deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2945
Published: 2023-05-27
Description: Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://github.com/openemr/openemr/commit/3656bc88288957d68ba040cad2e5f9dbd1b607b1; https://huntr.dev/bounties/62de71bd-333d-4593-91a5-534ef7f0c435; https://github.com/openemr/openemr/commit/3656bc88288957d68ba040cad2e5f9dbd1b607b1
CVE: CVE-2023-2946
Published: 2023-05-27
Description: Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/openemr/openemr/commit/81832acc14207e577e76c4175967c99ae7e3d3f4; https://huntr.dev/bounties/e550f4b0-945c-4886-af7f-ee0dc30b2a08; https://github.com/openemr/openemr/commit/81832acc14207e577e76c4175967c99ae7e3d3f4
CVE: CVE-2023-2947
Published: 2023-05-27
Description: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/openemr/openemr/commit/8d2d601ac40aca75bcd2c3cf193f59c8e56d8425; https://huntr.dev/bounties/52534def-acab-4200-a79a-89ef4ce6a0b0; https://github.com/openemr/openemr/commit/8d2d601ac40aca75bcd2c3cf193f59c8e56d8425
CVE: CVE-2023-2948
Published: 2023-05-28
Description: Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/openemr/openemr/commit/af1ecf78d[PII_REDACTED]bda9d3079e88f7d859015; https://huntr.dev/bounties/2393e4d9-9e9f-455f-bf50-f20f77b0a64d; https://github.com/openemr/openemr/commit/af1ecf78d[PII_REDACTED]bda9d3079e88f7d859015
CVE: CVE-2023-2949
Published: 2023-05-28
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/openemr/openemr/commit/af1ecf78d[PII_REDACTED]bda9d3079e88f7d859015; https://huntr.dev/bounties/3842486f-38b1-4150-9f78-b81d0ae580c4; https://github.com/openemr/openemr/commit/af1ecf78d[PII_REDACTED]bda9d3079e88f7d859015
CVE: CVE-2023-2950
Published: 2023-05-28
Description: Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285
References: https://github.com/openemr/openemr/commit/abee8d2606c706176818de25eb88a2d08b8f7fa4; https://huntr.dev/bounties/612d13cf-2ef9-44ea-b8fb-e797948a9a86; https://github.com/openemr/openemr/commit/abee8d2606c706176818de25eb88a2d08b8f7fa4
CVE: CVE-2023-2951
Published: 2023-05-28
Description: A vulnerability classified as critical has been found in code-projects Bus Dispatch and Information System 1.0. Affected is an unknown function of the file delete_bus.php. The manipulation of the argument busid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230112.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/F1owerSugarzzz/Commit-Vulnerability-Cve/blob/main/Bus%20Dispatch%20and%20Information%20System%20in%20delete_bus%20has%20Sql%20injection%20vulnerabilities.pdf; https://vuldb.com/?ctiid.230112; https://vuldb.com/?id.230112
CVE: CVE-2014-125101
Published: 2023-05-28
Description: A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.9 is able to address this issue. The identifier of the patch is 58ed88243e17df766036f4857041edaf358076d3. It is recommended to upgrade the affected component. The identifier VDB-230085 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/wp-plugins/portfolio-gallery/commit/58ed88243e17df766036f4857041edaf358076d3; https://vuldb.com/?ctiid.230085; https://vuldb.com/?id.230085
CVE: CVE-2015-10106
Published: 2023-05-28
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This vulnerability affects the function moduleContent of the file mod1/index.php. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is identified as 429f50f4e4795b20dae06735b41fb94f010722bf. It is recommended to upgrade the affected component. VDB-230086 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/mback2k/mh_httpbl/commit/429f50f4e4795b20dae06735b41fb94f010722bf; https://github.com/mback2k/mh_httpbl/releases/tag/mh_httpbl_1.1.8_security; https://typo3.org/article/typo3-ext-sa-2015-021
CVE: CVE-2023-33216
Published: 2023-05-28
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woodiscuz-woocommerce-comments/wordpress-woodiscuz-woocommerce-comments-plugin-2-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woodiscuz-woocommerce-comments/wordpress-woodiscuz-woocommerce-comments-plugin-2-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32958
Published: 2023-05-28
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nose Graze Novelist plugin <= 1.2.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/novelist/wordpress-novelist-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/novelist/wordpress-novelist-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33212
Published: 2023-05-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.0.6 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/jetformbuilder/wordpress-jetformbuilder-plugin-3-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jetformbuilder/wordpress-jetformbuilder-plugin-3-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-33309
Published: 2023-05-28
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/duplicator-pro/wordpress-duplicator-pro-plugin-4-5-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/duplicator-pro/wordpress-duplicator-pro-plugin-4-5-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33314
Published: 2023-05-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-bulk-editor/wordpress-bear-plugin-1-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-bulk-editor/wordpress-bear-plugin-1-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-33315
