deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-34166
Published: 2023-06-19
Description: Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2023-34167
Published: 2023-06-19
Description: Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2023-34461
Published: 2023-06-19
Description: PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulnerability could have been exploited in which users could submit any type of HTML tag, and have said tag run. For example, a malicious `<a>` that looks like ```<a href=javascript:alert (1)>xss</a>``` could have been used to run code through JavaScript on the client side. The problem has been patched as of commit `5defd92`, and users are advised to upgrade. Attackers do need posting privilege in order to exploit this vulnerability. This vulnerability is present within the 0.1.0 release, and users are advised to upgrade to 0.1.1. Users unable to upgrade may be able to work around the attack by either; Removing the ability to create posts, removing the `|safe` tag from the Jinja2 template titled "post.html" in templates or by adding manual validation of links in the post creation section.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/benjjvi/PyBB/commit/5defd922ab05a193a783392d447c6538628cf854; https://github.com/benjjvi/PyBB/security/advisories/GHSA-mv96-w49p-438p; https://github.com/benjjvi/PyBB/commit/5defd922ab05a193a783392d447c6538628cf854
CVE: CVE-2023-35843
Published: 2023-06-19
Description: NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://advisory.dw1.io/60; https://github.com/nocodb/nocodb/blob/6decfa2b20c28db9946bddce0bcb1442b683ecae/packages/nocodb/src/lib/controllers/attachment.ctl.ts#L62-L74; https://github.com/nocodb/nocodb/blob/f7ee7e3beb91d313a159895d1edc1aba9d91b0bc/packages/nocodb/src/controllers/attachments.controller.ts#L55-L66
CVE: CVE-2023-3022
Published: 2023-06-19
Description: A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, sometimes holding rt6_info and other times fib6_info. This was not accounted for in other parts of the code where rt6_info was expected unconditionally, potentially leading to a kernel panic in fib6_rule_suppress.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://bugzilla.redhat.com/show_bug.cgi?id=2211440; https://github.com/torvalds/linux/commit/a65120bae4b7; https://bugzilla.redhat.com/show_bug.cgi?id=2211440
CVE: CVE-2023-3312
Published: 2023-06-19
Description: A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. This flaw, during device unbind will lead to double release problem leading to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415, CWE-415
References: https://patchwork.kernel.org/project/linux-pm/patch/[PII_REDACTED]4026.950622-1-krzysztof.kozlowski%40linaro.org/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://patchwork.kernel.org/project/linux-pm/patch/[PII_REDACTED]4026.950622-1-krzysztof.kozlowski%40linaro.org/
CVE: CVE-2023-29158
Published: 2023-06-19
Description: 


SUBNET PowerSYSTEM Center versions 2020 U10 and prior are vulnerable to replay attacks which may result in a denial-of-service condition or a loss of data integrity.







CVSS Score: 6.1 (MEDIUM)
CWE: CWE-294
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-01
CVE: CVE-2023-32659
Published: 2023-06-19
Description: 
SUBNET PowerSYSTEM Center versions 2020 U10 and prior contain a cross-site scripting vulnerability that may allow an attacker to inject malicious code into report header graphic files that could propagate out of the system and reach users who are subscribed to email notifications.





CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-01
CVE: CVE-2023-3315
Published: 2023-06-19
Description: Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2932; https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2932
CVE: CVE-2023-3320
Published: 2023-06-20
Description: The WP Sticky Social  plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation in the ~/admin/views/admin.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
References: http://packetstormsecurity.com/files/173048/WordPress-WP-Sticky-Social-1.0.1-CSRF-Cross-Site-Scripting.html; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2926150%40wp-sticky-social&new=2926150%40wp-sticky-social; https://www.wordfence.com/threat-intel/vulnerabilities/id/a272e12b-97a2-421a-a703-3acce2ed8313?source=cve
CVE: CVE-2023-3325
Published: 2023-06-20
Description: The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the '_cmsc_public_key' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation. This can only be exploited if the plugin has not been configured yet, however, if combined with another arbitrary plugin installation and activation vulnerability, the impact can be severe.
CVSS Score: 8.1 (HIGH)
CWE: CWE-345, CWE-331
References: https://plugins.trac.wordpress.org/browser/cms-commander-client/tags/2.287/init.php#L88; https://plugins.trac.wordpress.org/changeset/2927811/cms-commander-client; https://www.wordfence.com/threat-intel/vulnerabilities/id/ca37d453-9f9a-46b2-a17f-65a16e3e2ed1?source=cve
CVE: CVE-2023-35884
Published: 2023-06-20
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-3-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-3-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26427
Published: 2023-06-20
Description: Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known.


CVSS Score: 3.2 (LOW)
CWE: CWE-922, CWE-732
References: http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Jun/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
CVE: CVE-2023-26428
Published: 2023-06-20
Description: Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitly shared. We improved permission handling when requesting snippets that are not explicitly shared with other users. No publicly available exploits are known.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Jun/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
CVE: CVE-2023-26429
Published: 2023-06-20
Description: Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentially break the exported data structure. We now drop all control characters that are not whitespace character during the export. No publicly available exploits are known.


CVSS Score: 3.5 (LOW)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Jun/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
CVE: CVE-2023-26431
Published: 2023-06-20
Description: IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accounts could use this to bypass existing deny-list functionality and trigger requests to restricted network infrastructure to gain insight about topology and running services. We now respect possible IPV4-mapped IPv6 addresses when checking if contained in a deny-list. No publicly available exploits are known.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Jun/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
CVE: CVE-2023-26432
Published: 2023-06-20
Description: When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted SMTP server response to reasonable length/size. No publicly available exploits are known.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Jun/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
CVE: CVE-2023-26433
Published: 2023-06-20
Description: When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted IMAP server response to reasonable length/size. No publicly available exploits are known.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Jun/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
CVE: CVE-2023-26434
Published: 2023-06-20
Description: When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server response to reasonable length/size. No publicly available exploits are known.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Jun/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
CVE: CVE-2023-26435
Published: 2023-06-20
Description: It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read permissions of the open-xchange system user. This was limited to specific file-types, like images. We have improved existing content filters and validators to avoid including any local resources. No publicly available exploits are known.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Jun/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
CVE: CVE-2023-26436
Published: 2023-06-20
Description: Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processing the request. A check has been introduced to restrict processing of legal and expected classes for this API. We now log a warning in case there are attempts to inject illegal classes. No publicly available exploits are known.


CVSS Score: 7.1 (HIGH)
CWE: CWE-94, CWE-502
References: http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Jun/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
CVE: CVE-2023-35878
Published: 2023-06-20
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/extra-user-details/wordpress-extra-user-details-plugin-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/extra-user-details/wordpress-extra-user-details-plugin-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-35882
Published: 2023-06-20
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/super-socializer/wordpress-super-socializer-plugin-7-13-52-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/super-socializer/wordpress-super-socializer-plugin-7-13-52-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-1862
Published: 2023-06-20
Description: Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP connect and disconnect commands, as well as obtaining network diagnostics and application configuration from the target's device. It is important to note that in order to exploit this, a set of requirements would need to be met, such as the target's device must've been reachable on port 445, allowed authentication with NULL sessions or otherwise having knowledge of the target's credentials.


CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://developers.cloudflare.com/warp-client/get-started/windows/; https://github.com/cloudflare/advisories/security/advisories/GHSA-q55r-53c8-5642; https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release
CVE: CVE-2023-35097
Published: 2023-06-20
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Internet Marketing Dojo WP Affiliate Links plugin <= 0.1.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-affiliate-links/wordpress-wp-affiliate-links-plugin-0-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-affiliate-links/wordpress-wp-affiliate-links-plugin-0-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-35098
Published: 2023-06-20
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wordpress-nextgen-galleryview/wordpress-wordpress-nextgen-galleryview-plugin-0-5-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wordpress-nextgen-galleryview/wordpress-wordpress-nextgen-galleryview-plugin-0-5-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-1999
Published: 2023-06-20
Description: There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416, CWE-415, CWE-416
References: https://chromium.googlesource.com/webm/libwebp; https://security.gentoo.org/glsa/202309-05; https://chromium.googlesource.com/webm/libwebp
CVE: CVE-2023-35854
Published: 2023-06-20
Description: Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/970198175/Simply-use; https://www.manageengine.com; https://github.com/970198175/Simply-use
CVE: CVE-2023-3337
Published: 2023-06-20
Description: A vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/reg.php of the component Admin Registration. The manipulation leads to improper authentication. The attack can be launched remotely. The identifier VDB-232009 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://vuldb.com/?ctiid.232009; https://vuldb.com/?id.232009; https://vuldb.com/?ctiid.232009
CVE: CVE-2023-33495
Published: 2023-06-20
Description: Craft CMS through 4.4.9 is vulnerable to HTML Injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212; https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection; https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
CVE: CVE-2023-34596
Published: 2023-06-20
Description: A vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.
CVSS Score: 6.5 (MEDIUM)
References: https://aeotec.com/products/aeotec-wallmote-quad/%3B; https://github.com/iot-sec23/IoT-CVE/blob/main/Aeotec%20WallMote%20Switch%20Vulnerability%20Report.pdf; https://aeotec.com/products/aeotec-wallmote-quad/%3B
CVE: CVE-2023-34597
Published: 2023-06-20
Description: A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/iot-sec23/IoT-CVE/blob/main/Fibaro%20Motion%20Sensor%20Vulnerability%20Report.pdf; https://www.fibaro.com/en/products/motion-sensor/%3B; https://github.com/iot-sec23/IoT-CVE/blob/main/Fibaro%20Motion%20Sensor%20Vulnerability%20Report.pdf
CVE: CVE-2023-35095
Published: 2023-06-20
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flothemes Flo Forms – Easy Drag & Drop Form Builder plugin <= 1.0.40 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/flo-forms/wordpress-flo-forms-plugin-1-0-40-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/flo-forms/wordpress-flo-forms-plugin-1-0-40-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2020-20067
Published: 2023-06-20
Description: File upload vulnerability in ebCMS v.1.1.0 allows a remote attacker to execute arbitrary code via the upload type parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/a932278490/ebcms/issues/1; https://github.com/a932278490/ebcms/issues/1
CVE: CVE-2020-20070
Published: 2023-06-20
Description: Cross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld parameter of the qu-multi-fillblank!answers.action file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/wkeyuan/DWSurvey/issues/48; https://github.com/wkeyuan/DWSurvey/issues/48
CVE: CVE-2020-20335
Published: 2023-06-20
Description: Buffer Overflow vulnerability in Antirez Kilo before commit 7709a04ae8520c5b04d261616098cebf742f5a23 allows a remote attacker to cause a denial of service via the editorUpdateRow function in kilo.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/antirez/kilo/issues/60; https://github.com/antirez/kilo/issues/60
CVE: CVE-2020-20413
Published: 2023-06-20
Description: SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/SuperSalsa20/WUZHICMS-SQL-Injection/blob/master/README.md; https://github.com/SuperSalsa20/WUZHICMS-SQL-Injection/blob/master/README.md
CVE: CVE-2020-20491
Published: 2023-06-20
Description: SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function in upload/admin/index.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/opencart/opencart/issues/7612; https://github.com/opencart/opencart/issues/7612
CVE: CVE-2020-20502
Published: 2023-06-20
Description: Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.yzmcms.com/; https://github.com/yzmcms/yzmcms/issues/27; http://www.yzmcms.com/
CVE: CVE-2020-20636
Published: 2023-06-20
Description: SQL injection vulnerability found in Joyplus-cms v.1.6.0 allows a remote attacker to access sensitive information via the id parameter of the goodbad() function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/joyplus/joyplus-cms/issues/447; https://github.com/joyplus/joyplus-cms/issues/447