deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28569
Published: 2023-11-07
Description: Information disclosure in WLAN HAL while handling command through WMI interfaces.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-28570
Published: 2023-11-07
Description: Memory corruption while processing audio effects.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-28572
Published: 2023-11-07
Description: Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-126, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-28574
Published: 2023-11-07
Description: Memory corruption in core services when Diag handler receives a command to configure event listeners.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-20, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-33031
Published: 2023-11-07
Description: Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-33045
Published: 2023-11-07
Description: Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-33047
Published: 2023-11-07
Description: Transient DOS in WLAN Firmware while parsing no-inherit IES.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-33048
Published: 2023-11-07
Description: Transient DOS in WLAN Firmware while parsing t2lm buffers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-33055
Published: 2023-11-07
Description: Memory Corruption in Audio while invoking callback function in driver from ADSP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-33056
Published: 2023-11-07
Description: Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-33059
Published: 2023-11-07
Description: Memory corruption in Audio while processing the VOC packet data from ADSP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-33061
Published: 2023-11-07
Description: Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-33074
Published: 2023-11-07
Description: Memory corruption in Audio when SSR event is triggered after music playback is stopped.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-47102
Published: 2023-11-07
Description: UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-47102; https://quantiano.github.io/cve-2023-47102/; https://quantiano.github.io/cve-2023-47102/
CVE: CVE-2023-38547
Published: 2023-11-07
Description: A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://www.veeam.com/kb4508; https://www.veeam.com/kb4508
CVE: CVE-2023-38548
Published: 2023-11-07
Description: A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://www.veeam.com/kb4508; https://www.veeam.com/kb4508
CVE: CVE-2023-38549
Published: 2023-11-07
Description: A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Note: The criticality of this vulnerability is reduced as it requires interaction by a user with the Veeam ONE Administrator role.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.veeam.com/kb4508; https://www.veeam.com/kb4508
CVE: CVE-2023-41723
Published: 2023-11-07
Description: A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability is reduced because the user with the Read-Only role is only able to view the schedule and cannot make changes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://www.veeam.com/kb4508; https://www.veeam.com/kb4508
CVE: CVE-2023-30739
Published: 2023-11-07
Description: Arbitrary File Descriptor Write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42283
Published: 2023-11-07
Description: Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/andreysanyuk/CVE-2023-42283; https://github.com/andreysanyuk/CVE-2023-42283
CVE: CVE-2023-42284
Published: 2023-11-07
Description: Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/andreysanyuk/CVE-2023-42284; https://github.com/andreysanyuk/CVE-2023-42284
CVE: CVE-2023-42527
Published: 2023-11-07
Description: Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose sensitive information.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42528
Published: 2023-11-07
Description: Improper Input Validation vulnerability in ProcessNvBuffering of libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42529
Published: 2023-11-07
Description: Out-of-bound write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42530
Published: 2023-11-07
Description: Improper access control vulnerability in SecSettings prior to SMR Nov-2023 Release 1 allows attackers to enable Wi-Fi and Wi-Fi Direct without User Interaction.
CVSS Score: 6.7 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42531
Published: 2023-11-07
Description: Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on starting activities from the background.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42532
Published: 2023-11-07
Description: Improper Certificate Validation in FotaAgent prior to SMR Nov-2023 Release1 allows remote attacker to intercept the network traffic including Firmware information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42533
Published: 2023-11-07
Description: Improper Input Validation with USB Gadget Interface prior to SMR Nov-2023 Release 1 allows a physical attacker to execute arbitrary code in Kernel.
CVSS Score: 6.6 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42534
Published: 2023-11-07
Description: Improper input validation vulnerability in ChooserActivity prior to SMR Nov-2023 Release 1 allows local attackers to read arbitrary files with system privilege.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-552
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42535
Published: 2023-11-07
Description: Out-of-bounds Write in read_block of vold prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42536
Published: 2023-11-07
Description: An improper input validation in saped_dec in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write.
CVSS Score: 8.4 (HIGH)
CWE: CWE-125, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42537
Published: 2023-11-07
Description: An improper input validation in get_head_crc in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write.
CVSS Score: 8.4 (HIGH)
CWE: CWE-125, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42538
Published: 2023-11-07
Description: An improper input validation in saped_rec_silence in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE: CVE-2023-42539
Published: 2023-11-07
Description: PendingIntent hijacking vulnerability in ChallengeNotificationManager in Samsung Health prior to version 6.25 allows local attackers to access data.
CVSS Score: 4.7 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42540
Published: 2023-11-07
Description: Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive information via implicit intent.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42541
Published: 2023-11-07
Description: Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-863, CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42542
Published: 2023-11-07
Description: Improper access control vulnerability in Samsung Push Service prior to 3.4.10 allows local attackers to get register ID to identify the device.
CVSS Score: 3.3 (LOW)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42543
Published: 2023-11-07
Description: Improper verification of intent by broadcast receiver vulnerability in Bixby Voice prior to version 3.3.35.12 allows attackers to access arbitrary data with Bixby Voice privilege.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42544
Published: 2023-11-07
Description: Improper access control vulnerability in Quick Share prior to 13.5.52.0 allows local attacker to access local files.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42545
Published: 2023-11-07
Description: Use of implicit intent for sensitive communication vulnerability in Phone prior to versions 12.7.20.12 in Android 11, 13.1.48, 13.5.28 in Android 12, and 14.7.38 in Android 13 allows attackers to access location data.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42546
Published: 2023-11-07
Description: Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42547
Published: 2023-11-07
Description: Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42548
Published: 2023-11-07
Description: Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42549
Published: 2023-11-07
Description: Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42550
Published: 2023-11-07
Description: Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42551
Published: 2023-11-07
Description: Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42552
Published: 2023-11-07
Description: Implicit intent hijacking vulnerability in Firewall application prior to versions 12.1.00.24 in Android 11, 13.1.00.16 in Android 12 and 14.1.00.7 in Android 13 allows 3rd party application to tamper the database of Firewall.
CVSS Score: 4.4 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42553
Published: 2023-11-07
Description: Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-863
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42554
Published: 2023-11-07
Description: Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-42555
Published: 2023-11-07
Description: Use of implicit intent for sensitive communication vulnerability in EasySetup prior to version 11.1.13 allows attackers to get the bluetooth address of user device.
CVSS Score: 6.3 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=11
CVE: CVE-2023-43885
Published: 2023-11-07
Description: Missing error handling in the HTTP server component of Tenda RX9 Pro Firmware V22.03.02.20 allows authenticated attackers to arbitrarily lock the device.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://blog.rtlcopymemory.com/tenda-rx9-pro/; https://blog.rtlcopymemory.com/tenda-rx9-pro/
CVE: CVE-2023-43886
Published: 2023-11-07
Description: A buffer overflow in the HTTP server component of Tenda RX9 Pro v22.03.02.20 might allow an authenticated attacker to overwrite memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://blog.rtlcopymemory.com/tenda-rx9-pro/; https://blog.rtlcopymemory.com/tenda-rx9-pro/
CVE: CVE-2023-46845
Published: 2023-11-07
Description: EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://jvn.jp/en/jp/JVN29195731/; https://www.ec-cube.net/info/weakness/20231026/index.php; https://www.ec-cube.net/info/weakness/20231026/index_3.php
CVE: CVE-2023-5076
Published: 2023-11-07
Description: The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2988896/ziteboard-online-whiteboard; https://www.wordfence.com/threat-intel/vulnerabilities/id/f5608f50-e17a-471f-b644-dceb64d82f0c?source=cve; https://plugins.trac.wordpress.org/changeset/2988896/ziteboard-online-whiteboard
CVE: CVE-2023-46851
Published: 2023-11-07
Description: Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them.  Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution.

This issue affects Apache Allura from 1.0.1 through 1.15.0.

Users are recommended to upgrade to version 1.16.0, which fixes the issue.  If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20, CWE-73, CWE-200
References: https://allura.apache.org/posts/2023-allura-1.16.0.html; https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx; https://allura.apache.org/posts/2023-allura-1.16.0.html
CVE: CVE-2023-47510
Published: 2023-11-07
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPSolutions-HQ WPDBSpringClean plugin <= 1.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpdbspringclean/wordpress-wpdbspringclean-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpdbspringclean/wordpress-wpdbspringclean-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2021-4431
Published: 2023-11-07
Description: A vulnerability classified as problematic has been found in msyk FMDataAPI up to 22. Affected is an unknown function of the file FMDataAPI_Sample.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 23 is able to address this issue. The patch is identified as 3bd1709a8f7b1720529bf5dfc9855ad609f436cf. It is recommended to upgrade the affected component. VDB-244494 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/msyk/FMDataAPI/commit/3bd1709a8f7b1720529bf5dfc9855ad609f436cf; https://github.com/msyk/FMDataAPI/pull/54; https://github.com/msyk/FMDataAPI/releases/tag/23