Published: 2023-05-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin <= 1.1.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/smart-app-banner/wordpress-smart-app-banner-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smart-app-banner/wordpress-smart-app-banner-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-33326
Published: 2023-05-28
Description: Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-2-8-6-reflected-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-2-8-6-reflected-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-33328
Published: 2023-05-28
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps MailChimp Subscribe Form plugin <= 4.0.9.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mailchimp-subscribe-sm/wordpress-pluginops-optin-builder-plugin-4-0-9-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/mailchimp-subscribe-sm/wordpress-pluginops-optin-builder-plugin-4-0-9-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-33931
Published: 2023-05-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/youtube-playlist-player/wordpress-youtube-playlist-player-plugin-4-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/youtube-playlist-player/wordpress-youtube-playlist-player-plugin-4-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28785
Published: 2023-05-28
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpseo-local/wordpress-yoast-seo-local-plugin-14-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpseo-local/wordpress-yoast-seo-local-plugin-14-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32800
Published: 2023-05-28
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in One Rank Math SEO PRO plugin <= 3.0.35 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/seo-by-rank-math-pro/wordpress-rank-math-seo-pro-plugin-3-0-35-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seo-by-rank-math-pro/wordpress-rank-math-seo-pro-plugin-3-0-35-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33211
Published: 2023-05-28
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in André Bräkling WP-Matomo Integration (WP-Piwik) plugin <= 1.0.27 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-piwik/wordpress-wp-matomo-integration-wp-piwik-plugin-1-0-27-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-piwik/wordpress-wp-matomo-integration-wp-piwik-plugin-1-0-27-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33311
Published: 2023-05-28
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CRM Perks Contact Form Entries plugin <= 1.3.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/contact-form-entries/wordpress-contact-form-entries-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-entries/wordpress-contact-form-entries-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33313
Published: 2023-05-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wip-custom-login/wordpress-wip-custom-login-plugin-1-2-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wip-custom-login/wordpress-wip-custom-login-plugin-1-2-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-33316
Published: 2023-05-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-follow-up-emails/wordpress-woocommerce-follow-up-emails-plugin-4-9-40-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-follow-up-emails/wordpress-woocommerce-follow-up-emails-plugin-4-9-40-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-33319
Published: 2023-05-28
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-follow-up-emails/wordpress-woocommerce-follow-up-emails-plugin-4-9-40-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-follow-up-emails/wordpress-woocommerce-follow-up-emails-plugin-4-9-40-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33332
Published: 2023-05-28
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-1-76-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-1-76-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-36345
Published: 2023-05-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Plugin <= 2.0.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/download-plugin/wordpress-download-plugin-2-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/download-plugin/wordpress-download-plugin-2-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-33926
Published: 2023-05-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/google-maps-easy/wordpress-easy-google-maps-plugin-1-11-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/google-maps-easy/wordpress-easy-google-maps-plugin-1-11-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2021-4336
Published: 2023-05-28
Description: A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file modules/reports/models/scheduled_reports.php. The manipulation leads to sql injection. Upgrading to version 2021.11.30 is able to address this issue. The name of the patch is 6da9080faec9bca1ca5342386c0421dca0a6c0cc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230084.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ITRS-Group/monitor-ninja/commit/6da9080faec9bca1ca5342386c0421dca0a6c0cc; https://github.com/ITRS-Group/monitor-ninja/releases/tag/v2021.11.30; https://vuldb.com/?ctiid.230084
CVE: CVE-2023-33291
Published: 2023-05-28
Description: In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. (It cannot be exploited with e-mail addresses or phone numbers that are registered in the application.)
