deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-40581
Published: 2023-09-25
Description: yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the shell used by Python's `subprocess` on Windows) does not properly escape special characters, which can allow for remote code execution if `--exec` is used directly with maliciously crafted remote data. This vulnerability only impacts `yt-dlp` on Windows, and the vulnerability is present regardless of whether `yt-dlp` is run from `cmd` or from `PowerShell`. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2023.09.24 fixes this issue by properly escaping each special character. `\n` will be replaced by `\r` as no way of escaping it has been found. It is recommended to upgrade yt-dlp to version 2023.09.24 as soon as possible. Also, always be careful when using --exec, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade: 1. Avoid using any output template expansion in --exec other than {} (filepath). 2. If expansion in --exec is needed, verify the fields you are using do not contain ", | or &. 3. Instead of using --exec, write the info json and load the fields from it instead.

CVSS Score: 8.3 (HIGH)
CWE: CWE-78
References: https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.09.24.003044; https://github.com/yt-dlp/yt-dlp/commit/de015e930747165dbb8fcd360f8775fd973b7d6e; https://github.com/yt-dlp/yt-dlp/releases/tag/2021.04.11
CVE: CVE-2023-41863
Published: 2023-09-25
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Pepro Dev. Group PeproDev CF7 Database plugin <= 1.7.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pepro-cf7-database/wordpress-peprodev-cf7-database-plugin-1-7-0-unauthenticated-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pepro-cf7-database/wordpress-peprodev-cf7-database-plugin-1-7-0-unauthenticated-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41867
Published: 2023-09-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AcyMailing Newsletter Team AcyMailing plugin <= 8.6.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/acymailing/wordpress-acymailing-plugin-8-6-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/acymailing/wordpress-acymailing-plugin-8-6-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41868
Published: 2023-09-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ram Ratan Maurya, Codestag StagTools plugin <= 2.3.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/stagtools/wordpress-stagtools-plugin-2-3-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stagtools/wordpress-stagtools-plugin-2-3-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41871
Published: 2023-09-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Poll Maker Team Poll Maker plugin <= 4.7.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/poll-maker/wordpress-poll-maker-best-wordpress-poll-plugin-plugin-4-7-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/poll-maker/wordpress-poll-maker-best-wordpress-poll-plugin-plugin-4-7-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-42817
Published: 2023-09-25
Description: Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c; https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-m988-7375-7g2c; https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c
CVE: CVE-2023-43319
Published: 2023-09-25
Description: Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40muthumohanprasath.r/reflected-cross-site-scripting-on-icewarp-webclient-product-cve-2023-43319-c2ad758ac2bc; https://medium.com/%40muthumohanprasath.r/reflected-cross-site-scripting-on-icewarp-webclient-product-cve-2023-43319-c2ad758ac2bc
CVE: CVE-2022-4137
Published: 2023-09-25
Description: A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.
