deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3129
Published: 2023-07-10
Description: The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/5717d729-c24b-4415-bb99-fcdd259328c4; https://wpscan.com/vulnerability/5717d729-c24b-4415-bb99-fcdd259328c4
CVE: CVE-2023-3131
Published: 2023-07-10
Description: The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c; https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c
CVE: CVE-2023-3175
Published: 2023-07-10
Description: The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/7643980b-eaa2-45d1-bd9d-9afae0943f43; https://wpscan.com/vulnerability/7643980b-eaa2-45d1-bd9d-9afae0943f43
CVE: CVE-2023-3209
Published: 2023-07-10
Description: The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
CVSS Score: 3.5 (LOW)
References: https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c; https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c
CVE: CVE-2023-3219
Published: 2023-07-10
Description: The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: http://packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html; https://wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fd; http://packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html
CVE: CVE-2023-3225
Published: 2023-07-10
Description: The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/3c76d0f4-2ea8-433d-afb2-e35e45630899; https://wpscan.com/vulnerability/3c76d0f4-2ea8-433d-afb2-e35e45630899
CVE: CVE-2023-3270
Published: 2023-07-10
Description: Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system.
CVSS Score: 8.6 (HIGH)
CWE: CWE-668
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf; https://sick.com/psirt
CVE: CVE-2023-3271
Published: 2023-07-10
Description: 
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing
unauthenticated endpoints.


CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf; https://sick.com/psirt
CVE: CVE-2023-3272
Published: 2023-07-10
Description: 


Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a
remote attacker to gather sensitive information by intercepting network traffic that is not encrypted.




CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf; https://sick.com/psirt
CVE: CVE-2023-3273
Published: 2023-07-10
Description: 
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP
address based on missing access control.



CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf; https://sick.com/psirt
CVE: CVE-2023-3554
Published: 2023-07-10
Description: A vulnerability was found in GZ Scripts GZ Forum Script 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /preview.php. The manipulation of the argument catid/topicid/topic/topic_message/free_name leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233348. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233348; https://vuldb.com/?id.233348; https://vuldb.com/?ctiid.233348
CVE: CVE-2023-3555
Published: 2023-07-10
Description: A vulnerability was found in GZ Scripts PHP Vacation Rental Script 1.8. It has been classified as problematic. This affects an unknown part of the file /preview.php. The manipulation of the argument page/layout/sort_by/property_id leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-233349 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233349; https://vuldb.com/?id.233349; https://vuldb.com/?ctiid.233349
CVE: CVE-2023-3556
Published: 2023-07-10
Description: A vulnerability was found in GZ Scripts Car Listing Script PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /preview.php. The manipulation of the argument page/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-233350 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?ctiid.233350; https://vuldb.com/?id.233350; https://vuldb.com/?ctiid.233350
CVE: CVE-2023-3557
Published: 2023-07-10
Description: A vulnerability was found in GZ Scripts Property Listing Script 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /preview.php. The manipulation of the argument page/layout/sort_by leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-233351. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233351; https://vuldb.com/?id.233351; https://vuldb.com/?ctiid.233351
CVE: CVE-2023-3558
Published: 2023-07-10
Description: A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8. Affected is an unknown function of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233352. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233352; https://vuldb.com/?id.233352; https://vuldb.com/?ctiid.233352
CVE: CVE-2023-3559
Published: 2023-07-10
Description: A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability is an unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233353 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?ctiid.233353; https://vuldb.com/?id.233353; https://vuldb.com/?ctiid.233353
CVE: CVE-2023-3560
Published: 2023-07-10
Description: A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is some unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack may be launched remotely. VDB-233354 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233354; https://vuldb.com/?id.233354; https://vuldb.com/?ctiid.233354
CVE: CVE-2023-3561
Published: 2023-07-10
Description: A vulnerability, which was classified as problematic, was found in GZ Scripts PHP GZ Hotel Booking Script 1.8. This affects an unknown part of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233355. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233355; https://vuldb.com/?id.233355; https://vuldb.com/?ctiid.233355
CVE: CVE-2023-3562
Published: 2023-07-10
Description: A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 and classified as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument action leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233356. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233356; https://vuldb.com/?id.233356; https://vuldb.com/?ctiid.233356
CVE: CVE-2023-3563
Published: 2023-07-10
Description: A vulnerability was found in GZ Scripts GZ E Learning Platform 1.8 and classified as problematic. This issue affects some unknown processing of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-233357 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233357; https://vuldb.com/?id.233357; https://vuldb.com/?ctiid.233357
CVE: CVE-2023-3564
Published: 2023-07-10
Description: A vulnerability was found in GZ Scripts GZ Multi Hotel Booking System 1.8. It has been classified as problematic. Affected is an unknown function of the file /index.php. The manipulation of the argument adults/children/cal_id leads to cross site scripting. It is possible to launch the attack remotely. VDB-233358 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233358; https://vuldb.com/?id.233358; https://vuldb.com/?ctiid.233358
CVE: CVE-2023-3565
Published: 2023-07-10
Description: Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nilsteampassnet/teampass/commit/820bb49a362a566c9038e4a3048b26d654babb0e; https://huntr.dev/bounties/fcf46e1f-2ab6-4057-9d25-cf493ab09530; https://github.com/nilsteampassnet/teampass/commit/820bb49a362a566c9038e4a3048b26d654babb0e
CVE: CVE-2023-3566
Published: 2023-07-10
Description: A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of resources. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233359. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-770
References: https://github.com/ctflearner/Vulnerability/blob/main/WALLABAG/NAME-LIMIT.md; https://vuldb.com/?ctiid.233359; https://vuldb.com/?id.233359
CVE: CVE-2023-3568
Published: 2023-07-10
Description: Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/alextselegidis/easyappointments/commit/b37b[PII_REDACTED]9db4f22eb2fe998bca84b2cb64; https://huntr.dev/bounties/e8d530db-a6a7-4f79-a95d-b77654cc04f8; https://github.com/alextselegidis/easyappointments/commit/b37b[PII_REDACTED]9db4f22eb2fe998bca84b2cb64
CVE: CVE-2023-3574
Published: 2023-07-10
Description: Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45; https://huntr.dev/bounties/1dcb4f01-e668-4aa3-a6a3-838532e500c6; https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45
CVE: CVE-2023-3578
Published: 2023-07-10
Description: A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233371.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/nightcloudos/cve/blob/main/SSRF.md; https://vuldb.com/?ctiid.233371; https://vuldb.com/?id.233371
CVE: CVE-2023-3579
Published: 2023-07-10
Description: A vulnerability, which was classified as problematic, has been found in HadSky 7.11.8. Affected by this issue is some unknown functionality of the component User Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233372.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/nightcloudos/cve/blob/main/CSRF.md; https://vuldb.com/?ctiid.233372; https://vuldb.com/?id.233372
CVE: CVE-2023-3580
Published: 2023-07-10
Description: Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-167
References: https://github.com/squidex/squidex/commit/2aca7621845ce18ed4065cba8e3d0fa68aaf02bf; https://huntr.dev/bounties/4eed53ca-06c2-43aa-aea8-c03ea5f13ce4; https://github.com/squidex/squidex/commit/2aca7621845ce18ed4065cba8e3d0fa68aaf02bf
CVE: CVE-2023-36375
Published: 2023-07-10
Description: Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Guardian relation, complimentary address, city, permanent address, and city parameters in the Book Hostel & Room Details page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/@ridheshgohil1092/cve-2023-36375-xss-on-hostel-management-system-d654e6df26bc; https://packetstormsecurity.com; https://www.exploit-db.com/exploits/50628
CVE: CVE-2023-37277
Published: 2023-07-10
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST requests and accepts `text/plain`, `multipart/form-data` or `application/www-form-urlencoded` as content types which can be sent via regular HTML forms, thus allowing cross-site request forgery. With the interaction of a user with programming rights, this allows remote code execution through script macros and thus impacts the integrity, availability and confidentiality of the whole XWiki installation. For regular cookie-based authentication, the vulnerability is mitigated by SameSite cookie restrictions but as of March 2023, these are not enabled by default in Firefox and Safari. The vulnerability has been patched in XWiki 14.10.8 and 15.2 by requiring a CSRF token header for certain request types that are susceptible to CSRF attacks.


CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://github.com/xwiki/xwiki-platform/commit/4c175405faa0e62437df397811c7526dfc0fbae7; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6xxr-648m-gch6; https://jira.xwiki.org/browse/XWIKI-20135
CVE: CVE-2023-37700
Published: 2023-07-10
Description: Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6905; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6905
CVE: CVE-2023-37701
Published: 2023-07-10
Description: Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6908; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6908
CVE: CVE-2023-37702
Published: 2023-07-10
Description: Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the formSetDeviceName function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6801; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6801
CVE: CVE-2023-37703
Published: 2023-07-10
Description: Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6907; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6907
CVE: CVE-2023-37704
Published: 2023-07-10
Description: Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the formSetClientState function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6901; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6901
CVE: CVE-2023-37705
Published: 2023-07-10
Description: Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromAddressNat function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6902; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6902
CVE: CVE-2023-37706
Published: 2023-07-10
Description: Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the entrys parameter in the fromAddressNat function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6903; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6903
CVE: CVE-2023-37707
Published: 2023-07-10
Description: Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6904; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6904
CVE: CVE-2023-37710
Published: 2023-07-10
Description: Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the wpapsk_crypto parameter in the fromSetWirelessRepeat function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/fromSetWirelessRepeat; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/fromSetWirelessRepeat
CVE: CVE-2023-37711
Published: 2023-07-10
Description: Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the deviceId parameter in the saveParentControlInfo function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/saveParentControlInfo; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/saveParentControlInfo
CVE: CVE-2023-37712
Published: 2023-07-10
Description: Tenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408) were discovered to contain a stack overflow in the page parameter in the fromSetIpBind function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/fromSetIpBind; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/fromSetIpBind; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/fromSetIpBind
CVE: CVE-2016-15034
Published: 2023-07-10
Description: A vulnerability was found in Dynacase Webdesk and classified as critical. Affected by this issue is the function freedomrss_search of the file freedomrss_search.php. The manipulation leads to sql injection. Upgrading to version 3.2-20180305 is able to address this issue. The patch is identified as 750a9b35af182950c952faf6ddfdcc50a2b25f8b. It is recommended to upgrade the affected component. VDB-233366 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/dynacase-labs/dynacase-webdesk/commit/750a9b35af182950c952faf6ddfdcc50a2b25f8b; https://github.com/dynacase-labs/dynacase-webdesk/releases/tag/3.2-20180305; https://vuldb.com/?ctiid.233366
CVE: CVE-2023-23348
Published: 2023-07-10
Description: HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed.

CVSS Score: 5.1 (MEDIUM)
CWE: CWE-922
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105978; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105978
CVE: CVE-2023-26590
Published: 2023-07-10
Description: A floating point exception vulnerability was found in sox, in the lsx_aiffstartwrite function at sox/src/aiff.c:622:58. This flaw can lead to a denial of service.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1077, CWE-697
References: https://access.redhat.com/security/cve/CVE-2023-26590; https://bugzilla.redhat.com/show_bug.cgi?id=2212279; https://access.redhat.com/security/cve/CVE-2023-26590
CVE: CVE-2023-32627
Published: 2023-07-10
Description: A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. This flaw can lead to a denial of service.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1077, CWE-697
References: https://access.redhat.com/security/cve/CVE-2023-32627; https://bugzilla.redhat.com/show_bug.cgi?id=2212282; https://lists.debian.org/debian-lts-announce/2023/08/msg00015.html
CVE: CVE-2023-34318
Published: 2023-07-10
Description: A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41. This flaw can lead to a denial of service, code execution, or information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/security/cve/CVE-2023-34318; https://bugzilla.redhat.com/show_bug.cgi?id=2212283; https://access.redhat.com/security/cve/CVE-2023-34318
CVE: CVE-2023-36936
Published: 2023-07-10
Description: Cross-Site Scripting (XSS) vulnerability in PHPGurukul Online Security Guards Hiring System using PHP and MySQL 1.0 allows attackers to execute arbitrary code via a crafted payload to the search booking box.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40ridheshgohil1092/cve-2023-36936-xss-online-security-guards-hiring-system-773f394f6117; https://packetstormsecurity.com; https://medium.com/%40ridheshgohil1092/cve-2023-36936-xss-online-security-guards-hiring-system-773f394f6117