deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-10003
Published: 2023-02-07
Description: A vulnerability was found in XpressEngine up to 1.4.4. It has been rated as critical. This issue affects some unknown processing of the component Update Query Handler. The manipulation leads to sql injection. Upgrading to version 1.4.5 is able to address this issue. The patch is named c6e94449f21256d6362450b29c7847305e756ad5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220247.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/haegyung/xe-core/commit/c6e94449f21256d6362450b29c7847305e756ad5; https://vuldb.com/?ctiid.220247; https://vuldb.com/?id.220247
CVE: CVE-2021-37492
Published: 2023-02-07
Description: An issue discovered in src/wallet/wallet.cpp in Ravencoin Core 4.3.2.1 and earlier allows attackers to view sensitive information via CWallet::CreateTransactionAll() function.
CVSS Score: 7.5 (HIGH)
References: http://ravencoin.com; https://github.com/RavenProject/Ravencoin/blob/master/src/wallet/wallet.cpp#L3657-L3671; https://github.com/RavenProject/Ravencoin/issues/1086
CVE: CVE-2022-45768
Published: 2023-02-07
Description: Command Injection vulnerability in Edimax Technology Co., Ltd. Wireless Router N300 Firmware BR428nS v3 allows attacker to execute arbitrary code via the formWlanMP function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/Erebua/CVE/blob/main/Edimax.md; https://www.lovesandy.cc/2022/11/20/EDIMAX%E6%BC%8F%E6%B4%9E/; https://github.com/Erebua/CVE/blob/main/Edimax.md
CVE: CVE-2022-46663
Published: 2023-02-07
Description: In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
CVSS Score: 7.5 (HIGH)
References: http://www.greenwoodsoftware.com/less/news.609.html; http://www.openwall.com/lists/oss-security/2023/02/07/7; https://github.com/gwsw/less/commit/a78e1351113cef564d790a730d657a321624d79c
CVE: CVE-2023-0696
Published: 2023-02-07
Description: Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html; https://crbug.com/1402270; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-0697
Published: 2023-02-07
Description: Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html; https://crbug.com/1341541; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-0698
Published: 2023-02-07
Description: Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html; https://crbug.com/1403573; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-0699
Published: 2023-02-07
Description: Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page and browser shutdown. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html; https://crbug.com/1371859; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-0700
Published: 2023-02-07
Description: Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html; https://crbug.com/1393732; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-0701
Published: 2023-02-07
Description: Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interaction . (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html; https://crbug.com/1405123; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-0702
Published: 2023-02-07
Description: Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html; https://crbug.com/1316301; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-0703
Published: 2023-02-07
Description: Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html; https://crbug.com/1405574; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-0704
Published: 2023-02-07
Description: Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-602
References: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html; https://crbug.com/1385982; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-0705
Published: 2023-02-07
Description: Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html; https://crbug.com/1238642; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-23931
Published: 2023-02-07
Description: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-754
References: https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3; https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r; https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3
CVE: CVE-2022-47413
Published: 2023-02-07
Description: 
Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/; https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/
CVE: CVE-2022-47414
Published: 2023-02-07
Description: 
If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/; https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/
CVE: CVE-2022-47415
Published: 2023-02-07
Description: LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messaging system (both subject and message bodies).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/; https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/
CVE: CVE-2022-47416
Published: 2023-02-07
Description: LogicalDOC Enterprise is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app chat system.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/; https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/
CVE: CVE-2022-47417
Published: 2023-02-07
Description: LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document file name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/; https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/
CVE: CVE-2022-47419
Published: 2023-02-07
Description: An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.mayan-edms.com/news/2023/02/version-4.3.6/; https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/; https://www.mayan-edms.com/news/2023/02/version-4.3.6/
CVE: CVE-2023-0713
Published: 2023-02-07
Description: The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/2764b360-228d-48c1-8a29-d3764e532799?source=cve
CVE: CVE-2023-0728
Published: 2023-02-07
Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/43b43802-f301-4748-98b9-eea78a249355?source=cve
CVE: CVE-2021-36471
Published: 2023-02-07
Description: Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html, /admin/index3.html URIs. Note: AdminLTE developers dispute that this a weakness with AdminLTE and is instead a misconfiguration error on various websites by the website developers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://gist.github.com/cybersaki/31ffe679a5552c1047164e3a5b01c2fd; https://github.com/ColorlibHQ/AdminLTE/issues/4948; https://gist.github.com/cybersaki/31ffe679a5552c1047164e3a5b01c2fd
CVE: CVE-2022-47418
Published: 2023-02-07
Description: LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document version comments.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/; https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/
CVE: CVE-2023-0712
Published: 2023-02-07
Description: The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0be428ae-40ae-4cc0-82ad-d121b6d2d27e?source=cve
CVE: CVE-2023-0719
Published: 2023-02-07
Description: The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9b26604b-2423-4130-b0ef-8f63a392c760?source=cve
CVE: CVE-2023-0723
Published: 2023-02-07
Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_move_object function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/dc01108f-e781-484b-997a-c1d4e218a3f4?source=cve
CVE: CVE-2023-0727
Published: 2023-02-07
Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_delete_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/62b56928-7125-4211-b233-07b5b51881c1?source=cve
CVE: CVE-2023-0730
Published: 2023-02-07
Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder_order function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4104f69f-b185-498a-aabf-2126ffb94ab3?source=cve
CVE: CVE-2023-0731
Published: 2023-02-07
Description: The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2861473%40interactive-geo-maps%2Ftrunk&old=2857078%40interactive-geo-maps%2Ftrunk&sfp_email=&sfph_mail=#file4; https://www.wordfence.com/threat-intel/vulnerabilities/id/95ce515a-377c-49b4-8d1b-7ac22769c759?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2861473%40interactive-geo-maps%2Ftrunk&old=2857078%40interactive-geo-maps%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE: CVE-2023-0735
Published: 2023-02-07
Description: Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/wallabag/wallabag/commit/268372dbbdd7ef87b84617fdebf95d0a86caf7dc; https://huntr.dev/bounties/8bc78cb1-b10b-4152-842e-ceb999fc5508; https://github.com/wallabag/wallabag/commit/268372dbbdd7ef87b84617fdebf95d0a86caf7dc
CVE: CVE-2023-0736
Published: 2023-02-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wallabag/wallabag/commit/4e023bddc3622ba5e901cc14a261fcb98d955cd7; https://huntr.dev/bounties/7e6f9614-6a96-4295-83f0-06a240be844e; https://github.com/wallabag/wallabag/commit/4e023bddc3622ba5e901cc14a261fcb98d955cd7
CVE: CVE-2023-23011
Published: 2023-02-07
Description: Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/e4ab1aedd9727c3b09c7d0154a052199; https://gist.github.com/enferas/e8fff9261526fdf51808c39b3004e1b5; https://gist.github.com/enferas/e4ab1aedd9727c3b09c7d0154a052199
CVE: CVE-2023-23026
Published: 2023-02-07
Description: Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to execute arbitrary code via the product_name and product_price inputs in file print.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/63b2bc406f[PII_REDACTED]9c26683e84ce; https://gist.github.com/enferas/63b2bc406f[PII_REDACTED]9c26683e84ce
CVE: CVE-2022-40480
Published: 2023-02-08
Description: Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial of Service (DoS) via a crafted ConReq packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://blediff.github.io/; https://blediff.github.io/
CVE: CVE-2022-45190
Published: 2023-02-08
Description: An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can bypass passkey entry in the legacy pairing of the device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://blediff.github.io/; https://blediff.github.io/
CVE: CVE-2022-45191
Published: 2023-02-08
Description: An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a pair confirm message with wrong values.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://www.microchip.com/en-us/support/product-change-notification; https://www.microchip.com/en-us/support/product-change-notification
CVE: CVE-2022-45192
Published: 2023-02-08
Description: An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a cleartext encryption pause request.
CVSS Score: 6.5 (MEDIUM)
References: https://blediff.github.io/; https://blediff.github.io/
CVE: CVE-2023-0718
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/2c26d6de-5653-4be8-9526-39b30cb61625?source=cve
CVE: CVE-2023-24828
Published: 2023-02-08
Description: Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-338
References: https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5; https://github.com/theonedev/onedev/security/advisories/GHSA-jf5c-9r77-3j5j; https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5