CVSS Score: 8.1 (HIGH)
CWE: CWE-81, CWE-79
References: https://access.redhat.com/errata/RHSA-2023:1043; https://access.redhat.com/errata/RHSA-2023:1044; https://access.redhat.com/errata/RHSA-2023:1045
CVE: CVE-2022-4244
Published: 2023-09-25
Description: A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://access.redhat.com/errata/RHSA-2023:2135; https://access.redhat.com/errata/RHSA-2023:3906; https://access.redhat.com/security/cve/CVE-2022-4244
CVE: CVE-2022-4245
Published: 2023-09-25
Description: A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-91, CWE-611
References: https://access.redhat.com/errata/RHSA-2023:2135; https://access.redhat.com/errata/RHSA-2023:3906; https://access.redhat.com/security/cve/CVE-2022-4245
CVE: CVE-2022-4318
Published: 2023-09-25
Description: A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-538, CWE-913
References: https://access.redhat.com/errata/RHSA-2023:1033; https://access.redhat.com/errata/RHSA-2023:1503; https://access.redhat.com/security/cve/CVE-2022-4318
CVE: CVE-2023-43458
Published: 2023-09-25
Description: Cross Site Scripting (XSS) vulnerability in Resort Reservation System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the room, name, and description parameters in the manage_room function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://samh4cks.github.io/posts/cve-2023-43458/; https://www.sourcecodester.com/php/16447/resort-reservation-system-php-and-sqlite3-source-code-free-download.html; https://samh4cks.github.io/posts/cve-2023-43458/
CVE: CVE-2023-43642
Published: 2023-09-25
Description: snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5; https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv; https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5
CVE: CVE-2023-43644
Published: 2023-09-25
Description: Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285g; https://github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285g
CVE: CVE-2023-42426
Published: 2023-09-25
Description: Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://froala.com; https://github.com/b0marek/CVE-2023-42426; https://www.youtube.com/watch?v=Me33Dx1_XqQ
CVE: CVE-2023-42753
Published: 2023-09-25
Description: An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787, CWE-787
References: https://access.redhat.com/errata/RHSA-2023:7370; https://access.redhat.com/errata/RHSA-2023:7379; https://access.redhat.com/errata/RHSA-2023:7382
CVE: CVE-2023-43132
Published: 2023-09-25
Description: szvone vmqphp <=1.13 is vulnerable to SQL Injection. Unauthorized remote users can use sql injection attacks to obtain the hash of the administrator password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/8FishMan/a37417d1fd97046fb00eb11a257008a7; https://gist.github.com/8FishMan/d42032b1cdcf401a9c27532aa72ccb37; https://github.com/szvone/vmqphp
CVE: CVE-2023-43457
Published: 2023-09-25
Description: An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://samh4cks.github.io/posts/cve-2023-43457/; https://www.sourcecodester.com/php/16501/service-provider-management-system-using-php-and-mysql-source-code-free-download.html; https://www.sourcecodester.com/users/tips23
CVE: CVE-2023-5129
Published: 2023-09-25
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of CVE-2023-4863.
CVE: CVE-2023-43326
Published: 2023-09-25
Description: A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ahrixia/CVE-2023-43326; https://moosocial.com/; https://github.com/ahrixia/CVE-2023-43326
CVE: CVE-2023-4258
Published: 2023-09-25
Description: In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.


CVSS Score: 8.6 (HIGH)
CWE: CWE-684
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m34c-cp63-rwh7; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m34c-cp63-rwh7
CVE: CVE-2023-38907
Published: 2023-09-25
Description: An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to replay old messages encrypted with a still valid session key.
CVSS Score: 7.5 (HIGH)
References: https://arxiv.org/abs/2308.09019; https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/; https://www.scitepress.org/Papers/2023/120929/120929.pdf
CVE: CVE-2023-43278
Published: 2023-09-25
Description: A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://seacms.com; https://blog.csdn.net/sugaryzheng/article/details/133283101?spm=1001.2014.3001.5501; https://www.seacms.net/
CVE: CVE-2023-43325
Published: 2023-09-26
Description: A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ahrixia/CVE-2023-43325; https://moosocial.com/; https://travel.moosocial.com/
CVE: CVE-2023-4259
Published: 2023-09-26
Description: Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.
CVSS Score: 7.1 (HIGH)
CWE: CWE-120, CWE-193, CWE-120
References: http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html; http://seclists.org/fulldisclosure/2023/Nov/1; http://www.openwall.com/lists/oss-security/2023/11/07/1
CVE: CVE-2021-38243
Published: 2023-09-27
Description: xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackers to execute arbitrary code via a crafted GET request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/P0wfuu/xunruicms-RCE; https://github.com/P0wfuu/xunruicms-RCE
CVE: CVE-2022-48606
Published: 2023-09-27
Description: Stability-related vulnerability in the binder background management and control module. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://consumer.huawei.com/en/support/bulletin/2023/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/9/
CVE: CVE-2023-0456
Published: 2023-09-27
Description: A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.
