deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-39161
Published: 2023-05-03
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information.  IBM X-Force  ID:  235069.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235069; https://www.ibm.com/support/pages/node/6987779; https://exchange.xforce.ibmcloud.com/vulnerabilities/235069
CVE: CVE-2023-24744
Published: 2023-05-03
Description: Cross Site Scripting (XSS) vulnerability in Rediker Software AdminPlus 6.1.91.00 allows remote attackers to run arbitrary code via the onload function within the application DOM.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/HeidiSecurities/CVEs/blob/main/CVE-2023-24744/Rediker%20-%20XSS%20%28Reflected%20&%20DOM-based%29.md; https://github.com/HeidiSecurities/CVEs/blob/main/CVE-2023-24744/Rediker%20-%20XSS%20%28Reflected%20&%20DOM-based%29.md
CVE: CVE-2023-30300
Published: 2023-05-03
Description: An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://github.com/WebAssembly/wabt/issues/2180; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OSFFCKXUQ5PAC5UVXY7N6HEHVQ3AC2RG/; https://github.com/WebAssembly/wabt/issues/2180
CVE: CVE-2023-0155
Published: 2023-05-03
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0155.json; https://gitlab.com/gitlab-org/gitlab/-/issues/387638; https://hackerone.com/reports/1817250
CVE: CVE-2023-0485
Published: 2023-05-03
Description: An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0485.json; https://gitlab.com/gitlab-org/gitlab/-/issues/389191; https://hackerone.com/reports/1837937
CVE: CVE-2023-1204
Published: 2023-05-03
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically crafted request on user update settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-347
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1204.json; https://gitlab.com/gitlab-org/gitlab/-/issues/394745; https://hackerone.com/reports/1881598
CVE: CVE-2023-1265
Published: 2023-05-03
Description: An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1265.json; https://gitlab.com/gitlab-org/gitlab/-/issues/394960; https://hackerone.com/reports/1888690
CVE: CVE-2023-1836
Published: 2023-05-03
Description: A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be made to render as HTML if viewed under specific circumstances
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1836.json; https://gitlab.com/gitlab-org/gitlab/-/issues/404613; https://hackerone.com/reports/1923293
CVE: CVE-2023-1965
Published: 2023-05-03
Description: An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for 3rd party Group SAML SSO logins. This feature isn't enabled by default.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1965.json; https://gitlab.com/gitlab-org/gitlab/-/issues/406235; https://hackerone.com/reports/1923672
CVE: CVE-2023-2069
Published: 2023-05-03
Description: An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD variables.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-668
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2069.json; https://gitlab.com/gitlab-org/gitlab/-/issues/407374; https://hackerone.com/reports/1939987
CVE: CVE-2023-30204
Published: 2023-05-03
Description: Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the judge_id parameter at /php-jms/edit_judge.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/debug601/bug_report/blob/main/vendors/oretnom23/judging-management-system/SQLi-3.md; https://github.com/debug601/bug_report/blob/main/vendors/oretnom23/judging-management-system/SQLi-3.md
CVE: CVE-2023-30205
Published: 2023-05-03
Description: A stored cross-site scripting (XSS) vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the unique_id parameter in /admin/article.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/godd-bot/cve/issues/2; https://github.com/godd-bot/cve/issues/2
CVE: CVE-2022-43950
Published: 2023-05-03
Description: A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, 
 8.8 all versions, 8.7 all versions may allow an unauthenticated attacker to redirect users to any arbitrary website via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://fortiguard.com/psirt/FG-IR-22-407; https://fortiguard.com/psirt/FG-IR-22-407
CVE: CVE-2022-45858
Published: 2023-05-03
Description: A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all versions may increase the chances of an attacker to have access to sensitive information or to perform man-in-the-middle attacks.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://fortiguard.com/psirt/FG-IR-22-452; https://fortiguard.com/psirt/FG-IR-22-452
CVE: CVE-2022-45859
Published: 2023-05-03
Description: An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://fortiguard.com/psirt/FG-IR-22-456; https://fortiguard.com/psirt/FG-IR-22-456
CVE: CVE-2022-45860
Published: 2023-05-03
Description: A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increased chance of success.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1390, CWE-287
References: https://fortiguard.com/psirt/FG-IR-22-464; https://fortiguard.com/psirt/FG-IR-22-464
CVE: CVE-2022-4376
Published: 2023-05-03
Description: An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab account on an instance.
CVSS Score: 3.1 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4376.json; https://gitlab.com/gitlab-org/gitlab/-/issues/385246; https://hackerone.com/reports/1794713
CVE: CVE-2023-0756
Published: 2023-05-03
Description: An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems.
CVSS Score: 4.8 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0756.json; https://gitlab.com/gitlab-org/gitlab/-/issues/390910; https://hackerone.com/reports/1864278
CVE: CVE-2023-0805
Published: 2023-05-03
Description: An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a public group even after being banned from the public group by the owner.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0805.json; https://gitlab.com/gitlab-org/gitlab/-/issues/391433; https://hackerone.com/reports/1850046
CVE: CVE-2023-1178
Published: 2023-05-03
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-94
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1178.json; https://gitlab.com/gitlab-org/gitlab/-/issues/381815; https://hackerone.com/reports/1778009
CVE: CVE-2023-22637
Published: 2023-05-03
Description: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-23-013; https://fortiguard.com/psirt/FG-IR-23-013
CVE: CVE-2023-22640
Published: 2023-05-03
Description: A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS version 6.2.0 through 6.2.13, FortiOS all versions 6.0,  FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://fortiguard.com/psirt/FG-IR-22-475; https://fortiguard.com/psirt/FG-IR-22-475
CVE: CVE-2023-26203
Published: 2023-05-03
Description: A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an authenticated attacker to access to the database via shell commands.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://fortiguard.com/psirt/FG-IR-22-520; https://fortiguard.com/psirt/FG-IR-22-520
CVE: CVE-2023-27993
Published: 2023-05-03
Description: A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://fortiguard.com/psirt/FG-IR-23-069; https://fortiguard.com/psirt/FG-IR-23-069
CVE: CVE-2023-27999
Published: 2023-05-03
Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-297; https://fortiguard.com/psirt/FG-IR-22-297
CVE: CVE-2023-2182
Published: 2023-05-03
Description: An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users.
CVSS Score: 6.8 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2182.json; https://gitlab.com/gitlab-org/gitlab/-/issues/403012; https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2182.json
CVE: CVE-2022-47757
Published: 2023-05-04
Description: In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's data directory. This may allow an attacker to save a shared library under a special directory which the app uses to dynamically load modules. Loading the library can lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-ghf9-x3c5-3mwj; https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-ghf9-x3c5-3mwj
CVE: CVE-2023-25438
Published: 2023-05-04
Description: An issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute arbitrary code and gain escalated privileges via modifying specific files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://millegpg.it/; https://packetstormsecurity.com/files/172052/MilleGPG5-5.9.2-Local-Privilege-Escalation.html; https://millegpg.it/
CVE: CVE-2023-27075
Published: 2023-05-04
Description: A cross-site scripting vulnerability (XSS) in the component microbin/src/pasta.rs of Microbin v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/szabodanika/microbin/issues/142; https://github.com/szabodanika/microbin/pull/143; https://github.com/szabodanika/microbin/issues/142
CVE: CVE-2023-27568
Published: 2023-05-04
Description: SQL injection vulnerability inSpryker Commerce OS 0.9 that allows for access to sensitive data via customer/order?orderSearchForm[searchText]=
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/172257/Spryker-Commerce-OS-1.0-SQL-Injection.html; http://seclists.org/fulldisclosure/2023/May/2; https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-001.txt
CVE: CVE-2023-31099
Published: 2023-05-04
Description: Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.
CVSS Score: 8.8 (HIGH)
References: https://manageengine.com; https://www.manageengine.com/network-monitoring/security-updates/cve-2023-31099.html; https://manageengine.com
CVE: CVE-2023-29842
Published: 2023-05-04
Description: ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/175105/ChurchCRM-4.5.4-SQL-Injection.html; https://github.com/ChurchCRM/CRM; https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/CVE-2023-29842.md
CVE: CVE-2023-30077
Published: 2023-05-04
Description: Judging Management System v1.0 by oretnom23 was discovered to vulnerable to SQL injection via /php-jms/review_result.php?mainevent_id=, mainevent_id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Dzero57/cve_report/blob/main/judging-management-system/SQLi-1.md; https://www.github.com; https://github.com/Dzero57/cve_report/blob/main/judging-management-system/SQLi-1.md
CVE: CVE-2023-30331
Published: 2023-05-04
Description: An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
References: https://gitee.com/xiandafu/beetl/issues/I6RUIP; https://github.com/luelueking/Beetl-3.15.0-vuln-poc; https://gitee.com/xiandafu/beetl/issues/I6RUIP
CVE: CVE-2023-26125
Published: 2023-05-04
Description: Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.**Note:** Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-20, CWE-20, CWE-77
References: https://github.com/gin-gonic/gin/pull/3500; https://github.com/gin-gonic/gin/pull/3503; https://github.com/gin-gonic/gin/releases/tag/v1.9.0
CVE: CVE-2023-25934
Published: 2023-05-04
Description: 
DELL ECS prior to 3.8.0.2 contains an improper verification of cryptographic signature vulnerability. A network attacker with an ability to intercept the request could potentially exploit this vulnerability to modify the body data of the request.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-347, CWE-347, CWE-347
References: https://www.dell.com/support/kbdoc/en-us/000212970/dsa-2023-109-dell-ecs-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000212970/dsa-2023-109-dell-ecs-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-22651
Published: 2023-05-04
Description: Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to
 the misconfiguration of the Webhook. This component enforces validation
 rules and security checks before resources are admitted into the 
Kubernetes cluster.
The issue only affects users that upgrade from 2.6.x or 2.7.x to 2.7.2. Users that did a fresh install of 2.7.2 (and did not follow an upgrade path) are not affected.


CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269, CWE-276
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22651; https://github.com/rancher/rancher/security/advisories/GHSA-6m9f-pj6w-w87g; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22651
CVE: CVE-2017-20184
Published: 2023-05-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Carlo Gavazzi Powersoft up to version 2.1.1.1 allows an unauthenticated, remote attacker to download any file from the affected device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.exploit-db.com/exploits/42705; https://www.exploit-db.com/exploits/42705
CVE: CVE-2022-4259
Published: 2023-05-04
Description: Due to improper input validation in the Alerts controller, a SQL injection vulnerability in Nozomi Networks Guardian and CMC allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://security.nozominetworks.com/NN-2023:1-01; https://security.nozominetworks.com/NN-2023:1-01
CVE: CVE-2022-45818
Published: 2023-05-04
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate plugin <= 1.3.4 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/hero-banner-ultimate/wordpress-hero-banner-ultimate-plugin-1-3-4-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/hero-banner-ultimate/wordpress-hero-banner-ultimate-plugin-1-3-4-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25962
Published: 2023-05-04
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari Accordion – Multiple Accordion or FAQs Builder plugin <= 2.3.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-multiple-accordions-or-faqs-builder-plugin-2-3-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-multiple-accordions-or-faqs-builder-plugin-2-3-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-26016
Published: 2023-05-04
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tauhidul Alam Simple Portfolio Gallery plugin <= 0.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-portfolio-gallery/wordpress-simple-portfolio-gallery-plugin-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-portfolio-gallery/wordpress-simple-portfolio-gallery-plugin-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23470
Published: 2023-05-04
Description: IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default configurations, as a result of improper SQL processing. By using a specially crafted SQL operation, the administrator could exploit the vulnerability to perform additional administrator operations.  IBM X-Force ID:  244510.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-89, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244510; https://www.ibm.com/support/pages/node/6987767; https://exchange.xforce.ibmcloud.com/vulnerabilities/244510
CVE: CVE-2023-24958
Published: 2023-05-04
Description: A vulnerability in the IBM TS7700 Management Interface 8.51.2.12, 8.52.200.111, 8.52.102.13, and 8.53.0.63 could allow an authenticated user to submit a specially crafted URL leading to privilege escalation and remote code execution.  IBM X-Force ID:  246320.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/246320; https://www.ibm.com/support/pages/node/6980845; https://exchange.xforce.ibmcloud.com/vulnerabilities/246320
CVE: CVE-2023-26010
Published: 2023-05-04
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App plugin <= 11.18 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpappninja/wordpress-wpmobile-app-android-and-ios-mobile-application-plugin-11-18-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpappninja/wordpress-wpmobile-app-android-and-ios-mobile-application-plugin-11-18-cross-site-scripting-xss-vulnerability?_s_id=cve