CVSS Score: 7.4 (HIGH)
CWE: CWE-276, CWE-276
References: http://packetstormsecurity.com/files/172476/eBankIT-6-Arbitrary-OTP-Generation.html; https://www.ebankit.com/digital-banking-platform; http://packetstormsecurity.com/files/172476/eBankIT-6-Arbitrary-OTP-Generation.html
CVE: CVE-2023-31873
Published: 2023-05-28
Description: Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/172530/Gin-Markdown-Editor-0.7.4-Arbitrary-Code-Execution.html; http://packetstormsecurity.com/files/172530/Gin-Markdown-Editor-0.7.4-Arbitrary-Code-Execution.html
CVE: CVE-2023-32762
Published: 2023-05-28
Description: An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.
CVSS Score: 5.3 (MEDIUM)
References: https://codereview.qt-project.org/c/qt/qtbase/+/476140; https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305; https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
CVE: CVE-2023-32763
Published: 2023-05-28
Description: An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://codereview.qt-project.org/c/qt/qtbase/+/476125; https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html; https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
CVE: CVE-2023-29380
Published: 2023-05-29
Description: Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/linuxmint/warpinator/compare/1.4.5...1.6.0; https://www.openwall.com/lists/oss-security/2023/04/26/1; https://github.com/linuxmint/warpinator/compare/1.4.5...1.6.0
CVE: CVE-2023-30350
Published: 2023-05-29
Description: FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/172124/FS-S3900-24T4S-Privilege-Escalation.html; http://packetstormsecurity.com/files/172124/FS-S3900-24T4S-Privilege-Escalation.html
CVE: CVE-2023-30570
Published: 2023-05-29
Description: pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://libreswan.org/security/CVE-2023-30570/CVE-2023-30570.txt; https://libreswan.org/security/CVE-2023-30570/CVE-2023-30570.txt
CVE: CVE-2023-31874
Published: 2023-05-29
Description: Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: http://packetstormsecurity.com/files/172535/Yank-Note-3.52.1-Arbitrary-Code-Execution.html; http://packetstormsecurity.com/files/172535/Yank-Note-3.52.1-Arbitrary-Code-Execution.html
CVE: CVE-2022-33974
Published: 2023-05-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress-custom-twitter-feeds-plugin-1-8-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress-custom-twitter-feeds-plugin-1-8-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-45372
Published: 2023-05-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-product-gallery-slider/wordpress-product-gallery-slider-for-woocommerce-plugin-2-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-product-gallery-slider/wordpress-product-gallery-slider-for-woocommerce-plugin-2-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28153
Published: 2023-05-29
Description: An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restrictions temporarily without the parents noticing by rebooting into Android Safe Mode and disabling the "Display over other apps" permission.
CVSS Score: 6.4 (MEDIUM)
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-kiddoware-kids-place-parental-control-android-app/; https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-kiddoware-kids-place-parental-control-android-app/
CVE: CVE-2023-29078
Published: 2023-05-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in a customer-controlled product. Notes: none.
CVE: CVE-2023-29079
Published: 2023-05-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in a customer-controlled product. Notes: none.
CVE: CVE-2023-24597
Published: 2023-05-29
Description: OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing.
CVSS Score: 5.3 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/May/3; https://open-xchange.com; http://seclists.org/fulldisclosure/2023/May/3
CVE: CVE-2023-24598
Published: 2023-05-29
Description: OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: http://seclists.org/fulldisclosure/2023/May/3; https://open-xchange.com; http://seclists.org/fulldisclosure/2023/May/3
CVE: CVE-2023-24599
Published: 2023-05-29
Description: OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-843
References: http://seclists.org/fulldisclosure/2023/May/3; https://open-xchange.com; http://seclists.org/fulldisclosure/2023/May/3
CVE: CVE-2023-24600
Published: 2023-05-29
Description: OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: http://seclists.org/fulldisclosure/2023/May/3; https://open-xchange.com; http://seclists.org/fulldisclosure/2023/May/3
CVE: CVE-2023-24601
Published: 2023-05-29
Description: OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2023/May/3; https://open-xchange.com; http://seclists.org/fulldisclosure/2023/May/3