deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-23724
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-email-capture/wordpress-wordpress-email-marketing-plugin-wp-email-capture-plugin-3-9-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-email-capture/wordpress-wordpress-email-marketing-plugin-wp-email-capture-plugin-3-9-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25472
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/podlove-podcasting-plugin-for-wordpress/wordpress-podlove-podcast-publisher-plugin-3-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/podlove-podcasting-plugin-for-wordpress/wordpress-podlove-podcast-publisher-plugin-3-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25481
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/podlove-subscribe-button/wordpress-podlove-subscribe-button-plugin-1-3-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/podlove-subscribe-button/wordpress-podlove-subscribe-button-plugin-1-3-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25707
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.12 versions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/vikbooking/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-5-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/vikbooking/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-5-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-2483
Published: 2023-05-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-33203. Reason: This candidate is a reservation duplicate of CVE-2023-33203. Notes: All CVE users should reference CVE-2023-33203 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-33338
Published: 2023-05-23
Description: Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/ANUJ-KUMAR/Old-Age-Home-Management-2022-2023-1.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/ANUJ-KUMAR/Old-Age-Home-Management-2022-2023-1.0
CVE: CVE-2022-46851
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates plugin <= 3.1.20 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/astra-sites/wordpress-starter-templates-elementor-wordpress-beaver-builder-templates-plugin-3-1-20-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/astra-sites/wordpress-starter-templates-elementor-wordpress-beaver-builder-templates-plugin-3-1-20-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-46853
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 5.0.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/the-post-grid/wordpress-the-post-grid-shortcode-gutenberg-blocks-and-elementor-addon-for-post-grid-plugin-5-0-4-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/the-post-grid/wordpress-the-post-grid-shortcode-gutenberg-blocks-and-elementor-addon-for-post-grid-plugin-5-0-4-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-23705
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-books-gallery/wordpress-wordpress-books-gallery-plugin-4-4-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-books-gallery/wordpress-wordpress-books-gallery-plugin-4-4-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-23713
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Manoj Thulasidas Theme Tweaker plugin <= 5.20 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/theme-tweaker-lite/wordpress-theme-tweaker-plugin-5-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/theme-tweaker-lite/wordpress-theme-tweaker-plugin-5-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25056
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in SlickRemix Feed Them Social plugin <= 3.0.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/feed-them-social/wordpress-feed-them-social-for-twitter-feed-youtube-and-more-plugin-3-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/feed-them-social/wordpress-feed-them-social-for-twitter-feed-youtube-and-more-plugin-3-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-30440
Published: 2023-05-23
Description: IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 through FW1020.30, and FW1030.00 through FW1030.10 could allow a local attacker with control a partition that has been assigned SRIOV virtual function (VF) to cause a denial of service to a peer partition or arbitrary data corruption.  IBM X-Force ID:  253175.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/253175; https://www.ibm.com/support/pages/node/6997133; https://exchange.xforce.ibmcloud.com/vulnerabilities/253175
CVE: CVE-2023-33359
Published: 2023-05-23
Description: Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/Piwigo/Piwigo/issues/1908; https://github.com/Piwigo/Piwigo/issues/1908
CVE: CVE-2023-33361
Published: 2023-05-23
Description: Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Piwigo/Piwigo/issues/1910; https://github.com/Piwigo/Piwigo/issues/1910
CVE: CVE-2023-33362
Published: 2023-05-23
Description: Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2023-33362.md; https://github.com/Piwigo/Piwigo/issues/1911; https://github.com/Piwigo/Piwigo/issues/1911
CVE: CVE-2022-46813
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Younes JFR. Advanced Database Cleaner plugin <= 3.1.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/advanced-database-cleaner/wordpress-advanced-database-cleaner-plugin-3-1-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-database-cleaner/wordpress-advanced-database-cleaner-plugin-3-1-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-26011
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tim Eckel Read More Excerpt Link plugin <= 1.6 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/read-more-excerpt-link/wordpress-read-more-excerpt-link-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/read-more-excerpt-link/wordpress-read-more-excerpt-link-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-26014
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tim Eckel Minify HTML plugin <= 2.1.7 vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/minify-html-markup/wordpress-minify-html-plugin-2-02-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/minify-html-markup/wordpress-minify-html-plugin-2-02-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-33599
Published: 2023-05-23
Description: EasyImages2.0 ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/icret/EasyImages2.0/issues/115; https://github.com/icret/EasyImages2.0/issues/115
CVE: CVE-2023-33617
Published: 2023-05-23
Description: An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14_X000 was found via the /boaform/admin/formPing target_addr parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://gist.github.com/gbrls/58a5032bc58510abb908386124d1b4d2; https://gist.github.com/gbrls/58a5032bc58510abb908386124d1b4d2
CVE: CVE-2023-25474
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Csaba Kissi About Me 3000 widget plugin <= 2.2.6 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/about-me-3000/wordpress-about-me-3000-widget-plugin-2-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/about-me-3000/wordpress-about-me-3000-widget-plugin-2-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-1209
Published: 2023-05-23
Description: Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1262967; https://www.linkedin.com/in/osamay/; https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1262967
CVE: CVE-2023-1837
Published: 2023-05-23
Description: Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legacy APIs.This issue affects HYPR Server: before 8.0 (with enabled Legacy APIs)


CVSS Score: 8.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.hypr.com/security-advisories; https://www.hypr.com/security-advisories
CVE: CVE-2023-23298
Published: 2023-05-23
Description: The `Toybox.Graphics.BufferedBitmap.initialize` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which can result in integer overflows when allocating the underlying bitmap buffer. A malicious application could call the API method with specially crafted parameters and hijack the execution of the device's firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://developer.garmin.com/connect-iq/api-docs/Toybox/Graphics/BufferedBitmap.html#initialize-instance_function; https://developer.garmin.com/connect-iq/compatible-devices/; https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23298.md
CVE: CVE-2023-23299
Published: 2023-05-23
Description: The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data such as user profile information and GPS coordinates, among others.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://developer.garmin.com/connect-iq/core-topics/manifest-and-permissions/; https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23299.md; https://developer.garmin.com/connect-iq/core-topics/manifest-and-permissions/
CVE: CVE-2023-23300
Published: 2023-05-23
Description: The `Toybox.Cryptography.Cipher.initialize` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overflows when copying data. A malicious application could call the API method with specially crafted parameters and hijack the execution of the device's firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://developer.garmin.com/connect-iq/api-docs/Toybox/Cryptography/Cipher.html#initialize-instance_function; https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23300.md; https://developer.garmin.com/connect-iq/api-docs/Toybox/Cryptography/Cipher.html#initialize-instance_function
CVE: CVE-2023-23301
Published: 2023-05-23
Description: The `news` MonkeyC operation code in CIQ API version 1.0.0 through 4.1.7 fails to check that string resources are not extending past the end of the expected sections. A malicious CIQ application could craft a string that starts near the end of a section, and whose length extends past its end. Upon loading the string, the GarminOS TVM component may read out-of-bounds memory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23301.md; https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23301.md
CVE: CVE-2023-23302
Published: 2023-05-23
Description: The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/GenericChannel.html#setDeviceConfig-instance_function; https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23302.md; https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/GenericChannel.html#setDeviceConfig-instance_function
CVE: CVE-2023-23303
Published: 2023-05-23
Description: The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/GenericChannel.html#enableEncryption-instance_function; https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23303.md; https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/GenericChannel.html#enableEncryption-instance_function
CVE: CVE-2023-23304
Published: 2023-05-23
Description: The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` module without permission. A malicious application could call any functions from the `Toybox.SensorHistory` module without the user's consent and disclose potentially private or sensitive information.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://developer.garmin.com/connect-iq/api-docs/Toybox/SensorHistory.html; https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23304.md; https://developer.garmin.com/connect-iq/api-docs/Toybox/SensorHistory.html
CVE: CVE-2023-23305
Published: 2023-05-23
Description: The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources. A malicious application embedding specially crafted resources could hijack the execution of the device's firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23305.md; https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23305.md; https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/poc/GRMN-06.prg
CVE: CVE-2023-23306
Published: 2023-05-23
Description: The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bounds write operation. A malicious application could create a specially crafted `Toybox.Ant.BurstPayload` object, call its `add` method, override arbitrary memory and hijack the execution of the device's firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/BurstPayload.html#add-instance_function; https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23306.md; https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/BurstPayload.html#add-instance_function
CVE: CVE-2023-2702
Published: 2023-05-23
Description: Authorization Bypass Through User-Controlled Key vulnerability in Finex Media Competition Management System allows Authentication Abuse, Authentication Bypass.This issue affects Competition Management System: before 23.07.


CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-23-0283; https://www.usom.gov.tr/bildirim/tr-23-0283
CVE: CVE-2023-2703
Published: 2023-05-23
Description: Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users.This issue affects Competition Management System: before 23.07.


CVSS Score: 7.5 (HIGH)
CWE: CWE-359, CWE-668
References: https://www.usom.gov.tr/bildirim/tr-23-0283; https://www.usom.gov.tr/bildirim/tr-23-0283
CVE: CVE-2023-31517
Published: 2023-05-23
Description: A memory leak in the component CConsole::Chain of Teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via opening a crafted file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://teeworlds.com; https://gist.github.com/manba-bryant/9ca95d69c65f4d2c55946932c946fb9b; https://www.redpacketsecurity.com/teeworlds-denial-of-service-cve-2023-31517/
CVE: CVE-2023-31518
Published: 2023-05-23
Description: A heap use-after-free in the component CDataFileReader::GetItem of teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via a crafted map file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://gist.github.com/manba-bryant/9ca95d69c65f4d2c55946932c946fb9b; https://github.com/teeworlds/teeworlds/issues/2970; https://mmmds.pl/fuzzing-map-parser-part-1-teeworlds/
CVE: CVE-2023-31752
Published: 2023-05-23
Description: SourceCodester Employee and Visitor Gate Pass Logging System v1.0 is vulnerable to SQL Injection via /employee_gatepass/classes/Login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/4O4NtFd/bug_report/blob/main/SQLI2/SQLi-2.md; https://github.com/4O4NtFd/bug_report/blob/main/SQLI2/SQLi-2.md
CVE: CVE-2023-31860
Published: 2023-05-23
Description: Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/wuzhicms/b2b/issues/3; https://github.com/wuzhicms/b2b/issues/3; https://github.com/wuzhicms/b2b/issues/3
CVE: CVE-2023-1508
Published: 2023-05-23
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adam Retail Automation Systems Mobilmen Terminal Software allows SQL Injection.This issue affects Mobilmen Terminal Software: before 3.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0284; https://www.usom.gov.tr/bildirim/tr-23-0284
CVE: CVE-2023-30382
Published: 2023-05-23
Description: A buffer overflow in the component hl.exe of Valve Half-Life up to 5433873 allows attackers to execute arbitrary code and escalate privileges by supplying crafted parameters.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787, CWE-787
References: https://labs.jumpsec.com/advisory-cve-2023-30382-half-life-local-privilege-escalation/; https://labs.jumpsec.com/advisory-cve-2023-30382-half-life-local-privilege-escalation/
CVE: CVE-2023-28015
Published: 2023-05-23
Description: The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability.   During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not.  The attacker could use this information to focus a brute force attack on valid users.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105093; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105093
CVE: CVE-2023-31726
Published: 2023-05-23
Description: AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://alist.nn.ci/zh/; https://github.com/J6451/CVE-2023-31726; https://alist.nn.ci/zh/
CVE: CVE-2023-31747
Published: 2023-05-23
Description: Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attackers to launch processes with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428, CWE-428
References: http://filmora.com; http://wondershare.com; https://packetstormsecurity.com/files/172464/Filmora-12-Build-1.0.0.7-Unquoted-Service-Path.html
CVE: CVE-2023-32697
Published: 2023-05-23
Description: SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2; https://github.com/xerial/sqlite-jdbc/security/advisories/GHSA-6phf-6h5g-97j2; https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2
CVE: CVE-2023-2494
Published: 2023-05-24
Description: The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to modify access to the plugin when it should only be the administrator's privilege.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://codecanyon.net/item/go-pricing-wordpress-responsive-pricing-tables/3725820; https://www.wordfence.com/threat-intel/vulnerabilities/id/5779914a-a168-4835-8aea-e0ab2b3be4f6?source=cve; https://codecanyon.net/item/go-pricing-wordpress-responsive-pricing-tables/3725820