deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-47848
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tainacan.Org Tainacan allows Reflected XSS.This issue affects Tainacan: from n/a through 0.20.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/tainacan/wordpress-tainacan-plugin-0-20-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tainacan/wordpress-tainacan-plugin-0-20-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47853
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin allows Stored XSS.This issue affects myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin: from n/a through 2.6.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47872
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team wpForo Forum allows Stored XSS.This issue affects wpForo Forum: from n/a through 2.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47875
Published: 2023-11-30
Description: Cross-Site Request Forgery (CSRF) vulnerability in Perfmatters allows Cross Site Request Forgery.This issue affects Perfmatters: from n/a through 2.1.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/perfmatters/wordpress-perfmatters-plugin-2-1-6-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve; https://patchstack.com/database/vulnerability/perfmatters/wordpress-perfmatters-plugin-2-1-6-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve
CVE: CVE-2023-47876
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Reflected XSS.This issue affects Perfmatters: from n/a through 2.1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/perfmatters/wordpress-perfmatters-plugin-2-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/perfmatters/wordpress-perfmatters-plugin-2-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47877
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Stored XSS.This issue affects Perfmatters: from n/a before 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/perfmatters/wordpress-perfmatters-plugin-2-1-6-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/perfmatters/wordpress-perfmatters-plugin-2-1-6-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48272
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Maspik – Spam Blacklist allows Stored XSS.This issue affects Maspik – Spam Blacklist: from n/a through 0.9.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48278
Published: 2023-11-30
Description: Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Stored XSS.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-forms-puzzle-captcha/wordpress-wp-forms-puzzle-captcha-plugin-4-1-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-forms-puzzle-captcha/wordpress-wp-forms-puzzle-captcha-plugin-4-1-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48317
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Vatsa Display Custom Post allows Stored XSS.This issue affects Display Custom Post: from n/a through 2.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/display-custom-post/wordpress-display-custom-post-plugin-2-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/display-custom-post/wordpress-display-custom-post-plugin-2-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48320
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebDorado SpiderVPlayer allows Stored XSS.This issue affects SpiderVPlayer: from n/a through 1.5.22.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/player/wordpress-spidervplayer-plugin-1-5-22-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/player/wordpress-spidervplayer-plugin-1-5-22-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48321
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobile Pages allows Stored XSS.This issue affects AMP for WP – Accelerated Mobile Pages: from n/a through 1.0.88.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/accelerated-mobile-pages/wordpress-amp-for-wp-accelerated-mobile-pages-plugin-1-0-88-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/accelerated-mobile-pages/wordpress-amp-for-wp-accelerated-mobile-pages-plugin-1-0-88-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48746
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Reflected XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a through 6.2.6.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/peepso-core/wordpress-community-by-peepso-plugin-6-2-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/peepso-core/wordpress-community-by-peepso-plugin-6-2-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48748
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme nectar Salient Core allows Reflected XSS.This issue affects Salient Core: from n/a through 2.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/salient-core/wordpress-salient-core-plugin-2-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/salient-core/wordpress-salient-core-plugin-2-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48749
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme nectar Salient Core allows Stored XSS.This issue affects Salient Core: from n/a through 2.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/salient-core/wordpress-salient-core-plugin-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/salient-core/wordpress-salient-core-plugin-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48752
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms allows Reflected XSS.This issue affects Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms: from n/a through 1.25.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/happyforms/wordpress-happyforms-plugin-1-25-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/happyforms/wordpress-happyforms-plugin-1-25-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-6438
Published: 2023-11-30
Description: A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /WebArticle/articles/ of the component Like Handler. The manipulation leads to improper enforcement of a single, unique action. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-246438 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-837
References: http://124.71.147.32:8082; https://vuldb.com/?ctiid.246438; https://vuldb.com/?id.246438
CVE: CVE-2023-47870
Published: 2023-11-30
Description: Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-plugin-2-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-plugin-2-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48802
Published: 2023-11-30
Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.notion.so/X6000R-sub_4119A0-6-9541a9b3387a40de856a1cad692ba8d4?pvs=4; https://www.notion.so/X6000R-sub_4119A0-6-9541a9b3387a40de856a1cad692ba8d4?pvs=4
CVE: CVE-2023-48803
Published: 2023-11-30
Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.notion.so/X6000R-sub_4119A0-4-aead0a851416422ea2e282409eec3351?pvs=4; https://www.notion.so/X6000R-sub_4119A0-4-aead0a851416422ea2e282409eec3351?pvs=4
CVE: CVE-2023-48804
Published: 2023-11-30
Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.notion.so/X6000R-sub_4119A0-1-e9697e90e8b04e05a6d10c9fb7288750?pvs=4; https://www.notion.so/X6000R-sub_4119A0-1-e9697e90e8b04e05a6d10c9fb7288750?pvs=4
CVE: CVE-2023-48805
Published: 2023-11-30
Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.notion.so/X6000R-sub_4119A0-2-6a912e[PII_REDACTED]9ae8c5837d4288b4?pvs=4; https://www.notion.so/X6000R-sub_4119A0-2-6a912e[PII_REDACTED]9ae8c5837d4288b4?pvs=4
CVE: CVE-2023-48806
Published: 2023-11-30
Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.notion.so/X6000R-sub_4119A0-5-92b3d1e22e764ae7a18cdf0d8ac24e4f?pvs=4; https://www.notion.so/X6000R-sub_4119A0-5-92b3d1e22e764ae7a18cdf0d8ac24e4f?pvs=4
CVE: CVE-2023-48807
Published: 2023-11-30
Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.notion.so/X6000R-sub_4119A0-3-1e21686eebf94cee8a7819d1d7aa29b9?pvs=4; https://www.notion.so/X6000R-sub_4119A0-3-1e21686eebf94cee8a7819d1d7aa29b9?pvs=4
CVE: CVE-2023-48808
Published: 2023-11-30
Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.notion.so/X6000R-sub_4119A0-9-075ccc78275a4381a65e114eb1fddd6e?pvs=4; https://www.notion.so/X6000R-sub_4119A0-9-075ccc78275a4381a65e114eb1fddd6e?pvs=4
CVE: CVE-2023-48810
Published: 2023-11-30
Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.notion.so/X6000R-sub_4119A0-7-d5387bf8d16846c2b4f19b15a808aa4c?pvs=4; https://www.notion.so/X6000R-sub_4119A0-7-d5387bf8d16846c2b4f19b15a808aa4c?pvs=4
CVE: CVE-2023-48811
Published: 2023-11-30
Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.notion.so/X6000R-sub_4119A0-8-2332305e3d8044c09f093404a8ae59f4?pvs=4; https://www.notion.so/X6000R-sub_4119A0-8-2332305e3d8044c09f093404a8ae59f4?pvs=4
CVE: CVE-2023-48812
Published: 2023-11-30
Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.notion.so/X6000R-sub_4119A0-10-82467d98d07c45a59ec3729ec712cb57?pvs=4; https://www.notion.so/X6000R-sub_4119A0-10-82467d98d07c45a59ec3729ec712cb57?pvs=4
CVE: CVE-2023-6341
Published: 2023-11-30
Description: Catalis (previously Icon Software) CMS360 allows a remote, unauthenticated attacker to view sensitive court documents by modifying document and other identifiers in URLs. The impact varies based on the intention and configuration of a specific CMS360 installation.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://catalisgov.com/courts-land-records-support/; https://github.com/qwell/disorder-in-the-court/blob/main/README-Catalis.md; https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/
CVE: CVE-2023-6342
Published: 2023-11-30
Description: Tyler Technologies Court Case Management Plus allows a remote attacker to authenticate as any user by manipulating at least the 'CmWebSearchPfp/Login.aspx?xyzldk=' and 
'payforprint_CM/Redirector.ashx?userid=' parameters. The vulnerable "pay for print" feature was removed on or around 2023-11-01.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md; https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/; https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems
CVE: CVE-2023-6343
Published: 2023-11-30
Description: Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx 'FN' and 'PN' parameters. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is similar to CVE-2020-9323. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.



CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md; https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/; https://www.aquaforest.com/blog/aquaforest-tiff-server-sunsetting
CVE: CVE-2023-6344
Published: 2023-11-30
Description: Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx 'ifolder' parameter. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md; https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/; https://www.aquaforest.com/blog/aquaforest-tiff-server-sunsetting
CVE: CVE-2023-6352
Published: 2023-11-30
Description: The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services (IIS) or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate files or directories, traverse directories, bypass authentication, or access restricted files.



CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md; https://www.aquaforest.com/blog/aquaforest-tiff-server-sunsetting; https://www.aquaforest.com/blog/tiff-server-security-update
CVE: CVE-2023-6353
Published: 2023-11-30
Description: Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload.aspx 'enky' parameter.




CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md; https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/; https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems
CVE: CVE-2023-6354
Published: 2023-11-30
Description: Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the PDFViewer.aspx 'filename' parameter.



CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md; https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/; https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems
CVE: CVE-2023-6375
Published: 2023-11-30
Description: Tyler Technologies Court Case Management Plus may store backups in a location that can be accessed by a remote, unauthenticated attacker. Backups may contain sensitive information such as database credentials.



CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md; https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/; https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems
CVE: CVE-2023-6376
Published: 2023-11-30
Description: Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents.



CVSS Score: 5.3 (MEDIUM)
CWE: CWE-330, CWE-330
References: https://github.com/qwell/disorder-in-the-court/blob/main/README-Henschen%26Associates.md; https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/; https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems
CVE: CVE-2023-6439
Published: 2023-11-30
Description: A vulnerability classified as problematic was found in ZenTao PMS 18.8. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246439.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://1drv.ms/w/s!AgMfVZkPO1NWgR2_sUsSJF67lvbG?e=SStrt5; https://vuldb.com/?ctiid.246439; https://vuldb.com/?id.246439
CVE: CVE-2023-47452
Published: 2023-11-30
Description: An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/xieqiang11/poc-1/tree/main; https://github.com/xieqiang11/poc-1/tree/main
CVE: CVE-2023-47453
Published: 2023-11-30
Description: An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges through the version.dll file in the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/xieqiang11/poc-2/tree/main; https://github.com/xieqiang11/poc-2/tree/main
CVE: CVE-2023-47454
Published: 2023-11-30
Description: An Untrusted search path vulnerability in NetEase CloudMusic 2.10.4 for Windows allows local users to gain escalated privileges through the urlmon.dll file in the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/xieqiang11/poc-3/tree/main; https://github.com/xieqiang11/poc-3/tree/main