotics-and-workforce-intelligence-local-privilege; https://support.pega.com/support-doc/pega-security-advisory-b23-robotics-and-workforce-intelligence-local-privilege
CVE: CVE-2023-26773
Published: 2023-04-10
Description: Cross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote attacker to gain privileges via the product list function in the Master.php file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/171686/Sales-Tracker-Management-System-1.0-Cross-Site-Scripting.html; https://twitter.com/retrymp3; https://www.sourcecodester.com/php/16061/sales-tracker-management-system-using-php-free-source-code.html
CVE: CVE-2023-27076
Published: 2023-04-10
Description: Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/B2eFly/Router/blob/main/Tenda/G103/1.md; https://github.com/B2eFly/Router/blob/main/Tenda/G103/1.md
CVE: CVE-2023-27178
Published: 2023-04-10
Description: An arbitrary file upload vulnerability in the upload function of GDidees CMS 3.9.1 allows attackers to execute arbitrary code via a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://gist.github.com/Hadi999/4bc173bfb802c229b9bb397fa906847b; https://nvd.nist.gov/vuln/detail/CVE-2022-40797; https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6
CVE: CVE-2023-28093
Published: 2023-04-10
Description: A user with a compromised configuration can start an unsigned binary as a service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://support.pega.com/support-doc/pega-security-advisory-b23-robotics-and-workforce-intelligence-local-privilege; https://support.pega.com/support-doc/pega-security-advisory-b23-robotics-and-workforce-intelligence-local-privilege
CVE: CVE-2023-29005
Published: 2023-04-10
Description: Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://flask-limiter.readthedocs.io/en/stable/configuration.html; https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pv; https://flask-limiter.readthedocs.io/en/stable/configuration.html
CVE: CVE-2023-1668
Published: 2023-04-10
Description: A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.
CVSS Score: 8.2 (HIGH)
CWE: CWE-670, CWE-670
References: https://bugzilla.redhat.com/show_bug.cgi?id=2137666; https://lists.debian.org/debian-lts-announce/2023/05/msg00000.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ/
CVE: CVE-2023-1916
Published: 2023-04-10
Description: A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://gitlab.com/libtiff/libtiff/-/issues/536%2C; https://gitlab.com/libtiff/libtiff/-/issues/537; https://support.apple.com/kb/HT213844
CVE: CVE-2023-24721
Published: 2023-04-10
Description: A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://liveaction.com; https://github.com/marcovntr/CVE/blob/main/2023/CVE-2023-24721/CVE-2023-24721.md; http://liveaction.com
CVE: CVE-2023-26467
Published: 2023-04-10
Description: A man in the middle can redirect traffic to a malicious server in a compromised configuration.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://support.pega.com/support-doc/pega-security-advisory-b23-robotics-and-workforce-intelligence-local-privilege; https://support.pega.com/support-doc/pega-security-advisory-b23-robotics-and-workforce-intelligence-local-privilege
CVE: CVE-2023-29192
Published: 2023-04-10
Description: SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by other developers. This has been fixed in version 1.2.19.
CVSS Score: 2.7 (LOW)
CWE: CWE-668, CWE-668
References: https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-m6h6-wph7-498f; https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-m6h6-wph7-498f
CVE: CVE-2022-38604
Published: 2023-04-11
Description: Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59, CWE-59
References: https://github.com/LucaBarile/CVE-2022-38604; https://lucabarile.github.io/Blog/CVE-2022-38604/index.html; https://lucabarile.github.io/Blog/blog.html