deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-44631
Published: 2023-04-23
Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in 1app Technologies, Inc 1app Business Forms plugin <= 1.0.0 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/1app-business-forms/wordpress-1app-business-forms-plugin-1-0-0-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/1app-business-forms/wordpress-1app-business-forms-plugin-1-0-0-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-44594
Published: 2023-04-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Codebangers All in One Time Clock Lite plugin <= 1.3.320 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/aio-time-clock-lite/wordpress-all-in-one-time-clock-lite-plugin-1-3-320-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/aio-time-clock-lite/wordpress-all-in-one-time-clock-lite-plugin-1-3-320-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-44743
Published: 2023-04-23
Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.11.2 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/job-postings/wordpress-jobs-for-wordpress-plugin-2-5-10-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/job-postings/wordpress-jobs-for-wordpress-plugin-2-5-10-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45361
Published: 2023-04-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Boris Kuzmanov 0mk Shortener plugin <= 0.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/0mk-shortener/wordpress-0mk-shortener-plugin-0-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/0mk-shortener/wordpress-0mk-shortener-plugin-0-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-47435
Published: 2023-04-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Olive Design WP-OliveCart plugin <= 1.1.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-olivecart/wordpress-wp-olivecart-plugin-1-1-3-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-olivecart/wordpress-wp-olivecart-plugin-1-1-3-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-22698
Published: 2023-04-23
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jason Bobich Theme Blvd Responsive Google Maps plugin <= 1.0.2 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/theme-blvd-responsive-google-maps/wordpress-theme-blvd-responsive-google-maps-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/theme-blvd-responsive-google-maps/wordpress-theme-blvd-responsive-google-maps-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-22718
Published: 2023-04-23
Description: Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/user-meta-manager/wordpress-user-meta-manager-plugin-3-4-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/user-meta-manager/wordpress-user-meta-manager-plugin-3-4-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24386
Published: 2023-04-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Karishma Arora AI Contact Us Form plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ai-contact-us/wordpress-ai-contact-us-form-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ai-contact-us/wordpress-ai-contact-us-form-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24404
Published: 2023-04-23
Description: Reflected Cross-Site Scripting (XSS) vulnerability in VryaSage Marketing Performance plugin <= 2.0.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/marketing-performance/wordpress-marketing-performance-plugin-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/marketing-performance/wordpress-marketing-performance-plugin-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23717
Published: 2023-04-23
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in George Gecewicz Portfolio Slideshow plugin <= 1.13.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/portfolio-slideshow/wordpress-portfolio-slideshow-plugin-1-13-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/portfolio-slideshow/wordpress-portfolio-slideshow-plugin-1-13-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23806
Published: 2023-04-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Davinder Singh Custom Settings plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/custom-settings/wordpress-wordpress-custom-settings-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-settings/wordpress-wordpress-custom-settings-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23816
Published: 2023-04-23
Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Twardes Sitemap Index plugin <= 1.2.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sitemap-index/wordpress-sitemap-index-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sitemap-index/wordpress-sitemap-index-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23817
Published: 2023-04-23
Description: Auth. (contrinbutor+) Cross-Site Scripting (XSS) vulnerability in WebArea | Vera Nedvyzhenko Simple PDF Viewer plugin <= 1.9 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-pdf-viewer/wordpress-simple-pdf-viewer-plugin-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-pdf-viewer/wordpress-simple-pdf-viewer-plugin-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23827
Published: 2023-04-23
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Google Maps v3 Shortcode plugin <= 1.2.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/google-maps-v3-shortcode/wordpress-google-maps-v3-shortcode-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/google-maps-v3-shortcode/wordpress-google-maps-v3-shortcode-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23832
Published: 2023-04-23
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in TC Ultimate WP Query Search Filter plugin <= 1.0.10 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/ultimate-wp-query-search-filter/wordpress-ultimate-wp-query-search-filter-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-wp-query-search-filter/wordpress-ultimate-wp-query-search-filter-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25451
Published: 2023-04-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPChill CPO Content Types plugin <= 1.1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cpo-content-types/wordpress-cpo-content-types-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cpo-content-types/wordpress-cpo-content-types-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27425
Published: 2023-04-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in James Irving-Swift Electric Studio Client Login plugin <= 0.8.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/electric-studio-client-login/wordpress-electric-studio-client-login-plugin-0-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/electric-studio-client-login/wordpress-electric-studio-client-login-plugin-0-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27614
Published: 2023-04-23
Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Ian Haycox Motor Racing League plugin <= 1.9.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/motor-racing-league/wordpress-motor-racing-league-plugin-1-9-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/motor-racing-league/wordpress-motor-racing-league-plugin-1-9-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45074
Published: 2023-04-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/activity-reactions-for-buddypress/wordpress-activity-reactions-for-buddypress-plugin-1-0-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/activity-reactions-for-buddypress/wordpress-activity-reactions-for-buddypress-plugin-1-0-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-45080
Published: 2023-04-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/add-multiple-marker/wordpress-add-multiple-marker-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/add-multiple-marker/wordpress-add-multiple-marker-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-22686
Published: 2023-04-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/nice-paypal-button-lite/wordpress-nice-paypal-button-lite-plugin-1-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/nice-paypal-button-lite/wordpress-nice-paypal-button-lite-plugin-1-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-23879
Published: 2023-04-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/php-execution-plugin/wordpress-php-execution-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/php-execution-plugin/wordpress-php-execution-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-2246
Published: 2023-04-23
Description: A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227236.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://docs.google.com/document/d/1Bzt1UOXHJYyNFvTUsMO4zfbiDd_cKxuEygjAww2GcZQ/edit; https://vuldb.com/?ctiid.227236; https://vuldb.com/?id.227236
CVE: CVE-2023-31043
Published: 2023-04-23
Description: EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edb_filter_log.redact_password_commands. The fixed versions are 10.23.33, 11.18.29, 12.13.17, 13.9.13, and 14.6.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-521
References: https://www.enterprisedb.com/docs/epas/10/epas_rel_notes/epas10_23_33_rel_notes/; https://www.enterprisedb.com/docs/epas/11/epas_rel_notes/epas11_18_29_rel_notes/; https://www.enterprisedb.com/docs/epas/12/epas_rel_notes/epas12_13_17_rel_notes/
CVE: CVE-2023-23753
Published: 2023-04-23
Description: The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://blog.asturhackers.es/sql-injection-en-visforms-base-package-for-joomla-3-0-5-cve-2023-23753; https://vi-solutions.de/en/announcements/867-security-announcement-cve-2023-23754; https://blog.asturhackers.es/sql-injection-en-visforms-base-package-for-joomla-3-0-5-cve-2023-23753
CVE: CVE-2023-31056
Published: 2023-04-24
Description: CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single sign-on is not employed. The fixed versions are 5.15.4, 5.16.2, 5.17.3, and 6.0.x.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-532, CWE-532
References: https://support1.cloverdx.com/hc/en-us/articles/[PII_REDACTED]164-Security-advisory-April-2023; https://support1.cloverdx.com/hc/en-us/articles/[PII_REDACTED]164-Security-advisory-April-2023
CVE: CVE-2023-31059
Published: 2023-04-24
Description: Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://cybir.com/2023/cve/poc-repetier-server-140/; https://www.repetier-server.com/download-repetier-server/; https://cybir.com/2023/cve/poc-repetier-server-140/
CVE: CVE-2023-31060
Published: 2023-04-24
Description: Repetier Server through 1.4.10 executes as SYSTEM. This can be leveraged in conjunction with CVE-2023-31059 for full compromise.
CVSS Score: 9.8 (CRITICAL)
References: https://cybir.com/2023/cve/poc-repetier-server-140/; https://www.repetier-server.com/download-repetier-server/; https://cybir.com/2023/cve/poc-repetier-server-140/
CVE: CVE-2023-31061
Published: 2023-04-24
Description: Repetier Server through 1.4.10 does not have CSRF protection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://cybir.com/2023/cve/poc-repetier-server-140/; https://www.repetier-server.com/download-repetier-server/; https://cybir.com/2023/cve/poc-repetier-server-140/
CVE: CVE-2023-28131
Published: 2023-04-24
Description: A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc).
