deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-48376
Published: 2023-05-09
Description: In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48377
Published: 2023-05-09
Description: In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48378
Published: 2023-05-09
Description: In engineermode service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48379
Published: 2023-05-09
Description: In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48380
Published: 2023-05-09
Description: In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48381
Published: 2023-05-09
Description: In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48382
Published: 2023-05-09
Description: In log service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48383
Published: 2023-05-09
Description: .In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48384
Published: 2023-05-09
Description: In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48385
Published: 2023-05-09
Description: In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48386
Published: 2023-05-09
Description: the apipe driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48387
Published: 2023-05-09
Description: the apipe driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48388
Published: 2023-05-09
Description: In powerEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2022-48389
Published: 2023-05-09
Description: In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]82133761
CVE: CVE-2023-29092
Published: 2023-05-09
Description: An issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, and Exynos 1080. Binding of a wrong resource can occur due to improper handling of parameters while binding a network interface.
CVSS Score: 3.1 (LOW)
CWE: CWE-755, CWE-732
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-30740
Published: 2023-05-09
Description: SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality, limited impact on integrity and availability of the application.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-200
References: https://launchpad.support.sap.com/#/notes/3313484; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3313484
CVE: CVE-2023-30741
Published: 2023-05-09
Description: Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3309935; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3309935
CVE: CVE-2023-30742
Published: 2023-05-09
Description: SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.An attacker could store a malicious URL and lure the victim to click, causing the script supplied by the attacker to execute in the victim user's session. The information from the victim's session could then be modified or read by the attacker.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3315971; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3315971
CVE: CVE-2023-30743
Published: 2023-05-09
Description: Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5 control allows injection of untrusted CSS. This blocks user’s interaction with the application. Further, in the absence of URL validation by the application, the vulnerability could lead to the attacker reading or modifying user’s information through phishing attack.


CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3326210; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3326210
CVE: CVE-2023-30744
Published: 2023-05-09
Description: In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming and directory API to instantiate an object which has methods which can be called without further authorization and authentication.  A subsequent call to one of these methods can read or change the state of existing services without any effect on availability.


CVSS Score: 8.2 (HIGH)
CWE: CWE-306
References: https://launchpad.support.sap.com/#/notes/3317453; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3317453
CVE: CVE-2023-31404
Published: 2023-05-09
Description: Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could let them access data sources which would otherwise be restricted.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://launchpad.support.sap.com/#/notes/3038911; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3038911
CVE: CVE-2023-31406
Published: 2023-05-09
Description: Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3319400; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3319400
CVE: CVE-2023-31407
Published: 2023-05-09
Description: SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3312892; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3312892
CVE: CVE-2023-32111
Published: 2023-05-09
Description: In SAP PowerDesigner (Proxy) - version 16.7, an attacker can send a crafted request from a remote host to the proxy machine and crash the proxy server, due to faulty implementation of memory management causing a memory corruption. This leads to a high impact on availability of the application.


CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/3300624; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3300624
CVE: CVE-2023-32112
Published: 2023-05-09
Description: Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618, S4CORE 100, does not perform necessary authorization checks for an authenticated user to access some of its function. This could lead to modification of data impacting the integrity of the system.


CVSS Score: 2.8 (LOW)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2335198; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/2335198
CVE: CVE-2023-32113
Published: 2023-05-09
Description: SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a prepared shortcut file. Depending on the authorizations of the victim, the attacker can read and modify potentially sensitive information after successful exploitation.


CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://launchpad.support.sap.com/#/notes/3320467; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3320467
CVE: CVE-2021-44283
Published: 2023-05-09
Description: A buffer overflow in the component /Enclave.cpp of Electronics and Telecommunications Research Institute ShieldStore commit 58d455617f99705f0ffd8a27616abdf77bdc1bdc allows attackers to cause an information leak via a crafted structure from an untrusted operating system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: http://electronics.com; http://shieldstore.com; https://github.com/cocoppang/ShieldStore/blob/master/Enclave/Enclave.cpp
CVE: CVE-2022-4537
Published: 2023-05-09
Description: The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-348, CWE-345
References: https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.0.18/models/Brute.php#L131; https://plugins.trac.wordpress.org/browser/hide-my-wp/trunk/models/Brute.php#L132; https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf89f94-587a-4fed-a6e4-3876b7dbc9ba?source=cve
CVE: CVE-2023-30237
Published: 2023-05-09
Description: CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: http://cyberghostvpn.com; https://cwe.mitre.org/data/definitions/77.html; https://www.pentestpartners.com/security-blog/bullied-by-bugcrowd-over-kape-cyberghost-disclosure/
CVE: CVE-2023-2590
Published: 2023-05-09
Description: Missing Authorization in GitHub repository answerdev/answer prior to 1.0.9.
CVSS Score: 3.5 (LOW)
CWE: CWE-862
References: https://github.com/answerdev/answer/commit/51ac1e6b76ae9ab3ca2008ca4819c0cc3bd2fcd3; https://huntr.dev/bounties/a4238a30-3ddb-4415-9055-e179c3d4dea7; https://github.com/answerdev/answer/commit/51ac1e6b76ae9ab3ca2008ca4819c0cc3bd2fcd3
CVE: CVE-2023-23863
Published: 2023-05-09
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Black and White Digital Ltd TreePress – Easy Family Trees & Ancestor Profiles plugin <= 2.0.22 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/treepress/wordpress-treepress-easy-family-trees-ancestor-profiles-plugin-2-0-22-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/treepress/wordpress-treepress-easy-family-trees-ancestor-profiles-plugin-2-0-22-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-41640
Published: 2023-05-09
Description: Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Rymera Web Co Wholesale Suite plugin <= 2.1.5 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-wholesale-prices/wordpress-wholesale-suite-plugin-2-1-5-authenticated-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-wholesale-prices/wordpress-wholesale-suite-plugin-2-1-5-authenticated-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23664
Published: 2023-05-09
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ConvertBox ConvertBox Auto Embed WordPress plugin <= 1.0.19 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/convertbox-auto-embed/wordpress-convertbox-auto-embed-wordpress-plugin-plugin-1-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/convertbox-auto-embed/wordpress-convertbox-auto-embed-wordpress-plugin-plugin-1-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23793
Published: 2023-05-09
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eightweb Interactive Read More Without Refresh plugin <= 3.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/read-more-without-refresh/wordpress-read-more-without-refresh-plugin-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/read-more-without-refresh/wordpress-read-more-without-refresh-plugin-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-2591
Published: 2023-05-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nilsteampassnet/teampass/commit/57a977c6323656e5dc06ab5c227e75c3465a1a4a; https://huntr.dev/bounties/705f79f4-f5e3-41d7-82a5-f00441cd984b; https://github.com/nilsteampassnet/teampass/commit/57a977c6323656e5dc06ab5c227e75c3465a1a4a
CVE: CVE-2023-23732
Published: 2023-05-09
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joel James Disqus Conditional Load plugin <= 11.0.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/disqus-conditional-load/wordpress-disqus-conditional-load-plugin-11-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/disqus-conditional-load/wordpress-disqus-conditional-load-plugin-11-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23733
Published: 2023-05-09
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joel James Lazy Social Comments plugin <= 2.0.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/lazy-facebook-comments/wordpress-lazy-social-comments-plugin-2-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/lazy-facebook-comments/wordpress-lazy-social-comments-plugin-2-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23734
Published: 2023-05-09
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Voswinkel Userlike – WordPress Live Chat plugin <= 2.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/userlike/wordpress-userlike-wordpress-live-chat-plugin-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/userlike/wordpress-userlike-wordpress-live-chat-plugin-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23862
Published: 2023-05-09
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Vertical scroll recent post plugin <= 14.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/vertical-scroll-recent-post/wordpress-vertical-scroll-recent-post-plugin-14-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/vertical-scroll-recent-post/wordpress-vertical-scroll-recent-post-plugin-14-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23883
Published: 2023-05-09
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Gwyer WP Content Filter plugin <= 3.0.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-content-filter/wordpress-wp-content-filter-censor-all-offensive-content-from-your-site-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-content-filter/wordpress-wp-content-filter-censor-all-offensive-content-from-your-site-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23884
Published: 2023-05-09
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/kanban/wordpress-kanban-boards-for-wordpress-plugin-2-5-20-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/kanban/wordpress-kanban-boards-for-wordpress-plugin-2-5-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24372
Published: 2023-05-09
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in USB Memory Direct Simple Custom Author Profiles plugin <= 1.0.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/simple-custom-author-profiles/wordpress-simple-custom-author-profiles-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-custom-author-profiles/wordpress-simple-custom-author-profiles-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-46822
Published: 2023-05-09
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in JC Development Team WooCommerce JazzCash Gateway Plugin plugin <= 2.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/jazzcash-woocommerce-gateway/wordpress-woocommerce-jazzcash-gateway-plugin-plugin-2-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/jazzcash-woocommerce-gateway/wordpress-woocommerce-jazzcash-gateway-plugin-plugin-2-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-46844
Published: 2023-05-09
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pixfields/wordpress-pixfields-plugin-0-7-0-auth-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pixfields/wordpress-pixfields-plugin-0-7-0-auth-cross-site-scripting-xss-vulnerability?_s_id=cve