deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27231
Published: 2023-03-28
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Am1ngl/ttt/tree/main/31; https://github.com/Am1ngl/ttt/tree/main/31
CVE: CVE-2023-1681
Published: 2023-03-28
Description: A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Affected is an unknown function of the file /config/myfield/test.php. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-224238 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/[PII_REDACTED]/CMS-bug/blob/main/Informationdisclosure-1.md; https://vuldb.com/?ctiid.224238; https://vuldb.com/?id.224238
CVE: CVE-2023-27232
Published: 2023-03-28
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Am1ngl/ttt/tree/main/32; https://github.com/Am1ngl/ttt/tree/main/32
CVE: CVE-2023-1682
Published: 2023-03-29
Description: A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui/My/Config/Install.txt. The manipulation leads to direct request. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224239.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425, CWE-425
References: https://github.com/[PII_REDACTED]/CMS-bug/blob/main/Informationdisclosure-1.md; https://vuldb.com/?ctiid.224239; https://vuldb.com/?id.224239
CVE: CVE-2023-1683
Published: 2023-03-29
Description: A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/system_log.html. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224240.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-312
References: https://github.com/[PII_REDACTED]/CMS-bug/blob/main/Informationdisclosure-1.md; https://vuldb.com/?ctiid.224240; https://vuldb.com/?id.224240
CVE: CVE-2023-1684
Published: 2023-03-29
Description: A vulnerability was found in HadSky 7.7.16. It has been classified as problematic. This affects an unknown part of the file upload/index.php?c=app&a=superadmin:index. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224241 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://gitee.com/wkstestete/cve/blob/master/upload/HadSky.md; https://vuldb.com/?ctiid.224241; https://vuldb.com/?id.224241
CVE: CVE-2023-23355
Published: 2023-03-29
Description: An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors.
QES is not affected.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2346 build 20230322 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2348 build 20230324 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later

CVSS Score: 6.6 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-23-10; https://www.qnap.com/en/security-advisory/qsa-23-10
CVE: CVE-2023-1685
Published: 2023-03-29
Description: A vulnerability was found in HadSky up to 7.11.8. It has been declared as critical. This vulnerability affects unknown code of the file /install/index.php of the component Installation Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-224242 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://gitee.com/galaxies2580/cve/blob/master/hadSky.md; https://gitee.com/xinbate/cve/blob/master/HadSky%20rce.md; https://vuldb.com/?ctiid.224242
CVE: CVE-2022-27597
Published: 2023-03-29
Description: A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later
CVSS Score: 2.7 (LOW)
CWE: CWE-125, CWE-489, CWE-1295
References: https://www.qnap.com/en/security-advisory/qsa-23-06; https://www.qnap.com/en/security-advisory/qsa-23-06
CVE: CVE-2022-27598
Published: 2023-03-29
Description: A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later
CVSS Score: 2.7 (LOW)
CWE: CWE-125
References: https://www.qnap.com/en/security-advisory/qsa-23-06; https://www.qnap.com/en/security-advisory/qsa-23-06
CVE: CVE-2023-1686
Published: 2023-03-29
Description: A vulnerability was found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file bsenordering/admin/category/index.php of the component GET Parameter Handler. The manipulation of the argument view with the input <script>alert(233)</script> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224243.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Apeng96/bug_report/blob/main/XSS-1.md; https://vuldb.com/?ctiid.224243; https://vuldb.com/?id.224243
CVE: CVE-2023-1687
Published: 2023-03-29
Description: A vulnerability classified as problematic has been found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown function of the file LoginRegistration.php?a=register_user. The manipulation of the argument Fullname leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-224244.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?ctiid.224244; https://vuldb.com/?id.224244; https://vuldb.com/?ctiid.224244
CVE: CVE-2023-1688
Published: 2023-03-29
Description: A vulnerability classified as problematic has been found in SourceCodester Earnings and Expense Tracker App 1.0. This affects an unknown part of the file Master.php?a=save_expense. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-224307.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?ctiid.224307; https://vuldb.com/?id.224307; https://vuldb.com/?ctiid.224307
CVE: CVE-2023-1689
Published: 2023-03-29
Description: A vulnerability classified as problematic was found in SourceCodester Earnings and Expense Tracker App 1.0. This vulnerability affects unknown code of the file Master.php?a=save_earning. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-224308.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?ctiid.224308; https://vuldb.com/?id.224308; https://vuldb.com/?ctiid.224308
CVE: CVE-2023-0213
Published: 2023-03-29
Description: Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://empower.m-files.com/security-advisories/CVE-2023-0213; https://product.m-files.com/security-advisories/cve-2023-0213/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0213/
CVE: CVE-2023-1509
Published: 2023-03-29
Description: The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing nonce validation on the gmace_manager_server function called via the wp_ajax_gmace_manager AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/gmace/trunk/gmace.php?rev=1583327#L84; https://plugins.trac.wordpress.org/browser/gmace/trunk/inc/filemanager.php?rev=1583319#L27; https://www.wordfence.com/threat-intel/vulnerabilities/id/826b3913-9a37-4e15-80fd-b35cefb51af8?source=cve
CVE: CVE-2023-1690
Published: 2023-03-29
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Earnings and Expense Tracker App 1.0. This issue affects some unknown processing of the file LoginRegistration.php?a=register_user. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-224309 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?ctiid.224309; https://vuldb.com/?id.224309; https://vuldb.com/?ctiid.224309
CVE: CVE-2022-38077
Published: 2023-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/popup-anything-on-click/wordpress-popup-anything-plugin-2-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/popup-anything-on-click/wordpress-popup-anything-plugin-2-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-47433
Published: 2023-03-29
Description: Unauth. Reflected Cross-Site Scripting vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/multi-rating/wordpress-multi-rating-plugin-5-0-5-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/multi-rating/wordpress-multi-rating-plugin-5-0-5-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-47438
Published: 2023-03-29
Description: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/booking-calendar/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/booking-calendar/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-47444
Published: 2023-03-29
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.5.3 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-paid-membership-ecommerce-registration-form-login-form-user-profile-paywall-restrict-content-profilepress-plugin-4-4-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-paid-membership-ecommerce-registration-form-login-form-user-profile-paywall-restrict-content-profilepress-plugin-4-4-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-48430
Published: 2023-03-29
Description: In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-48431
Published: 2023-03-29
Description: In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-48432
Published: 2023-03-29
Description: In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-1188, CWE-1188
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-48433
Published: 2023-03-29
Description: In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-23861
Published: 2023-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/gmace/wordpress-gmace-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gmace/wordpress-gmace-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28158
Published: 2023-03-29
Description: Privilege escalation via stored XSS using the file upload service to upload malicious content.
The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2023/04/18/2; https://lists.apache.org/thread/8pm6d5y9cptznm0bdny3n8voovmm0dtt; http://www.openwall.com/lists/oss-security/2023/04/18/2
CVE: CVE-2023-1663
Published: 2023-03-29
Description: Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vulnerability is an insecurely configured servlet mapping for the underlying Apache Tomcat server. As a result, the downloads directory and its contents are accessible. 5.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-425, CWE-425
References: https://community.synopsys.com/s/article/Mitigation-for-Coverity-Platforms-Exposure-to-CVE-2023-1663; https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-2023-1663-Affecting-Coverity-Platform; https://community.synopsys.com/s/article/Mitigation-for-Coverity-Platforms-Exposure-to-CVE-2023-1663
CVE: CVE-2023-1575
Published: 2023-03-29
Description: The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://codecanyon.net/item/mega-main-menu-wordpress-menu-plugin/6135125; https://www.wordfence.com/threat-intel/vulnerabilities/id/a44ce6a3-0a9d-4bce-9251-f3a38b000645?source=cve; https://codecanyon.net/item/mega-main-menu-wordpress-menu-plugin/6135125
CVE: CVE-2023-1680
Published: 2023-03-29
Description: A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the file /dayrui/My/View/main.html. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224237 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/[PII_REDACTED]/CMS-bug/blob/main/Informationdisclosure-1.md; https://vuldb.com/?ctiid.224237; https://vuldb.com/?id.224237
CVE: CVE-2023-26982
Published: 2023-03-29
Description: Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/bypazs/CVE-2023-26982; https://github.com/polonel/trudesk/releases/tag/v1.2.6; https://trudesk.io/
CVE: CVE-2023-28892
Published: 2023-03-29
Description: Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://forums.malwarebytes.com/topic/307429-release-adwcleaner-841/; https://malwarebytes.com; https://www.malwarebytes.com/secure/cves/cve-2023-28892
CVE: CVE-2023-1701
Published: 2023-03-29
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/2b997737dd6a60be2239a51dd6d9ef5881568e6d; https://huntr.dev/bounties/64f943c4-68e5-4ef8-82f6-9c4abe928256; https://github.com/pimcore/pimcore/commit/2b997737dd6a60be2239a51dd6d9ef5881568e6d
CVE: CVE-2023-1702
Published: 2023-03-29
Description: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/2b997737dd6a60be2239a51dd6d9ef5881568e6d; https://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19; https://github.com/pimcore/pimcore/commit/2b997737dd6a60be2239a51dd6d9ef5881568e6d
CVE: CVE-2023-1703
Published: 2023-03-29
Description: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/765832f0dc5f6cfb296a82e089b701066f27bcef; https://huntr.dev/bounties/d12d105c-18fa-4d08-b591-b0e89e39eec1; https://github.com/pimcore/pimcore/commit/765832f0dc5f6cfb296a82e089b701066f27bcef
CVE: CVE-2023-1704
Published: 2023-03-29
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pimcore/pimcore/commit/295f5e8d108b68198e36399bea0f69598eb108a0; https://huntr.dev/bounties/84419c7b-ae29-401b-bdfd-5d0c498d320f; https://github.com/pimcore/pimcore/commit/295f5e8d108b68198e36399bea0f69598eb108a0
CVE: CVE-2022-47596
Published: 2023-03-29
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 1.9.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-media-library-categories/wordpress-media-library-categories-plugin-1-9-9-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-media-library-categories/wordpress-media-library-categories-plugin-1-9-9-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-48434
Published: 2023-03-29
Description: libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/cc867f2c09d2b69cee8a0eccd62aff002cbbfe11; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KOMB6WRUC55VWV25IKJTV22KARBUGWGQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PQHNSWXFUN3VJ3AO2AEJUK3BURSGM5G2/
CVE: CVE-2023-1550
Published: 2023-03-29
Description: Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://my.f5.com/manage/s/article/K000133135; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://my.f5.com/manage/s/article/K000133135
CVE: CVE-2023-26290
Published: 2023-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_reset_request.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_reset_request.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.forcepoint.com/s/article/000041617; https://support.forcepoint.com/s/article/000041617
CVE: CVE-2023-26291
Published: 2023-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_form.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_form.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.forcepoint.com/s/article/000041617; https://support.forcepoint.com/s/article/000041617
CVE: CVE-2023-26292
Published: 2023-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_submit.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_submit.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.forcepoint.com/s/article/000041617; https://support.forcepoint.com/s/article/000041617