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-522, CWE-522
References: https://blog.expo.dev/security-advisory-for-developers-using-authsessions-useproxy-options-and-auth-expo-io-e470fe9346df; https://www.darkreading.com/endpoint/oauth-flaw-in-expo-platform-affects-hundreds-of-third-party-sites-apps; https://blog.expo.dev/security-advisory-for-developers-using-authsessions-useproxy-options-and-auth-expo-io-e470fe9346df
CVE: CVE-2023-31081
Published: 2023-04-24
Description: An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_bridge.c in the Linux kernel 6.2. There is a NULL pointer dereference in vidtv_mux_stop_thread. In vidtv_stop_streaming, after dvb->mux=NULL occurs, it executes vidtv_mux_stop_thread(dvb->mux).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.suse.com/show_bug.cgi?id=1210782; https://lore.kernel.org/all/CA+UBctDXyiosaiR7YNKCs8k0aWu4gU+YutRcnC+TDJkXpHjQag%40mail.gmail.com/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31082
Published: 2023-04-24
Description: An issue was discovered in drivers/tty/n_gsm.c in the Linux kernel 6.2. There is a sleeping function called from an invalid context in gsmld_write, which will block the kernel. Note: This has been disputed by 3rd parties as not a valid vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-763
References: https://bugzilla.suse.com/show_bug.cgi?id=1210781; https://lore.kernel.org/all/CA+UBctCZok5FSQ=LPRA+A-jocW=L8FuMVZ_7MNqhh483P5yN8A%40mail.gmail.com/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31083
Published: 2023-04-24
Description: An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-476
References: https://bugzilla.suse.com/show_bug.cgi?id=1210780; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9c33663af9ad115f90c076a1828129a3fbadea98; https://lore.kernel.org/all/CA+UBctC3p49aTgzbVgkSZ2+TQcqq4fPDO7yZitFT5uBPDeCO2g%40mail.gmail.com/
CVE: CVE-2023-31084
Published: 2023-04-24
Description: An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-833
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b8c75e4a1b325ea0a9433fa8834be97b5836b946; https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE: CVE-2023-31085
Published: 2023-04-24
Description: An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=017c73a34a661a861712f7cc1393a123e5b2208c; https://lore.kernel.org/all/687[PII_REDACTED]95[PII_REDACTED]034.JavaMail.zimbra%40nod.at/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-30458
Published: 2023-04-24
Description: A username enumeration issue was discovered in Medicine Tracker System 1.0. The login functionality allows a malicious user to guess a valid username due to a different response time from invalid usernames. When one enters a valid username, the response time increases depending on the length of the supplied password.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://github.com/d34dun1c02n/CVE-2023-30458; https://www.sourcecodester.com/download-code?nid=16308&title=Medicine+Tracker+System+in+PHP+%28OOP%29+and+MySQL+DB+Source+Code+Free+Download; https://www.sourcecodester.com/php/16308/medicine-tracker-system-php-oop-and-mysql-db-source-code-free-download.html
CVE: CVE-2023-30533
Published: 2023-04-24
Description: SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://cdn.sheetjs.com/advisories/CVE-2023-30533; https://git.sheetjs.com/sheetjs/sheetjs/issues/2986; https://git.sheetjs.com/sheetjs/sheetjs/src/branch/master/CHANGELOG.md
CVE: CVE-2023-31045
Published: 2023-04-24
Description: A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/backdrop/backdrop-issues/issues/6065; https://github.com/backdrop/backdrop/releases/tag/1.24.2; https://github.com/backdrop/backdrop-issues/issues/6065
CVE: CVE-2023-22577
Published: 2023-04-24
Description: Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://csirt.divd.nl/CVE-2023-22577/; https://csirt.divd.nl/DIVD-2022-00068/; https://github.com/advisories/GHSA-gv4x-jjcj-p736
CVE: CVE-2023-22581
Published: 2023-04-24
Description: White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application (the default installation makes the webserver run as the root user).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://csirt.divd.nl/CVE-2023-22581/; https://csirt.divd.nl/DIVD-2022-00068/; https://vuldb.com/?id.227269
CVE: CVE-2023-25131
Published: 2023-04-24
Description: Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the 'admin' password.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-1393, CWE-287
References: https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads; https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads; https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads