deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-40575
Published: 2023-08-31
Description: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_YUV444ToRGB_8u_P3AC4R_BGRX` function. This issue is likely down to insufficient data for the `pSrc` variable and results in crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/primitives/prim_YUV.c#L414-L445; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c6vw-92h9-5w9v; https://security.gentoo.org/glsa/202401-16
CVE: CVE-2023-40576
Published: 2023-08-31
Description: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `RleDecompress` function. This Out-Of-Bounds Read occurs because FreeRDP processes the `pbSrcBuffer` variable without checking if it contains data of sufficient length. Insufficient data in the `pbSrcBuffer` variable may cause errors or crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/include/bitmap.c#L94-L113; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x3x5-r7jm-5pq2; https://security.gentoo.org/glsa/202401-16
CVE: CVE-2023-39912
Published: 2023-08-31
Description: Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://manageengine.com; https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-39912.html; https://manageengine.com
CVE: CVE-2023-4481
Published: 2023-09-01
Description: An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When certain specific crafted BGP UPDATE messages are received over an established BGP session, one BGP session may be torn down with an UPDATE message error, or the issue may propagate beyond the local system which will remain non-impacted, but may affect one or more remote systems. This issue is exploitable remotely as the crafted UPDATE message can propagate through unaffected systems and intermediate BGP speakers.
Continuous receipt of the crafted BGP UPDATE messages will create a sustained Denial of Service (DoS) condition for impacted devices.

This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations.  This issue requires a remote attacker to have at least one established BGP session.
 Improper Input Validation, Denial of Service vulnerability in Juniper Networks, Inc. Junos OS (BGP, rpd modules), Juniper Networks, Inc. Junos OS Evolved (BGP, rpd modules) allows Fuzzing.This issue affects 

Junos OS: 



  *  All versions before 20.4R3-S10,
  *  from 21.1R1 through 21.*,
  *  from 21.2 before 21.2R3-S5,
  *  from 21.3 before 21.3R3-S5,
  *  from 21.4 before 21.4R3-S7 (unaffected from 21.4R3-S5, affected from 21.4R3-S6)
  *  from 22.1 before 22.1R3-S4,
  *  from 22.2 before 22.2R3-S3,
  *  from 22.3 before 22.3R3-S1,
  *  from 22.4 before 22.4R3,
  *  from 23.2 before 23.2R2.


Junos OS Evolved:



  *  All versions before 20.4R3-S10-EVO,
  *  from 21.2-EVO before 21.2R3-S7-EVO,
  *  from 21.3-EVO before 21.3R3-S5-EVO,
  *  from 21.4-EVO before 21.4R3-S5-EVO,
  *  from 22.1-EVO before 22.1R3-S4-EVO,
  *  from 22.2-EVO before 22.2R3-S3-EVO,
  *  from 22.3-EVO before 22.3R3-S1-EVO,
  *  from 22.4-EVO before 22.4R3-EVO,
  *  from 23.2-EVO before 23.2R2-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://kb.juniper.net/JSA72510; https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html; https://www.rfc-editor.org/rfc/rfc4271
CVE: CVE-2023-4695
Published: 2023-09-01
Description: Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1241
References: https://github.com/pkp/pkp-lib/commit/e5e7e543887fe77708aa31e07b18fe85f9b5a3b5; https://huntr.dev/bounties/887c7fc7-70c8-482d-b570-350533af4702; https://github.com/pkp/pkp-lib/commit/e5e7e543887fe77708aa31e07b18fe85f9b5a3b5
CVE: CVE-2023-4696
Published: 2023-09-01
Description: Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/usememos/memos/commit/c9aa2eeb9852047e4f41915eb30726bd25f07ecd; https://huntr.dev/bounties/4747a485-77c3-4bb5-aab0-21253ef303ca; https://github.com/usememos/memos/commit/c9aa2eeb9852047e4f41915eb30726bd25f07ecd
CVE: CVE-2023-4697
Published: 2023-09-01
Description: Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://github.com/usememos/memos/commit/c9aa2eeb9852047e4f41915eb30726bd25f07ecd; https://huntr.dev/bounties/3ff3325a-1dcb-4da7-894d-81a9cf726d81; https://github.com/usememos/memos/commit/c9aa2eeb9852047e4f41915eb30726bd25f07ecd
CVE: CVE-2023-4698
Published: 2023-09-01
Description: Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/usememos/memos/commit/c9aa2eeb9852047e4f41915eb30726bd25f07ecd; https://huntr.dev/bounties/e1107d79-1d63-4238-90b7-5cc150512654; https://github.com/usememos/memos/commit/c9aa2eeb9852047e4f41915eb30726bd25f07ecd
CVE: CVE-2022-44349
Published: 2023-09-01
Description: NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/MVRC-ITSEC/CVEs/blob/main/CVE-2022-44349; https://www.navblue.aero/product/n-crew-planning/; https://github.com/MVRC-ITSEC/CVEs/blob/main/CVE-2022-44349
CVE: CVE-2023-24674
Published: 2023-09-01
Description: Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://cupc4k3.medium.com/cve-2023-24674-uncovering-a-privilege-escalation-vulnerability-in-bludit-cms-dcf86c41107; https://medium.com/%40cupc4k3/privilege-scalation-in-bludit-cms-dcf86c41107; https://cupc4k3.medium.com/cve-2023-24674-uncovering-a-privilege-escalation-vulnerability-in-bludit-cms-dcf86c41107
CVE: CVE-2023-24675
Published: 2023-09-01
Description: Cross Site Scripting Vulnerability in BluditCMS v.3.14.1 allows attackers to execute arbitrary code via the Categories Friendly URL.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cupc4k3.medium.com/cve-2023-24674-uncovering-a-privilege-escalation-vulnerability-in-bludit-cms-dcf86c41107; https://medium.com/%40cupc4k3/xss-stored-in-friendly-url-field-on-bludit-cms-641a9dd653f; https://cupc4k3.medium.com/cve-2023-24674-uncovering-a-privilege-escalation-vulnerability-in-bludit-cms-dcf86c41107
CVE: CVE-2023-39685
Published: 2023-09-01
Description: An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://github.com/hjson/hjson-java/issues/27; https://github.com/hjson/hjson-java/issues/27
CVE: CVE-2023-41364
Published: 2023-09-01
Description: In tine through 2023.01.14.325, the sort parameter of the /index.php endpoint allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2023-0002/; https://www.tine-groupware.de/
CVE: CVE-2023-4704
Published: 2023-09-01
Description: External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-15, CWE-610
References: https://github.com/instantsoft/icms2/commit/bc22d89691fdaf38055eba13dda8d959b16fa731; https://huntr.dev/bounties/4a54134d-df1f-43d4-9b14-45f023cd654a; https://github.com/instantsoft/icms2/commit/bc22d89691fdaf38055eba13dda8d959b16fa731
CVE: CVE-2022-46527
Published: 2023-09-01
Description: ELSYS ERS 1.5 Sound v2.3.8 was discovered to contain a buffer overflow via the NFC data parser.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-46527.pdf; https://www.elsys.se/en/ers-sound/; https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-46527.pdf
CVE: CVE-2022-4343
Published: 2023-09-01
Description: An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/gitlab/-/issues/385124; https://hackerone.com/reports/1767797; https://gitlab.com/gitlab-org/gitlab/-/issues/385124
CVE: CVE-2023-0120
Published: 2023-09-01
Description: An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user.
CVSS Score: 3.5 (LOW)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/387531; https://hackerone.com/reports/1818425; https://gitlab.com/gitlab-org/gitlab/-/issues/387531
CVE: CVE-2023-1279
Published: 2023-09-01
Description: An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project.
CVSS Score: 2.6 (LOW)
CWE: CWE-601, CWE-601
References: https://gitlab.com/gitlab-org/gitlab/-/issues/395437; https://hackerone.com/reports/1889230; https://gitlab.com/gitlab-org/gitlab/-/issues/395437
CVE: CVE-2023-1555
Published: 2023-09-01
Description: An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API.
CVSS Score: 2.7 (LOW)
CWE: CWE-262
References: https://gitlab.com/gitlab-org/gitlab/-/issues/398587; https://hackerone.com/reports/1911908; https://gitlab.com/gitlab-org/gitlab/-/issues/398587
CVE: CVE-2023-24412
Published: 2023-09-01
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Image Social Feed plugin <= 1.7.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/add-instagram/wordpress-image-social-feed-plugin-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/add-instagram/wordpress-image-social-feed-plugin-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25042
Published: 2023-09-01
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy (Storm Consultancy) oAuth Twitter Feed for Developers plugin <= 2.3.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/oauth-twitter-feed-for-developers/wordpress-oauth-twitter-feed-for-developers-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/oauth-twitter-feed-for-developers/wordpress-oauth-twitter-feed-for-developers-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25044
Published: 2023-09-01
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sumo Social Share Boost plugin <= 4.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/social-share-boost/wordpress-social-share-boost-plugin-4-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/social-share-boost/wordpress-social-share-boost-plugin-4-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-25477
Published: 2023-09-01
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yotuwp Video Gallery plugin <= 1.3.12 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/yotuwp-easy-youtube-embed/wordpress-video-gallery-youtube-playlist-channel-gallery-by-yotuwp-plugin-1-3-12-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yotuwp-easy-youtube-embed/wordpress-video-gallery-youtube-playlist-channel-gallery-by-yotuwp-plugin-1-3-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25488
Published: 2023-09-01
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Duc Bui Quang WP Default Feature Image plugin <= 1.0.1.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-default-feature-image/wordpress-wp-default-feature-image-plugin-1-0-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-default-feature-image/wordpress-wp-default-feature-image-plugin-1-0-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-3205
Published: 2023-09-01
Description: An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/gitlab/-/issues/415067; https://hackerone.com/reports/2011464; https://gitlab.com/gitlab-org/gitlab/-/issues/415067
CVE: CVE-2023-3210
Published: 2023-09-01
Description: An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/gitlab/-/issues/415074; https://hackerone.com/reports/2011474; https://gitlab.com/gitlab-org/gitlab/-/issues/415074
CVE: CVE-2023-3915
Published: 2023-09-01
Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified as external and may be used to access internal projects.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-279, CWE-732
References: https://gitlab.com/gitlab-org/gitlab/-/issues/417664; https://hackerone.com/reports/2040834; https://gitlab.com/gitlab-org/gitlab/-/issues/417664
CVE: CVE-2023-3950
Published: 2023-09-01
Description: An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://gitlab.com/gitlab-org/gitlab/-/issues/419675; https://hackerone.com/reports/2079154; https://gitlab.com/gitlab-org/gitlab/-/issues/419675
CVE: CVE-2023-40239
Published: 2023-09-01
Description: Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or higher) is required to remediate the vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://publications.lexmark.com/publications/security-alerts/CVE-2023-40239.pdf; https://publications.lexmark.com/publications/security-alerts/CVE-2023-40239.pdf
CVE: CVE-2023-40969
Published: 2023-09-01
Description: Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-918
References: https://github.com/komangsughosa/CVE-ID-not-yet/blob/main/slims/slims9_bulian-9.6.1-SSRF-pop_p2p.md; https://github.com/slims/slims9_bulian/issues/204; https://github.com/komangsughosa/CVE-ID-not-yet/blob/main/slims/slims9_bulian-9.6.1-SSRF-pop_p2p.md
CVE: CVE-2023-40970
Published: 2023-09-01
Description: Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/komangsughosa/CVE-ID-not-yet/blob/main/slims/slims9_bulian-9.6.1-SQLI-loan_rules.md; https://github.com/slims/slims9_bulian/issues/205; https://github.com/komangsughosa/CVE-ID-not-yet/blob/main/slims/slims9_bulian-9.6.1-SQLI-loan_rules.md
CVE: CVE-2023-4018
Published: 2023-09-01
Description: An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425
References: https://gitlab.com/gitlab-org/gitlab/-/issues/420301; https://hackerone.com/reports/2083440; https://gitlab.com/gitlab-org/gitlab/-/issues/420301
CVE: CVE-2023-4378
Published: 2023-09-01
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-201
References: https://gitlab.com/gitlab-org/gitlab/-/issues/422134; https://hackerone.com/reports/2104591; https://gitlab.com/gitlab-org/gitlab/-/issues/422134
CVE: CVE-2023-4647
Published: 2023-09-01
Description: An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/414502; https://gitlab.com/gitlab-org/gitlab/-/issues/414502
CVE: CVE-2022-22305
Published: 2023-09-01
Description: An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-297, CWE-295
References: https://fortiguard.com/psirt/FG-IR-18-292; https://fortiguard.com/psirt/FG-IR-18-292
CVE: CVE-2023-34011
Published: 2023-09-01
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ShopConstruct plugin <= 1.1.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/shopconstruct/wordpress-shopconstruct-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shopconstruct/wordpress-shopconstruct-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-37893
Published: 2023-09-01
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chop-Chop Coming Soon Chop Chop plugin <= 2.2.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cc-coming-soon/wordpress-coming-soon-chop-chop-plugin-2-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cc-coming-soon/wordpress-coming-soon-chop-chop-plugin-2-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-37986
Published: 2023-09-01
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange YourMembership Single Sign On – YM SSO Login plugin <= 1.1.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/login-with-yourmembership/wordpress-yourmembership-single-sign-on-plugin-1-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/login-with-yourmembership/wordpress-yourmembership-single-sign-on-plugin-1-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-37994
Published: 2023-09-01
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Artem Abramovich Art Decoration Shortcode plugin <= 1.5.6 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/art-decoration-shortcode/wordpress-art-decoration-shortcode-plugin-1-5-6-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/art-decoration-shortcode/wordpress-art-decoration-shortcode-plugin-1-5-6-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-37997
Published: 2023-09-01
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dharmesh Patel Post List With Featured Image plugin <= 1.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/post-list-with-featured-image/wordpress-post-list-with-featured-image-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/post-list-with-featured-image/wordpress-post-list-with-featured-image-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-37826
Published: 2023-09-01
Description: A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fieldname parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://case.contwise.com/php/portal_case.php; https://github.com/Popeye-ITSec/CVEs/blob/main/CVE-2023-37826; https://case.contwise.com/php/portal_case.php
CVE: CVE-2023-37827
Published: 2023-09-01
Description: A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the executionBlockName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://case.contwise.com/php/portal_case.php; https://github.com/Popeye-ITSec/CVEs/blob/main/CVE-2023-37827; https://case.contwise.com/php/portal_case.php
CVE: CVE-2023-37828
Published: 2023-09-01
Description: A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tasktyp parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://case.contwise.com/php/portal_case.php; https://github.com/Popeye-ITSec/CVEs/blob/main/CVE-2023-37828; https://case.contwise.com/php/portal_case.php