deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-47489
Published: 2023-11-09
Description: CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components.
CVSS Score: 7.8 (HIGH)
References: https://bugplorer.github.io/cve-csv-itop/; https://nitipoom-jar.github.io/CVE-2023-47489/; https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-47489
CVE: CVE-2023-47613
Published: 2023-11-09
Description: A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to escape from virtual directories and get read/write access to protected files on the targeted system.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-211-telit-cinterion-thales-gemalto-modules-relative-path-traversal/; https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-211-telit-cinterion-thales-gemalto-modules-relative-path-traversal/
CVE: CVE-2023-47248
Published: 2023-11-09
Description: Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).

This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.

It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.

If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See  https://pypi.org/project/pyarrow-hotfix/  for instructions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/apache/arrow/commit/f[PII_REDACTED]436ec1d03a724d8d3f3925484ecf; https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X/
CVE: CVE-2023-4218
Published: 2023-11-09
Description: In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

CVSS Score: 5.0 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://github.com/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1b; https://github.com/eclipse-emf/org.eclipse.emf/issues/10; https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d
CVE: CVE-2023-47612
Published: 2023-11-09
Description: A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to obtain a read/write access to any files and directories on the targeted system, including hidden files and directories.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-194-telit-cinterion-thales-gemalto-modules-files-or-directories-accessible-to-external-parties-vulnerability/; https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-194-telit-cinterion-thales-gemalto-modules-files-or-directories-accessible-to-external-parties-vulnerability/
CVE: CVE-2023-47615
Published: 2023-11-09
Description: A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to get access to a sensitive data on the targeted system.
CVSS Score: 3.3 (LOW)
CWE: CWE-526
References: https://ics-cert.kaspersky.com/advisories/2023/11/09/klcert-22-212-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-through-environmental-variables/; https://ics-cert.kaspersky.com/advisories/2023/11/09/klcert-22-212-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-through-environmental-variables/
CVE: CVE-2023-47616
Published: 2023-11-09
Description: A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to get access to a sensitive data on the targeted system.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://ics-cert.kaspersky.com/advisories/2023/11/09/klcert-22-193-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-to-an-unauthorized-actor/; https://ics-cert.kaspersky.com/advisories/2023/11/09/klcert-22-193-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-to-an-unauthorized-actor/
CVE: CVE-2023-6052
Published: 2023-11-09
Description: A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. Affected is an unknown function of the file general/system/censor_words/module/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-244872. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/kenankkkkk/cve/blob/main/sql.md; https://vuldb.com/?ctiid.244872; https://vuldb.com/?id.244872
CVE: CVE-2023-47363
Published: 2023-11-09
Description: The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/syz913/CVE-reports/blob/main/F.B.P%20members.md; https://github.com/syz913/CVE-reports/blob/main/F.B.P%20members.md
CVE: CVE-2023-47364
Published: 2023-11-09
Description: The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/syz913/CVE-reports/blob/main/nagaoka%20taxi.md; https://github.com/syz913/CVE-reports/blob/main/nagaoka%20taxi.md
CVE: CVE-2023-47365
Published: 2023-11-09
Description: The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/syz913/CVE-reports/blob/main/Lil.OFF-PRICE%20STORE.md; https://github.com/syz913/CVE-reports/blob/main/Lil.OFF-PRICE%20STORE.md
CVE: CVE-2023-47366
Published: 2023-11-09
Description: The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/syz913/CVE-reports/blob/main/craft_members.md; https://github.com/syz913/CVE-reports/blob/main/craft_members.md
CVE: CVE-2023-47367
Published: 2023-11-09
Description: The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/syz913/CVE-reports/blob/main/platinum%20clinic.md; https://github.com/syz913/CVE-reports/blob/main/platinum%20clinic.md
CVE: CVE-2023-47369
Published: 2023-11-09
Description: The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/syz913/CVE-reports/blob/main/best_training_member.md; https://github.com/syz913/CVE-reports/blob/main/best_training_member.md
CVE: CVE-2023-4612
Published: 2023-11-09
Description: Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-302, CWE-287
References: https://cert.pl/en/posts/2023/11/CVE-2023-4612/; https://cert.pl/posts/2023/11/CVE-2023-4612/; https://cert.pl/en/posts/2023/11/CVE-2023-4612/
CVE: CVE-2023-40054
Published: 2023-11-09
Description: The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability.  This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33226
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-4-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40054; https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-4-1_release_notes.htm
CVE: CVE-2023-40055
Published: 2023-11-09
Description: The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability.  This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33227
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40055; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40055
CVE: CVE-2023-41137
Published: 2023-11-09
Description: Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.
CVSS Score: 8.0 (HIGH)
CWE: CWE-321, CWE-798, CWE-798
References: https://docs.appsanywhere.com/appsanywhere/3.1/2023-11-security-advisory; https://docs.appsanywhere.com/appsanywhere/3.1/2023-11-security-advisory
CVE: CVE-2023-41138
Published: 2023-11-09
Description: The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-226, CWE-269
References: https://docs.appsanywhere.com/appsanywhere/3.1/2023-11-security-advisory; https://docs.appsanywhere.com/appsanywhere/3.1/2023-11-security-advisory
CVE: CVE-2023-43791
Published: 2023-11-09
Description: Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://github.com/HumanSignal/label-studio/commit/3d06c5131c15600621e08b06f07d976887cde81b; https://github.com/HumanSignal/label-studio/pull/4690; https://github.com/HumanSignal/label-studio/releases/tag/1.8.2
CVE: CVE-2023-47368
Published: 2023-11-09
Description: The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/syz913/CVE-reports/blob/main/taketorinoyu.md; https://github.com/syz913/CVE-reports/blob/main/taketorinoyu.md
CVE: CVE-2023-47370
Published: 2023-11-09
Description: The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/syz913/CVE-reports/blob/main/bluetrick.md; https://github.com/syz913/CVE-reports/blob/main/bluetrick.md
CVE: CVE-2023-47372
Published: 2023-11-09
Description: The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/syz913/CVE-reports/blob/main/UPDATESALON%20C-LOUNGE.md; https://github.com/syz913/CVE-reports/blob/main/UPDATESALON%20C-LOUNGE.md
CVE: CVE-2023-47373
Published: 2023-11-09
Description: The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/syz913/CVE-reports/blob/main/DRAGON%20FAMILY.md; https://github.com/syz913/CVE-reports/blob/main/DRAGON%20FAMILY.md
CVE: CVE-2023-6039
Published: 2023-11-09
Description: A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when the LAN78XX USB device detaches.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/CVE-2023-6039; https://bugzilla.redhat.com/show_bug.cgi?id=2248755; https://github.com/torvalds/linux/commit/1e7417c188d0a83fb385ba2dbe35fd2563f2b6f3
CVE: CVE-2023-25994
Published: 2023-11-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Alex Benfica Publish to Schedule plugin <= 4.4.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/publish-to-schedule/wordpress-publish-to-schedule-plugin-4-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/publish-to-schedule/wordpress-publish-to-schedule-plugin-4-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-36688
Published: 2023-11-09
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Mann Simple Site Verify plugin <= 1.0.7 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-site-verify/wordpress-simple-site-verify-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-site-verify/wordpress-simple-site-verify-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46743
Published: 2023-11-09
Description: application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a document, they should be able to open the office attachments files in view or edit mode. Currently, if a user opens an attachment file in edit mode in collabora, this right will be preserved for all future users, until the editing session is closes, even if some of them have only view right. Collabora server is the one issuing this request and it seems that the `userCanWrite` query parameter is cached, even if, for example, token is not. This issue has been patched in version 1.3.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://github.com/xwikisas/application-collabora/security/advisories/GHSA-mvq3-xxg2-rj57; https://github.com/xwikisas/application-collabora/security/advisories/GHSA-mvq3-xxg2-rj57
CVE: CVE-2023-46894
Published: 2023-11-09
Description: An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://github.com/espressif/esptool/issues/926; https://github.com/espressif/esptool/issues/926
CVE: CVE-2023-47110
Published: 2023-11-09
Description: blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in module blockreassurance allows modifying any value in the configuration table. This vulnerability has been patched in version 5.1.4.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-xfm3-hjcc-gv78; https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-xfm3-hjcc-gv78
CVE: CVE-2023-45283
Published: 2023-11-09
Description: The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2023/12/05/2; https://go.dev/cl/540277; https://go.dev/cl/541175
CVE: CVE-2023-45284
Published: 2023-11-09
Description: On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.
CVSS Score: 5.3 (MEDIUM)
References: https://go.dev/cl/540277; https://go.dev/issue/63713; https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY
CVE: CVE-2023-45884
Published: 2023-11-09
Description: Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.linkedin.com/pulse/xss-nasas-open-mct-v302-visionspace-technologies-ubg4f; https://www.linkedin.com/pulse/xss-nasas-open-mct-v302-visionspace-technologies-ubg4f
CVE: CVE-2023-45885
Published: 2023-11-09
Description: Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in the flexibleLayout plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.linkedin.com/pulse/xss-nasas-open-mct-v302-visionspace-technologies-ubg4f; https://www.linkedin.com/pulse/xss-nasas-open-mct-v302-visionspace-technologies-ubg4f
CVE: CVE-2023-47610
Published: 2023-11-09
Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-120
References: https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-23-018-telit-cinterion-thales-gemalto-modules-buffer-copy-without-checking-size-of-input-vulnerability/; https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-23-018-telit-cinterion-thales-gemalto-modules-buffer-copy-without-checking-size-of-input-vulnerability/
CVE: CVE-2023-25975
Published: 2023-11-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Frédéric Sheedy Etsy Shop plugin <= 3.0.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/etsy-shop/wordpress-etsy-shop-plugin-3-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/etsy-shop/wordpress-etsy-shop-plugin-3-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-31087
Published: 2023-11-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/js-jobs/wordpress-js-jobs-manager-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/js-jobs/wordpress-js-jobs-manager-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-34002
Published: 2023-11-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory Manager plugin <= 2.1.0.13 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-inventory-manager/wordpress-wp-inventory-manager-plugin-2-1-0-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-inventory-manager/wordpress-wp-inventory-manager-plugin-2-1-0-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-34386
Published: 2023-11-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-smart-wishlist/wordpress-wpc-smart-wishlist-for-woocommerce-plugin-4-6-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-smart-wishlist/wordpress-wpc-smart-wishlist-for-woocommerce-plugin-4-6-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-46614
Published: 2023-11-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mat Bao Corp WP Helper Premium plugin <= 4.5.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-helper-lite/wordpress-wp-helper-premium-plugin-4-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-helper-lite/wordpress-wp-helper-premium-plugin-4-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-34178
Published: 2023-11-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-2-7-10-3-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-2-7-10-3-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-34181
Published: 2023-11-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP-Cirrus plugin <= 0.6.11 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-cirrus/wordpress-wp-cirrus-plugin-0-6-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-cirrus/wordpress-wp-cirrus-plugin-0-6-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-34182
Published: 2023-11-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Peter Shaw LH Password Changer plugin <= 1.55 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/lh-password-changer/wordpress-lh-password-changer-plugin-1-55-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/lh-password-changer/wordpress-lh-password-changer-plugin-1-55-cross-site-request-forgery-csrf-vulnerability?_s_id=cve