CVSS Score: 7.4 (HIGH)
CWE: CWE-285, CWE-862
References: https://access.redhat.com/security/cve/CVE-2023-0456; https://bugzilla.redhat.com/show_bug.cgi?id=2163586; https://access.redhat.com/security/cve/CVE-2023-0456
CVE: CVE-2023-0833
Published: 2023-09-27
Description: A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://access.redhat.com/errata/RHSA-2023:1241; https://access.redhat.com/errata/RHSA-2023:3223; https://access.redhat.com/security/cve/CVE-2023-0833
CVE: CVE-2023-23495
Published: 2023-09-27
Description: A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Oct/3; https://support.apple.com/en-us/HT213940; http://seclists.org/fulldisclosure/2023/Oct/3
CVE: CVE-2023-23958
Published: 2023-09-27
Description: Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/22599; https://support.broadcom.com/external/content/SecurityAdvisories/0/22599
CVE: CVE-2023-25483
Published: 2023-09-27
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ankit Agarwal, Priyanshu Mittal Easy Coming Soon plugin <= 2.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-coming-soon/wordpress-easy-coming-soon-plugin-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-coming-soon/wordpress-easy-coming-soon-plugin-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27616
Published: 2023-09-27
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in David F. Carr RSVPMaker plugin <= 10.6.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-6-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-6-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-27617
Published: 2023-09-27
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David F. Carr RSVPMaker plugin <= 10.6.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27622
Published: 2023-09-27
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Abel Ruiz GuruWalk Affiliates plugin <= 1.0.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/guruwalk-affiliates/wordpress-guruwalk-affiliates-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/guruwalk-affiliates/wordpress-guruwalk-affiliates-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27628
Published: 2023-09-27
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Webvitaly Sitekit plugin <= 1.3 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sitekit/wordpress-sitekit-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sitekit/wordpress-sitekit-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28055
Published: 2023-09-27
Description: 
Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could potentially exploit this by manipulating a command leading to gain of complete access to the server file further resulting in information leaks, denial of service, and arbitrary code execution. Dell recommends customers to upgrade at the earliest opportunity.


CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://www.dell.com/support/kbdoc/en-us/000218003/dsa-2023-294-security-update-for-dell-networker-nw-client-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218003/dsa-2023-294-security-update-for-dell-networker-nw-client-vulnerabilities
CVE: CVE-2023-28490
Published: 2023-09-27
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/estatik-mortgage-calculator/wordpress-wordpress-mortgage-calculator-estatik-plugin-2-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/estatik-mortgage-calculator/wordpress-wordpress-mortgage-calculator-estatik-plugin-2-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28790
Published: 2023-09-27
Description: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Brett Shumaker Simple Staff List plugin <= 2.2.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-staff-list/wordpress-simple-staff-list-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-staff-list/wordpress-simple-staff-list-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29497
Published: 2023-09-27
Description: A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to access calendar data saved to a temporary directory.
CVSS Score: 3.3 (LOW)
References: http://seclists.org/fulldisclosure/2023/Oct/3; https://support.apple.com/en-us/HT213940; http://seclists.org/fulldisclosure/2023/Oct/3
CVE: CVE-2023-2315
Published: 2023-09-27
Description: Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-22, CWE-22
References: https://github.com/opencart/opencart/commit/0a8dd91e385f70e[PII_REDACTED]9fd644224c1bc97; https://starlabs.sg/advisories/23/23-2315/; https://github.com/opencart/opencart/commit/0a8dd91e385f70e[PII_REDACTED]9fd644224c1bc97
CVE: CVE-2023-2358
Published: 2023-09-27
Description: 
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-257, CWE-312
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]221; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]221
CVE: CVE-2023-30471
Published: 2023-09-27
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <= 1.4.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/search-analytics/wordpress-wp-search-analytics-plugin-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/search-analytics/wordpress-wp-search-analytics-plugin-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve