deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-5252
Published: 2023-10-30
Description: The FareHarbor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-89
References: https://plugins.trac.wordpress.org/browser/fareharbor/tags/3.6.7/fareharbor.php#L287; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2890569%40fareharbor%2Ftags%2F3.6.7&new=2985980%40fareharbor%2Ftags%2F3.6.8; https://www.wordfence.com/threat-intel/vulnerabilities/id/42ad6fef-4280-45db-a3e2-6d7522751fa7?source=cve
CVE: CVE-2023-5315
Published: 2023-10-30
Description: The Google Maps made Simple plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-gmappity-easy-google-maps/tags/0.6/wpgmappity-metadata.php#L127; https://www.wordfence.com/threat-intel/vulnerabilities/id/262db9aa-0db5-48cd-a85b-3e6302e88a42?source=cve; https://plugins.trac.wordpress.org/browser/wp-gmappity-easy-google-maps/tags/0.6/wpgmappity-metadata.php#L127
CVE: CVE-2023-5335
Published: 2023-10-30
Description: The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/buzzsprout-podcasting/tags/1.8.3/buzzsprout-podcasting.php#L271; https://plugins.trac.wordpress.org/changeset/2990144/buzzsprout-podcasting; https://www.wordfence.com/threat-intel/vulnerabilities/id/be7f8b73-801d-46e8-81c1-8bb0bb576700?source=cve
CVE: CVE-2023-5362
Published: 2023-10-30
Description: The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'spice_post_slider' shortcode in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/spice-post-slider/tags/1.9/include/view/shortcode.php#L102; https://plugins.trac.wordpress.org/browser/spice-post-slider/tags/2.0.1/include/view/shortcode.php?rev=2981648#L102; https://plugins.trac.wordpress.org/changeset/2981654/spice-post-slider
CVE: CVE-2023-5565
Published: 2023-10-30
Description: The Shortcode Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortmenu' shortcode in versions up to, and including, 3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/shortcode-menu/tags/3.2/shortcode-menu.php#L183; https://www.wordfence.com/threat-intel/vulnerabilities/id/438b9c13-4059-4671-ab4a-07a8cf6f6122?source=cve; https://plugins.trac.wordpress.org/browser/shortcode-menu/tags/3.2/shortcode-menu.php#L183
CVE: CVE-2023-5566
Published: 2023-10-30
Description: The Simple Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/smpl-shortcodes/tags/1.0.20/includes/shortcodes.php#L257; https://plugins.trac.wordpress.org/browser/smpl-shortcodes/tags/1.0.20/includes/shortcodes.php#L292; https://plugins.trac.wordpress.org/browser/smpl-shortcodes/tags/1.0.20/includes/shortcodes.php#L386
CVE: CVE-2023-5583
Published: 2023-10-30
Description: The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.34 via deserialization of untrusted input from the 'wpsimplegallery_gallery' post meta via 'wpsgallery' shortcode. This allows authenticated attackers, with contributor-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/wp-simple-galleries/tags/1.34/wp-simple-gallery.php#L250; https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc8f7cf-d8be-4229-b823-3bd9bc9f6eda?source=cve; https://plugins.trac.wordpress.org/browser/wp-simple-galleries/tags/1.34/wp-simple-gallery.php#L250
CVE: CVE-2023-5666
Published: 2023-10-30
Description: The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcpaccordion' shortcode in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/accordions-wp/trunk/theme/custom-wp-accordion-themes.php?rev=2406278#L24; https://plugins.trac.wordpress.org/changeset/2982015/accordions-wp#file370; https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ada876-4a8b-494f-9132-d88a71b42c44?source=cve
CVE: CVE-2023-5843
Published: 2023-10-30
Description: The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/ads-by-datafeedrcom/tags/1.1.3/inc/dfads.class.php#L34; https://plugins.trac.wordpress.org/changeset/2991088/ads-by-datafeedrcom; https://www.wordfence.com/threat-intel/vulnerabilities/id/5412fd87-49bc-445c-8d16-443e38933d1e?source=cve
CVE: CVE-2022-48189
Published: 2023-10-30
Description: An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code. 
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-106014; https://support.lenovo.com/us/en/product_security/LEN-106014
CVE: CVE-2022-4573
Published: 2023-10-30
Description: 
An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-106014; https://support.lenovo.com/us/en/product_security/LEN-106014
CVE: CVE-2022-4574
Published: 2023-10-30
Description: 
An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.  


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-106014; https://support.lenovo.com/us/en/product_security/LEN-106014
CVE: CVE-2022-4575
Published: 2023-10-30
Description: 
A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-106014; https://support.lenovo.com/us/en/product_security/LEN-106014
CVE: CVE-2023-44323
Published: 2023-10-30
Description: Adobe Acrobat for Edge version 118.0.2088.46 (and earlier) is affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44323; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44323
CVE: CVE-2023-4964
Published: 2023-10-30
Description: Potential open redirect vulnerability
in opentext Service Management Automation X
(SMAX)  versions 2020.05, 2020.08,
2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11 and opentext Asset
Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11. The
vulnerability could allow attackers to redirect a user to
malicious websites.








CVSS Score: 8.2 (HIGH)
CWE: CWE-601, CWE-601
References: https://portal.microfocus.com/s/article/KM000022703?language=en_US; https://portal.microfocus.com/s/article/KM000022703?language=en_US
CVE: CVE-2021-39810
Published: 2023-10-30
Description: In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://source.android.com/security/bulletin/2025-09-01; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2022-20264
Published: 2023-10-30
Description: In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21293
Published: 2023-10-30
Description: In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21294
Published: 2023-10-30
Description: In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21295
Published: 2023-10-30
Description: In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21296
Published: 2023-10-30
Description: In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21297
Published: 2023-10-30
Description: In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-287
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21298
Published: 2023-10-30
Description: In Slice, there is a possible disclosure of installed applications due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-203, CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21299
Published: 2023-10-30
Description: In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21300
Published: 2023-10-30
Description: In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21301
Published: 2023-10-30
Description: In ActivityManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21302
Published: 2023-10-30
Description: In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21303
Published: 2023-10-30
Description: In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21304
Published: 2023-10-30
Description: In Content Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21305
Published: 2023-10-30
Description: In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21306
Published: 2023-10-30
Description: In ContentService, there is a possible way to read installed sync content providers due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21307
Published: 2023-10-30
Description: In Bluetooth, there is a possible way for a paired Bluetooth device to access a long term identifier for an Android device due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21308
Published: 2023-10-30
Description: In Composer, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21309
Published: 2023-10-30
Description: In libcore, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21310
Published: 2023-10-30
Description: In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21311
Published: 2023-10-30
Description: In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21312
Published: 2023-10-30
Description: In IntentResolver, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21313
Published: 2023-10-30
Description: In Core, there is a possible way to forward calls without user knowledge due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21314
Published: 2023-10-30
Description: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21315
Published: 2023-10-30
Description: In Bluetooth, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21316
Published: 2023-10-30
Description: In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21317
Published: 2023-10-30
Description: In ContentService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14