deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-52142
Published: 2024-01-08
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cool Plugins Events Shortcodes For The Events Calendar.This issue affects Events Shortcodes For The Events Calendar: from n/a through 2.3.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/template-events-calendar/wordpress-events-shortcodes-for-the-events-calendar-plugin-2-3-1-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/template-events-calendar/wordpress-events-shortcodes-for-the-events-calendar-plugin-2-3-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-52196
Published: 2024-01-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phil Ewels CPT Bootstrap Carousel allows Reflected XSS.This issue affects CPT Bootstrap Carousel: from n/a through 1.12.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/cpt-bootstrap-carousel/wordpress-cpt-bootstrap-carousel-plugin-1-12-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cpt-bootstrap-carousel/wordpress-cpt-bootstrap-carousel-plugin-1-12-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-52197
Published: 2024-01-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Impactpixel Ads Invalid Click Protection allows Stored XSS.This issue affects Ads Invalid Click Protection: from n/a through 1.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ads-invalid-click-protection/wordpress-ads-invalid-click-protection-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ads-invalid-click-protection/wordpress-ads-invalid-click-protection-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-52198
Published: 2024-01-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michiel van Eerd Private Google Calendars allows Stored XSS.This issue affects Private Google Calendars: from n/a through 20231125.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/private-google-calendars/wordpress-private-google-calendars-plugin-20231125-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/private-google-calendars/wordpress-private-google-calendars-plugin-20231125-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-52201
Published: 2024-01-08
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brian D. Goad pTypeConverter.This issue affects pTypeConverter: from n/a through 0.2.8.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/ptypeconverter/wordpress-ptypeconverter-plugin-0-2-8-1-subscriber-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ptypeconverter/wordpress-ptypeconverter-plugin-0-2-8-1-subscriber-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-52202
Published: 2024-01-08
Description: Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner Playlist Free.This issue affects HTML5 MP3 Player with Folder Feedburner Playlist Free: from n/a through 2.8.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/html5-mp3-player-with-mp3-folder-feedburner-playlist/wordpress-html5-mp3-player-with-folder-feedburner-plugin-2-8-0-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/html5-mp3-player-with-mp3-folder-feedburner-playlist/wordpress-html5-mp3-player-with-folder-feedburner-plugin-2-8-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-7218
Published: 2024-01-08
Description: A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-249852. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://github.com/jylsec/vuldb/blob/main/TOTOLINK/N350RT/4/README.md; https://vuldb.com/?ctiid.249852; https://vuldb.com/?id.249852
CVE: CVE-2022-29409
Published: 2024-01-08
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-34344
Published: 2024-01-08
Description: Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More: from n/a through 2.1.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-wholesale-prices/wordpress-wholesale-suite-plugin-2-1-5-auth-plugin-settings-change-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-wholesale-prices/wordpress-wholesale-suite-plugin-2-1-5-auth-plugin-settings-change-vulnerability?_s_id=cve
CVE: CVE-2022-36352
Published: 2024-01-08
Description: Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.0.3.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-0-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-40696
Published: 2024-01-08
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-3-1-1-6-0-2-custom-field-value-exposure?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-3-1-1-6-0-2-custom-field-value-exposure?_s_id=cve
CVE: CVE-2023-52072
Published: 2024-01-08
Description: FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig_updagte.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/zouyang0714/cms/blob/main/2.md; https://github.com/zouyang0714/cms/blob/main/2.md
CVE: CVE-2023-52073
Published: 2024-01-08
Description: FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/zouyang0714/cms/blob/main/3.md; https://github.com/zouyang0714/cms/blob/main/3.md
CVE: CVE-2023-52074
Published: 2024-01-08
Description: FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updagte.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/zouyang0714/cms/blob/main/1.md; https://github.com/zouyang0714/cms/blob/main/1.md
CVE: CVE-2023-50162
Published: 2024-01-09
Description: SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the DoExecSql function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Teresazdy/CVE; https://github.com/Teresazdy/CVE
CVE: CVE-2024-21648
Published: 2024-01-09
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don't have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback. 
CVSS Score: 8.0 (HIGH)
CWE: CWE-274
References: https://github.com/xwiki/xwiki-platform/commit/4de72875ca[PII_REDACTED][PII_REDACTED]bfdbf1e680; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xh35-w7wg-95v3; https://jira.xwiki.org/browse/XWIKI-21257
CVE: CVE-2024-21651
Published: 2024-01-09
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8959-rfxh-r4j4; https://jira.xwiki.org/browse/XCOMMONS-2796; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8959-rfxh-r4j4
CVE: CVE-2024-21663
Published: 2024-01-09
Description: Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.

CVSS Score: 9.9 (CRITICAL)
CWE: CWE-20, CWE-77
References: https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a; https://github.com/DEMON1A/Discord-Recon/issues/23; https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7
CVE: CVE-2023-46906
Published: 2024-01-09
Description: juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863
References: https://github.com/juzaweb/cms; https://www.sumor.top/index.php/archives/880/; https://github.com/juzaweb/cms
CVE: CVE-2023-50643
Published: 2024-01-09
Description: An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components.
CVSS Score: 9.8 (CRITICAL)
References: http://evernote.com; https://github.com/V3x0r/CVE-2023-50643; https://www.electronjs.org/blog/statement-run-as-node-cves
CVE: CVE-2024-21646
Published: 2024-01-09
Description: Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-190
References: https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe; https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv; https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe
CVE: CVE-2024-21734
Published: 2024-01-09
Description: SAP Marketing (Contacts App) - version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing phishing attack with low impact on confidentiality and integrity of the application.


CVSS Score: 3.7 (LOW)
CWE: CWE-601
References: https://me.sap.com/notes/3190894; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3190894
CVE: CVE-2024-21735
Published: 2024-01-09
Description: SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. This could allow an attacker with high privileges to perform unintended actions, resulting in escalation of privileges, which has High impact on confidentiality, integrity and availability of the system.


CVSS Score: 7.3 (HIGH)
CWE: CWE-863, CWE-863
References: https://me.sap.com/notes/3407617; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3407617
CVE: CVE-2023-26998
Published: 2024-01-09
Description: Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Alert Configuration page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://netscout.com; http://ngeniusone.com; https://piotrryciak.com/posts/netscout-multiple-vulnerabilities/
CVE: CVE-2023-26999
Published: 2024-01-09
Description: An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: http://netscout.com; http://ngeniusone.com; https://piotrryciak.com/posts/netscout-multiple-vulnerabilities/
CVE: CVE-2023-27000
Published: 2024-01-09
Description: Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name parameter of the Profile and Exclusion List page(s).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://netscout.com; http://ngeniusone.com; https://piotrryciak.com/posts/netscout-multiple-vulnerabilities/
CVE: CVE-2023-27098
Published: 2024-01-09
Description: TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: http://tp-lin.com; http://tp-link.com; https://github.com/c0d3x27/CVEs/tree/main/CVE-2023-27098
CVE: CVE-2023-36629
Published: 2024-01-09
Description: The ST ST54-android-packages-apps-Nfc package before[PII_REDACTED]5-23W07p0 for Android has an out-of-bounds read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/STMicroelectronics/ST54-android-packages-apps-Nfc/releases/tag/[PII_REDACTED]5-23W07p0; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hunting-for-android-privilege-escalation-with-a-32-line-fuzzer/; https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2023-007_Xiaomi_Redmi_10sNote-1.txt
CVE: CVE-2023-39336
Published: 2024-01-09
Description: An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an  attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server. 
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://forums.ivanti.com/s/article/SA-2023-12-19-CVE-2023-39336?language=en_US; https://forums.ivanti.com/s/article/SA-2023-12-19-CVE-2023-39336?language=en_US
CVE: CVE-2023-49238
Published: 2024-01-09
Description: In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://security.gradle.com; https://security.gradle.com/advisory/2023-01; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-51717
Published: 2024-01-09
Description: Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://dataiku.com; https://doc.dataiku.com/dss/latest/security/advisories/dsa-2023-010.html; https://dataiku.com
CVE: CVE-2024-21736
Published: 2024-01-09
Description: SAP S/4HANA Finance for (Advanced Payment Management) - versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. A function import could be triggered allowing the attacker to create in-house bank accounts leading to low impact on the confidentiality of the application.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-863
References: https://me.sap.com/notes/3260667; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3260667
CVE: CVE-2024-21737
Published: 2024-01-09
Description: In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behaviour of the application. This leads to considerable impact on confidentiality, integrity and availability.


CVSS Score: 8.4 (HIGH)
CWE: CWE-94
References: https://me.sap.com/notes/3411869; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3411869
CVE: CVE-2024-21738
Published: 2024-01-09
Description: SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.


CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3387737; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3387737
CVE: CVE-2024-22124
Published: 2024-01-09
Description: Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access information which would otherwise be restricted causing high impact on confidentiality.


CVSS Score: 4.1 (MEDIUM)
CWE: CWE-497
References: https://me.sap.com/notes/3392626; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3392626
CVE: CVE-2024-22125
Published: 2024-01-09
Description: Under certain conditions the Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) - version 1.0, allows an attacker to access highly sensitive information which would otherwise be restricted causing high impact on confidentiality.


CVSS Score: 7.4 (HIGH)
CWE: CWE-497
References: https://me.sap.com/notes/3386378; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3386378
CVE: CVE-2023-6594
Published: 2024-01-09
Description: The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Administrators can give button creation privileges to users with lower levels (contributor+) which would allow those lower-privileged users to carry out attacks.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3012872%40maxbuttons%2Ftrunk&old=2978023%40maxbuttons%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/cfe2cabd-98f6-4ebc-8a02-e6951202aa88?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3012872%40maxbuttons%2Ftrunk&old=2978023%40maxbuttons%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-6788
Published: 2024-01-09
Description: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This is due to missing or incorrect nonce validation on the contents function. This makes it possible for unauthenticated attackers to update the options "mf_hubsopt_token", "mf_hubsopt_refresh_token", "mf_hubsopt_token_type", and "mf_hubsopt_expires_in" via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This would allow an attacker to connect their own Hubspot account to a victim site's metform to obtain leads and contacts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/metform/trunk/core/integrations/crm/hubspot/loader.php#L87; https://plugins.trac.wordpress.org/changeset/3011284/metform/trunk/core/integrations/crm/hubspot/loader.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/30fd2425-ee48-4777-91c1-03906d63793a?source=cve
CVE: CVE-2023-7219
Published: 2024-01-09
Description: A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://github.com/jylsec/vuldb/blob/main/TOTOLINK/N350RT/5/README.md; https://vuldb.com/?ctiid.249853; https://vuldb.com/?id.249853
CVE: CVE-2023-50930
Published: 2024-01-09
Description: An issue was discovered in savignano S/Notify before 4.0.2 for Jira. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Jira, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
CVSS Score: 8.3 (HIGH)
CWE: CWE-352, CWE-352
References: https://help.savignano.net/snotify-email-encryption/sa-2023-11-28; https://help.savignano.net/snotify-email-encryption/sa-2023-11-28
CVE: CVE-2023-50931
Published: 2024-01-09
Description: An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Bitbucket, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
CVSS Score: 8.3 (HIGH)
CWE: CWE-352, CWE-352
References: https://help.savignano.net/snotify-email-encryption/sa-2023-11-28; https://help.savignano.net/snotify-email-encryption/sa-2023-11-28