deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-32829
Published: 2023-10-02
Description: In apusys, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07713478; Issue ID: ALPS07713478.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-32830
Published: 2023-10-02
Description: In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03802522; Issue ID: DTV03802522.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-42132
Published: 2023-10-02
Description: FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://jvn.jp/en/jp/JVN39596244/; https://web.fd-shinsei.mhlw.go.jp/download/software/index.html; https://jvn.jp/en/jp/JVN39596244/
CVE: CVE-2023-41692
Published: 2023-10-02
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hennessey Digital Attorney theme <= 3 theme.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/attorney/wordpress-attorney-theme-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/attorney/wordpress-attorney-theme-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41728
Published: 2023-10-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through 2.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/rescue-shortcodes/wordpress-rescue-shortcodes-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rescue-shortcodes/wordpress-rescue-shortcodes-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41729
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sendpress/wordpress-sendpress-newsletters-plugin-1-22-3-31-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/sendpress/wordpress-sendpress-newsletters-plugin-1-22-3-31-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-41731
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress publish post email notification plugin <= 1.0.2.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/publish-post-email-notification/wordpress-wordpress-publish-post-email-notification-plugin-1-0-2-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/publish-post-email-notification/wordpress-wordpress-publish-post-email-notification-plugin-1-0-2-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-41733
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in YYDevelopment Back To The Top Button plugin <= 2.1.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/back-to-the-top-button/wordpress-back-to-the-top-button-plugin-2-1-5-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/back-to-the-top-button/wordpress-back-to-the-top-button-plugin-2-1-5-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-41734
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nigauri Insert Estimated Reading Time plugin <= 1.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/insert-estimated-reading-time/wordpress-insert-estimated-reading-time-plugin-1-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/insert-estimated-reading-time/wordpress-insert-estimated-reading-time-plugin-1-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-41736
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Email posts to subscribers plugin <= 6.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/email-posts-to-subscribers/wordpress-email-posts-to-subscribers-plugin-6-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/email-posts-to-subscribers/wordpress-email-posts-to-subscribers-plugin-6-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-41737
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGens Swifty Bar, sticky bar by WPGens plugin <= 1.2.10 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/swifty-bar/wordpress-swifty-bar-sticky-bar-by-wpgens-plugin-1-2-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/swifty-bar/wordpress-swifty-bar-sticky-bar-by-wpgens-plugin-1-2-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41797
Published: 2023-10-02
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gold Plugins Locations plugin <= 4.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/locations/wordpress-locations-plugin-4-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/locations/wordpress-locations-plugin-4-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-41800
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in UniConsent UniConsent CMP for GDPR CPRA GPP TCF plugin <= 1.4.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/uniconsent-cmp/wordpress-uniconsent-cookie-consent-cmp-for-gdpr-ccpa-plugin-1-4-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/uniconsent-cmp/wordpress-uniconsent-cookie-consent-cmp-for-gdpr-ccpa-plugin-1-4-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-41847
Published: 2023-10-02
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WEN Solutions Notice Bar plugin <= 3.1.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/notice-bar/wordpress-notice-bar-plugin-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/notice-bar/wordpress-notice-bar-plugin-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41855
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Regpacks Regpack plugin <= 0.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/regpack/wordpress-regpack-plugin-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/regpack/wordpress-regpack-plugin-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41856
Published: 2023-10-02
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ClickToTweet.Com Click To Tweet plugin <= 2.0.14 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/click-to-tweet/wordpress-click-to-tweet-plugin-2-0-14-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/click-to-tweet/wordpress-click-to-tweet-plugin-2-0-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41859
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/order-delivery-date/wordpress-order-delivery-date-for-wp-e-commerce-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/order-delivery-date/wordpress-order-delivery-date-for-wp-e-commerce-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-44244
Published: 2023-10-02
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.44 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/foogallery/wordpress-foogallery-plugin-2-2-44-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/foogallery/wordpress-foogallery-plugin-2-2-44-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-44474
Published: 2023-10-02
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MD Jakir Hosen Tiger Forms – Drag and Drop Form Builder plugin <= 2.0.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/tiger-form/wordpress-tiger-forms-plugin-2-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tiger-form/wordpress-tiger-forms-plugin-2-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-44477
Published: 2023-10-02
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Boxy Studio Cooked plugin <= 1.7.13 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cooked/wordpress-cooked-plugin-1-7-13-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cooked/wordpress-cooked-plugin-1-7-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-44479
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jim Krill WP Jump Menu plugin <= 3.6.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-jump-menu/wordpress-wp-jump-menu-plugin-3-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-jump-menu/wordpress-wp-jump-menu-plugin-3-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-44144
Published: 2023-10-02
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dreamfox Payment gateway per Product for WooCommerce plugin <= 3.2.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-product-payments/wordpress-payment-gateway-per-product-for-woocommerce-plugin-3-2-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-product-payments/wordpress-payment-gateway-per-product-for-woocommerce-plugin-3-2-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-44145
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in jesweb.Dev Anchor Episodes Index (Spotify for Podcasters) plugin <= 2.1.7 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/anchor-episodes-index/wordpress-anchor-episodes-index-spotify-for-podcasters-plugin-2-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/anchor-episodes-index/wordpress-anchor-episodes-index-spotify-for-podcasters-plugin-2-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-44239
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jobin Jose WWM Social Share On Image Hover plugin <= 2.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wwm-social-share-on-image-hover/wordpress-wwm-social-share-on-image-hover-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wwm-social-share-on-image-hover/wordpress-wwm-social-share-on-image-hover-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-44245
Published: 2023-10-02
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Leap Contractor Contact Form Website to Workflow Tool plugin <= 4.0.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/contractor-contact-form-website-to-workflow-tool/wordpress-contractor-contact-form-website-to-workflow-tool-plugin-4-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contractor-contact-form-website-to-workflow-tool/wordpress-contractor-contact-form-website-to-workflow-tool-plugin-4-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-44262
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Renzo Johnson Blocks plugin <= 1.6.41 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/blocks/wordpress-blocks-plugin-1-6-41-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/blocks/wordpress-blocks-plugin-1-6-41-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-44263
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Riyaz Social Metrics plugin <= 2.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/social-metrics/wordpress-social-metrics-plugin-2-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/social-metrics/wordpress-social-metrics-plugin-2-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-3768
Published: 2023-10-02
Description: Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to gain knowledge about specially crafted packets that would create a DoS condition through the MMS protocol when initiating communication, achieving a complete system reboot of the device and its services.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ingeteam-products; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ingeteam-products
CVE: CVE-2023-44228
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Onclick show popup plugin <= 8.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/onclick-show-popup/wordpress-onclick-show-popup-plugin-8-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/onclick-show-popup/wordpress-onclick-show-popup-plugin-8-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-44230
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Popup contact form plugin <= 7.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/popup-contact-form/wordpress-popup-contact-form-plugin-7-1-cross-site-scripting-xss-2?_s_id=cve; https://patchstack.com/database/vulnerability/popup-contact-form/wordpress-popup-contact-form-plugin-7-1-cross-site-scripting-xss-2?_s_id=cve
CVE: CVE-2023-44242
Published: 2023-10-02
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team Slideshow, Image Slider by 2J plugin <= 1.3.54 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/2j-slideshow/wordpress-slideshow-image-slider-by-2j-plugin-1-3-54-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/2j-slideshow/wordpress-slideshow-image-slider-by-2j-plugin-1-3-54-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-44264
Published: 2023-10-02
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin <= 2.2.5 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-facebook-feed/wordpress-the-awesome-feed-custom-feed-plugin-2-2-5-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-facebook-feed/wordpress-the-awesome-feed-custom-feed-plugin-2-2-5-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-44265
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Popup contact form plugin <= 7.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/popup-contact-form/wordpress-popup-contact-form-plugin-7-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/popup-contact-form/wordpress-popup-contact-form-plugin-7-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-44266
Published: 2023-10-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jewel Theme WP Adminify plugin <= 3.1.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/adminify/wordpress-wp-adminify-custom-login-admin-dashboard-admin-columns-plugin-3-1-6-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/adminify/wordpress-wp-adminify-custom-login-admin-dashboard-admin-columns-plugin-3-1-6-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-5160
Published: 2023-10-02
Description: Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5106
Published: 2023-10-02
Description: An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports.
CVSS Score: 8.2 (HIGH)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/commit/67039cfcae80b8fc0496f79be88714873cd169b3; https://gitlab.com/gitlab-org/security/gitlab/-/issues/980; https://gitlab.com/gitlab-org/gitlab/-/commit/67039cfcae80b8fc0496f79be88714873cd169b3
CVE: CVE-2023-41580
Published: 2023-10-02
Description: Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://github.com/ehtec/phpipam-exploit; https://github.com/phpipam/phpipam/commit/c[PII_REDACTED]74943eb[PII_REDACTED]c0b61db566c5; https://github.com/ehtec/phpipam-exploit
CVE: CVE-2015-10124
Published: 2023-10-02
Description: A vulnerability was found in Most Popular Posts Widget Plugin up to 0.8 on WordPress. It has been classified as critical. Affected is the function add_views/show_views of the file functions.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 0.9 is able to address this issue. The patch is identified as a99667d11ac8d[PII_REDACTED]87b100e9a8b5c12e1. It is recommended to upgrade the affected component. VDB-241026 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/wp-plugins/most-popular-posts-widget-lite/commit/a99667d11ac8d[PII_REDACTED]87b100e9a8b5c12e1; https://vuldb.com/?ctiid.241026; https://vuldb.com/?id.241026
CVE: CVE-2023-3744
Published: 2023-10-02
Description: Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-slims; https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-slims
CVE: CVE-2023-3769
Published: 2023-10-02
Description: Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to gain knowledge about specially crafted packets that would create a DoS condition through the MMS protocol when initiating communication, achieving a complete system reboot of the device and its services.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ingeteam-products; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ingeteam-products
CVE: CVE-2023-3770
Published: 2023-10-02
Description: 
 Incorrect validation vulnerability of the data entered, allowing an attacker with access to the network on which the affected device is located to use the discovery port protocol (1925/UDP) to obtain device-specific information without the need for authentication.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-862
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ingeteam-products; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ingeteam-products
CVE: CVE-2023-4659
Published: 2023-10-02
Description: Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-352, CWE-352
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-request-forgery-free5gc; https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-request-forgery-free5gc
CVE: CVE-2023-5290
Published: 2023-10-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2023-40744
Published: 2023-10-02
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2023. Notes: none.
CVE: CVE-2023-0809
Published: 2023-10-02
Description: In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-789, CWE-770
References: https://mosquitto.org/blog/2023/08/version-2-0-16-released/; https://security.gentoo.org/glsa/202401-09; https://mosquitto.org/blog/2023/08/version-2-0-16-released/