deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41221
Published: 2023-05-24
Description: The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client (Versions 16.2.3, 21.2, and older versions) could upload XML files to the application that it did not sufficiently validate. As a result, attackers could craft XML files that, when processed by the application, would cause a negative security impact such as data exfiltration or localized denial of service against the application instance and system of the user running it.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611, CWE-611
References: https://labs.withsecure.com/advisories/opentext-archive-center-administration-client-xxe-vulnerability; https://labs.withsecure.com/advisories/opentext-archive-center-administration-client-xxe-vulnerability
CVE: CVE-2023-25599
Published: 2023-05-24
Description: A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the test_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0003; https://www.mitel.com/support/security-advisories
CVE: CVE-2023-29721
Published: 2023-05-24
Description: SofaWiki <= 3.8.9 has a file upload vulnerability that leads to command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/bellenuit/sofawiki/issues/27; https://github.com/xul18/Showcase/issues/2; https://github.com/bellenuit/sofawiki/issues/27
CVE: CVE-2023-31458
Published: 2023-05-24
Description: A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0005; https://www.mitel.com/support/security-advisories
CVE: CVE-2023-33829
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/172588/SCM-Manager-1.60-Cross-Site-Scripting.html; https://bitbucket.org/sdorra/docker-scm-manager/src/master/; https://github.com/n3gox/Stored-XSS-on-SCM-Manager-1.60
CVE: CVE-2022-4815
Published: 2023-05-24
Description: 
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. 


CVSS Score: 8.0 (HIGH)
CWE: CWE-502, CWE-502
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]285-IMPORTANT-Resolved-Pentaho-BA-Server-Deserialization-of-Untrusted-Data-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2022-4815-; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]285-IMPORTANT-Resolved-Pentaho-BA-Server-Deserialization-of-Untrusted-Data-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2022-4815-
CVE: CVE-2023-1158
Published: 2023-05-24
Description: 
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]741-IMPORTANT-Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2023-1158-; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]741-IMPORTANT-Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2023-1158-
CVE: CVE-2023-33248
Published: 2023-05-24
Description: Amazon Alexa software version[PII_REDACTED] on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz (often outside the range of human adult hearing). Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful.
CVSS Score: 7.6 (HIGH)
References: https://arxiv.org/abs/2305.10358; https://cios2023.org/papers; https://github.com/reveondivad/nuance
CVE: CVE-2023-1601
Published: 2023-05-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-2500
Published: 2023-05-25
Description: The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'go_pricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://codecanyon.net/item/go-pricing-wordpress-responsive-pricing-tables/3725820; https://www.wordfence.com/threat-intel/vulnerabilities/id/f7686b11-97a8-4f09-bbfa-d77120cc35b7?source=cve; https://codecanyon.net/item/go-pricing-wordpress-responsive-pricing-tables/3725820
CVE: CVE-2023-31594
Published: 2023-05-25
Description: IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://ic.com; https://github.com/Yozarseef95/CVE-2023-31594; http://ic.com
CVE: CVE-2023-31861
Published: 2023-05-25
Description: ZLMediaKit 4.0 is vulnerable to Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://gist.github.com/nbb651/5aa72867fc1df3ef52e690b293964aac; https://github.com/nbb651/CVE-ZLMediaKit/blob/main/README.md; https://gist.github.com/nbb651/5aa72867fc1df3ef52e690b293964aac
CVE: CVE-2023-2732
Published: 2023-05-25
Description: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/listing-rest-api/class.api.fields.php#L1079; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2916124%40mstore-api&old=2915729%40mstore-api&sfp_email=&sfph_mail=#file58; https://www.wordfence.com/threat-intel/vulnerabilities/id/f00761a7-fe24-49a3-b3e3-a471e05815c1?source=cve
CVE: CVE-2023-2733
Published: 2023-05-25
Description: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/flutter-woo.php#L734; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2913397%40mstore-api&old=2910707%40mstore-api&sfp_email=&sfph_mail=#file60; https://www.wordfence.com/threat-intel/vulnerabilities/id/c726d8f0-7f2a-414b-9d73-a053921074d9?source=cve
CVE: CVE-2023-2734
Published: 2023-05-25
Description: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/flutter-woo.php#L911; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2915729%40mstore-api&old=2913397%40mstore-api&sfp_email=&sfph_mail=#file59; https://www.wordfence.com/threat-intel/vulnerabilities/id/5881d16c-84e8-4610-8233-cfa5a94fe3f9?source=cve
CVE: CVE-2022-46907
Published: 2023-05-25
Description: A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.  Apache JSPWiki users should upgrade to 2.12.0 or later.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2023/05/25/1; https://lists.apache.org/thread/1m0mkq2nttx8tn94m11mytn4f0tv1504; http://www.openwall.com/lists/oss-security/2023/05/25/1
CVE: CVE-2023-1588
Published: 2023-05-25
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-41635
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Zorem Advanced Shipment Tracking for WooCommerce plugin <= 3.5.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-advanced-shipment-tracking/wordpress-advanced-shipment-tracking-for-woocommerce-plugin-3-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-advanced-shipment-tracking/wordpress-advanced-shipment-tracking-for-woocommerce-plugin-3-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-46800
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache plugin <= 5.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-5-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-5-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-46812
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-thank-you-page-customizer/wordpress-thank-you-page-customizer-for-woocommerce-increase-your-sales-plugin-1-0-13-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/woo-thank-you-page-customizer/wordpress-thank-you-page-customizer-for-woocommerce-increase-your-sales-plugin-1-0-13-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-46865
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <= 1.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/bulk-resize-media/wordpress-bulk-resize-media-plugin-1-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/bulk-resize-media/wordpress-bulk-resize-media-plugin-1-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-46866
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/import-external-images/wordpress-import-external-images-plugin-1-4-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/import-external-images/wordpress-import-external-images-plugin-1-4-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47135
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <= 7.0.9 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/chronoforms/wordpress-chronoforms-plugin-7-0-9-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/chronoforms/wordpress-chronoforms-plugin-7-0-9-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47138
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/login-attempts-limit-wp/wordpress-login-and-registration-attempts-limit-plugin-2-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/login-attempts-limit-wp/wordpress-login-and-registration-attempts-limit-plugin-2-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47139
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <= 5.2.15 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-basic-elements/wordpress-wp-basic-elements-plugin-5-2-15-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/wp-basic-elements/wordpress-wp-basic-elements-plugin-5-2-15-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47159
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Logaster Logaster Logo Generator plugin <= 1.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/logaster-logo-generator/wordpress-logaster-logo-generator-plugin-1-3-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/logaster-logo-generator/wordpress-logaster-logo-generator-plugin-1-3-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47164
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/mage-eventpress/wordpress-event-manager-and-tickets-selling-plugin-for-woocommerce-plugin-3-7-7-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/mage-eventpress/wordpress-event-manager-and-tickets-selling-plugin-for-woocommerce-plugin-3-7-7-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-2881
Published: 2023-05-25
Description: Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-257, CWE-522
References: https://github.com/pimcore/customer-data-framework/commit/d1d58c10313f080737dc1e71fab3beb12488a1e6; https://huntr.dev/bounties/db6c32f4-742e-4262-8fd5-cefd0f133416; https://github.com/pimcore/customer-data-framework/commit/d1d58c10313f080737dc1e71fab3beb12488a1e6
CVE: CVE-2023-2882
Published: 2023-05-25
Description: Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1270
References: https://www.usom.gov.tr/bildirim/tr-23-0293; https://www.usom.gov.tr/bildirim/tr-23-0293
CVE: CVE-2023-2883
Published: 2023-05-25
Description: Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.


CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-23-0293; https://www.usom.gov.tr/bildirim/tr-23-0293
CVE: CVE-2023-2884
Published: 2023-05-25
Description: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330, CWE-338
References: https://www.usom.gov.tr/bildirim/tr-23-0293; https://www.usom.gov.tr/bildirim/tr-23-0293
CVE: CVE-2023-2885
Published: 2023-05-25
Description: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM).This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.


CVSS Score: 8.1 (HIGH)
CWE: CWE-924, CWE-924
References: https://www.usom.gov.tr/bildirim/tr-23-0293; https://www.usom.gov.tr/bildirim/tr-23-0293
CVE: CVE-2023-2886
Published: 2023-05-25
Description: Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1385, CWE-346
References: https://www.usom.gov.tr/bildirim/tr-23-0293; https://www.usom.gov.tr/bildirim/tr-23-0293
CVE: CVE-2023-2887
Published: 2023-05-25
Description: Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: https://www.usom.gov.tr/bildirim/tr-23-0293; https://www.usom.gov.tr/bildirim/tr-23-0293
CVE: CVE-2022-45367
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Custom Order Numbers for WooCommerce plugin <= 1.4.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/custom-order-numbers-for-woocommerce/wordpress-custom-order-numbers-for-woocommerce-plugin-1-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-order-numbers-for-woocommerce/wordpress-custom-order-numbers-for-woocommerce-plugin-1-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-47149
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pretty Links plugin <= 3.4.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/pretty-link/wordpress-pretty-links-affiliate-links-link-branding-link-tracking-marketing-plugin-plugin-3-4-0-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/pretty-link/wordpress-pretty-links-affiliate-links-link-branding-link-tracking-marketing-plugin-plugin-3-4-0-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47161
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/health-check/wordpress-health-check-troubleshooting-plugin-1-5-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/health-check/wordpress-health-check-troubleshooting-plugin-1-5-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47165
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule plugin <= 3.3.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/coschedule-by-todaymade/wordpress-coschedule-plugin-3-3-8-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/coschedule-by-todaymade/wordpress-coschedule-plugin-3-3-8-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47177
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wp-easy-pay/wordpress-wp-easypay-square-for-wordpress-plugin-4-0-4-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/wp-easy-pay/wordpress-wp-easypay-square-for-wordpress-plugin-4-0-4-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-27529
Published: 2023-05-25
Description: Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vulnerability. When a user is tricked to execute a small malicious script before executing the affected version of the installer, arbitrary code may be executed with the root privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://jvn.jp/en/jp/JVN90278893/; https://www.wacom.com/en-us/support/product-support/drivers; https://jvn.jp/en/jp/JVN90278893/
CVE: CVE-2023-28370
Published: 2023-05-25
Description: Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/tornadoweb/tornado/releases/tag/v6.3.2; https://jvn.jp/en/jp/JVN45127776/; https://github.com/tornadoweb/tornado/releases/tag/v6.3.2
CVE: CVE-2023-30484
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in uPress Enable Accessibility plugin <= 1.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/enable-accessibility/wordpress-enable-accessibility-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/enable-accessibility/wordpress-enable-accessibility-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-38356
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/pearl-header-builder/wordpress-pearl-plugin-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pearl-header-builder/wordpress-pearl-plugin-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-38716
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/motors-car-dealership-classified-listings/wordpress-motors-plugin-1-4-4-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve; https://patchstack.com/database/vulnerability/motors-car-dealership-classified-listings/wordpress-motors-plugin-1-4-4-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve