deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39393
Published: 2023-08-13
Description: Vulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation of this vulnerability may cause ServiceWifiResources to be maliciously modified and overwritten.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-347
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39396
Published: 2023-08-13
Description: Deserialization vulnerability in the input module. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-502
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39405
Published: 2023-08-13
Description: Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Successful exploitation of this vulnerability may cause other apps to be executed with escalated privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2021-46895
Published: 2023-08-13
Description: Vulnerability of defects introduced in the design process in the Multi-Device Task Center. Successful exploitation of this vulnerability will cause the hopped app to bypass the app lock and reset the device that initiates the hop.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-701
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39385
Published: 2023-08-13
Description: Vulnerability of configuration defects in the media module of certain products.. Successful exploitation of this vulnerability may cause unauthorized access.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-16
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39386
Published: 2023-08-13
Description: Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause newly installed apps to fail to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-20, CWE-116
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39387
Published: 2023-08-13
Description: Vulnerability of permission control in the window management module. Successful exploitation of this vulnerability may cause malicious pop-up windows.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39390
Published: 2023-08-13
Description: Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the device to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20, CWE-116
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39391
Published: 2023-08-13
Description: Vulnerability of system file information leakage in the USB Service module. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39394
Published: 2023-08-13
Description: Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may cause the arp list to be modified.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39395
Published: 2023-08-13
Description: Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39397
Published: 2023-08-13
Description: Input parameter verification vulnerability in the communication system. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39398
Published: 2023-08-13
Description: Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-275, CWE-285
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39399
Published: 2023-08-13
Description: Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-275, CWE-285
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39400
Published: 2023-08-13
Description: Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-285
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39401
Published: 2023-08-13
Description: Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-285
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39402
Published: 2023-08-13
Description: Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-285
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39403
Published: 2023-08-13
Description: Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-358, CWE-285
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39404
Published: 2023-08-13
Description: Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the device to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39406
Published: 2023-08-13
Description: Permission control vulnerability in the XLayout component. Successful exploitation of this vulnerability may cause apps to forcibly restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-23208
Published: 2023-08-13
Description: Genesys Administrator Extension (GAX) before 9.0.105.15 is vulnerable to Cross Site Scripting (XSS) via the Business Structure page of the iWD plugin, aka GAX-11261.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.genesys.com/Documentation/RN/9.0.x/gax90rn/gax9010515; https://docs.genesys.com/Documentation/RN/9.0.x/gax90rn/gax9010515
CVE: CVE-2023-40274
Published: 2023-08-14
Description: An issue was discovered in zola 0.13.0 through 0.17.2. The custom implementation of a web server, available via the "zola serve" command, allows directory traversal. The handle_request function, used by the server to process HTTP requests, does not account for sequences of special path control characters (../) in the URL when serving a file, which allows one to escape the webroot of the server and read arbitrary files from the filesystem.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/getzola/zola/issues/2257; https://github.com/getzola/zola/pull/2258; https://github.com/getzola/zola/issues/2257
CVE: CVE-2023-40283
Published: 2023-08-14
Description: An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html; http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html; https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.10
CVE: CVE-2023-3259
Published: 2023-08-14
Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the malicious agent to take actions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts, and exporting confidential user information
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html; https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE: CVE-2023-3260
Published: 2023-08-14
Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html; https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE: CVE-2023-3261
Published: 2023-08-14
Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier contains a buffer overflow vulnerability in the librta.so.0.0.0 library.Successful exploitation could cause denial of service or unexpected behavior with respect to all interactions relying on the targeted vulnerable binary, including the ability to log in via the web server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-78
References: https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html; https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE: CVE-2023-3262
Published: 2023-08-14
Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database.A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html; https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE: CVE-2023-40291
Published: 2023-08-14
Description: Harman Infotainment[PII_REDACTED]1613 allows root access via SSH over a USB-to-Ethernet dongle with a password that is an internal project name.
CVSS Score: 6.8 (MEDIUM)
References: https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/; https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/
CVE: CVE-2023-40292
Published: 2023-08-14
Description: Harman Infotainment[PII_REDACTED]1613 and later discloses the IP address via CarPlay CTRL packets.
CVSS Score: 4.3 (MEDIUM)
References: https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/; https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/
CVE: CVE-2023-40293
Published: 2023-08-14
Description: Harman Infotainment[PII_REDACTED]1613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/; https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/
CVE: CVE-2023-40294
Published: 2023-08-14
Description: libboron in Boron 2.0.8 has a heap-based buffer overflow in ur_parseBlockI at i_parse_blk.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/0branch/boron/issues/3; https://github.com/0branch/boron/issues/3
CVE: CVE-2023-40295
Published: 2023-08-14
Description: libboron in Boron 2.0.8 has a heap-based buffer overflow in ur_strInitUtf8 at string.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/0branch/boron/issues/3; https://github.com/0branch/boron/issues/3
CVE: CVE-2023-40296
Published: 2023-08-14
Description: async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in ReceiveFrom and Receive in udpsocket.hpp when processing malformed UDP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/eminfedar/async-sockets-cpp/issues/32; https://github.com/eminfedar/async-sockets-cpp/issues/32
CVE: CVE-2023-3263
Published: 2023-08-14
Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials.Successful exploitation allows the malicious agent to obtain a valid authorization token and read information relating to the state of the relays and power distribution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-289, CWE-287
References: https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html; https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE: CVE-2023-3264
Published: 2023-08-14
Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html; https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE: CVE-2023-3265
Published: 2023-08-14
Description: An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator with hardcoded default credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-150
References: https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html; https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE: CVE-2023-3266
Published: 2023-08-14
Description: A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator by selecting LDAP authentication from a hidden HTML combo box. Successful exploitation of this vulnerability also requires the attacker to know at least one username on the device, but any password will authenticate successfully.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-358
References: https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html; https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE: CVE-2023-3267
Published: 2023-08-14
Description: When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with system-level access to the CyberPower PowerPanel Enterprise server.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html; https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE: CVE-2023-40303
Published: 2023-08-14
Description: GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop privileges before letting an ordinary user control the activities of the process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-252
References: http://www.openwall.com/lists/oss-security/2023/12/30/4; https://ftp.gnu.org/gnu/inetutils/; https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6
CVE: CVE-2023-40305
Published: 2023-08-14
Description: GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://ftp.gnu.org/gnu/indent/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W6SL3NKMH5R4S5PD2O3MTC2UR4SBVHK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4MIUH3F63KQJWYR3FLKRZUYYRJOY6FYX/
CVE: CVE-2023-3160
Published: 2023-08-14
Description: 
The vulnerability potentially allows an attacker to misuse ESET’s file operations during the module update to delete or move files without having proper permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://support.eset.com/en/ca8466; https://support.eset.com/en/ca8466
CVE: CVE-2023-4321
Published: 2023-08-14
Description: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cockpit-hq/cockpit/commit/34ab31ee9362da51b9709e178469dbffd7717249; https://huntr.dev/bounties/fce38751-bfd6-484c-b6e1-935e0aa8ffdc; https://github.com/cockpit-hq/cockpit/commit/34ab31ee9362da51b9709e178469dbffd7717249
CVE: CVE-2023-37847
Published: 2023-08-14
Description: novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://novel-plus.com; https://github.com/KingBangQ/CVE-2023-37847/blob/main/README.md; https://novel.xxyopen.com/index.htm
CVE: CVE-2023-30186
Published: 2023-08-14
Description: A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://onlyoffice.com; https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2; https://github.com/ONLYOFFICE/DocumentServer
CVE: CVE-2023-30187
Published: 2023-08-14
Description: An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://onlyoffice.com; https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2; https://github.com/ONLYOFFICE/DocumentServer
CVE: CVE-2023-30188
Published: 2023-08-14
Description: Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://onlyoffice.com; https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2; https://github.com/ONLYOFFICE/DocumentServer
CVE: CVE-2023-37070
Published: 2023-08-14
Description: Code Projects Hospital Information System 1.0 is vulnerable to Cross Site Scripting (XSS)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://code-projects.org/hospital-information-system-in-php-with-source-code/; https://github.com/InfoSecWarrior/Offensive-Payloads/blob/main/Cross-Site-Scripting-XSS-Payloads.txt; https://github.com/Mr-Secure-Code/My-CVE/blob/main/CVE-2023-37070-Exploit.md
CVE: CVE-2023-29097
Published: 2023-08-14
Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in a3rev Software a3 Portfolio plugin <= 3.1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/a3-portfolio/wordpress-a3-portfolio-plugin-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/a3-portfolio/wordpress-a3-portfolio-plugin-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve