deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38698
Published: 2023-08-04
Description: Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function. The vulnerability resides `@ensdomains/ens-contracts` prior to version 0.0.22.

If successfully exploited, this vulnerability would enable attackers to force the expiration of any ENS record, ultimately allowing them to claim the affected domains for themselves. Currently, it would require a malicious DAO to exploit it. Nevertheless, any vulnerability present in the controllers could potentially render this issue exploitable in the future. An additional concern is the possibility of renewal discounts. Should ENS decide to implement a system that offers unlimited .eth domains for a fixed fee in the future, the vulnerability could become exploitable by any user due to the reduced attack cost.

Version 0.0.22 contains a patch for this issue. As long as registration cost remains linear or superlinear based on registration duration, or limited to a reasonable maximum (eg, 1 million years), this vulnerability could only be exploited by a malicious DAO. The interim workaround is thus to take no action.

CVSS Score: 4.9 (MEDIUM)
CWE: CWE-190
References: https://github.com/ensdomains/ens-contracts/blob/master/contracts/ethregistrar/BaseRegistrarImplementation.sol#L171; https://github.com/ensdomains/ens-contracts/commit/e6b136e979084de3761c[PII_REDACTED]4173990ca; https://github.com/ensdomains/ens-contracts/security/advisories/GHSA-rrxv-q8m4-wch3
CVE: CVE-2023-38699
Published: 2023-08-04
Description: MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-311
References: https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd[PII_REDACTED]3b; https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0; https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw
CVE: CVE-2023-39107
Published: 2023-08-04
Description: An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-59
References: https://kb.nomachine.com/SU07U00247; https://kb.nomachine.com/TR07U10948; https://www.ns-echo.com/posts/nomachine_afo.html
CVE: CVE-2023-4157
Published: 2023-08-04
Description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitHub repository omeka/omeka-s prior to version 4.0.3.

CVSS Score: 5.2 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://github.com/omeka/omeka-s/commit/8b72619d9731b32dd21ab6dcaa01ccc3bbf0db63; https://huntr.dev/bounties/abc3521b-1238-4c4e-97f1-2957db670014; https://github.com/omeka/omeka-s/commit/8b72619d9731b32dd21ab6dcaa01ccc3bbf0db63
CVE: CVE-2023-4158
Published: 2023-08-04
Description: Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/omeka/omeka-s/commit/2a7fb26452167c8a1d95f207ae5328c6b1b0fcf8; https://huntr.dev/bounties/e0e462ae-d7cb-4a84-b6fe-5f5de20e3d15; https://github.com/omeka/omeka-s/commit/2a7fb26452167c8a1d95f207ae5328c6b1b0fcf8
CVE: CVE-2023-4159
Published: 2023-08-04
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository omeka/omeka-s prior to 4.0.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/omeka/omeka-s/commit/2a7fb26452167c8a1d95f207ae5328c6b1b0fcf8; https://huntr.dev/bounties/e2e2365e-6a5f-4ca4-9ef1-297e3ed41f9c; https://github.com/omeka/omeka-s/commit/2a7fb26452167c8a1d95f207ae5328c6b1b0fcf8
CVE: CVE-2023-38700
Published: 2023-08-04
Description: matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Version 1.0.1n fixes this issue. As a workaround, set the `matrixHandler.eventCacheSize` config value to `0`. This workaround may impact performance.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://github.com/matrix-org/matrix-appservice-irc/commit/8bbd2b69a16cbcbeffdd9b5c973fd89d61498d75; https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1; https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c7hh-3v6c-fj4q
CVE: CVE-2023-38702
Published: 2023-08-04
Description: Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload `template file` on the server, but does not need any authorization to be reached. When the JSP file is uploaded, the attacker just needs to connect to `/knowageqbeengine/foo.jsp` to gain code execution on the server. By exploiting this vulnerability, an attacker with low privileges can upload a JSP file to the `knowageqbeengine` directory and gain code execution capability on the server. This issue has been patched in Knowage version 8.1.8.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-7mjh-73q3-c3fc; https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-7mjh-73q3-c3fc
CVE: CVE-2023-38707
Published: 2023-08-04
Description: Rejected reason: This CVE has been rejected because of [CNA rule 7.4.7](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_7_assignment_rules):
```
7.4.7 CNAs SHOULD NOT assign CVE IDs to vulnerabilities in products that are not publicly available or licensable.
```
The repository with the vulnerable code is private, and therefore the product is not publicly available.
CVE: CVE-2023-39551
Published: 2023-08-04
Description: PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/Online%20Security%20Guards%20Hiring%20System%201.0.md; https://nvd.nist.gov/vuln/detail/CVE-2023-39551; https://www.chtsecurity.com/news/0dbe8e1d-0a6c-4604-9cf1-778ddc86a8c1
CVE: CVE-2023-39552
Published: 2023-08-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-0527. Reason: This candidate is a reservation duplicate of CVE-2023-0527. Notes: All CVE users should reference CVE-2023-0527 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-4955
Published: 2023-08-04
Description: Inappropriate implementation in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1349146; https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html
CVE: CVE-2023-38696
Published: 2023-08-04
Description: Rejected reason: This CVE has been rejected because it is unclear whether the issue rests in the original repository `microsoft/ContosoAir`, the forked repository `Apetree100122/ContosoAir`, or both. If the Microsoft repository is vulnerable, [Microsoft](https://www.cve.org/PartnerInformation/ListofPartners/partner/microsoft) is the appropriate CVE Numbering Authority.
CVE: CVE-2023-39344
Published: 2023-08-04
Description: social-media-skeleton is an uncompleted social media project. A SQL injection vulnerability in the project allows UNION based injections, which indirectly leads to remote code execution. Commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1 contains a fix for this issue.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://github.com/fobybus/social-media-skeleton/commit/3cabdd35c3d874608883c9eaf9bf69b2014d25c1; https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-857x-p6fq-mgfh; https://github.com/fobybus/social-media-skeleton/commit/3cabdd35c3d874608883c9eaf9bf69b2014d25c1
CVE: CVE-2020-26064
Published: 2023-08-04
Description: A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system.
 The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to read and write files within the affected application.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611, CWE-611
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx2-KpFVSUc; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx2-KpFVSUc
CVE: CVE-2020-26065
Published: 2023-08-04
Description: A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system.
 The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to view arbitrary files on the affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanpt2-FqLuefsS; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanpt2-FqLuefsS
CVE: CVE-2020-26082
Published: 2023-08-04
Description: A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass content filters that are configured on an affected device.
 The vulnerability is due to improper handling of password-protected zip files. An attacker could exploit this vulnerability by sending a malicious file inside a crafted zip-compressed file to an affected device. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-zip-bypass-gbU4gtTg; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-zip-bypass-gbU4gtTg
CVE: CVE-2023-39346
Published: 2023-08-04
Description: LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file. The problem has been patched in commit 20dba06bd1a3cf260612d4f21547c25002121cd5. There are no known workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/bjrjk/LinuxASMCallGraph/commit/20dba06bd1a3cf260612d4f21547c25002121cd5; https://github.com/bjrjk/LinuxASMCallGraph/issues/6; https://github.com/bjrjk/LinuxASMCallGraph/issues/8
CVE: CVE-2020-23564
Published: 2023-08-05
Description: File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/a1ertx55/cmstest/blob/main/semcms.md; https://github.com/a1ertx55/cmstest/blob/master/semcms.md; https://github.com/a1ertx55/cmstest/blob/main/semcms.md
CVE: CVE-2022-46782
Published: 2023-08-05
Description: An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine.
CVSS Score: 7.8 (HIGH)
References: https://advisories.stormshield.eu/2022-028/; https://advisories.stormshield.eu/2022-028/
CVE: CVE-2023-33367
Published: 2023-08-05
Description: A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33367; https://www.controlid.com.br/en/access-control/idsecure/; https://claroty.com/team82/disclosure-dashboard/cve-2023-33367
CVE: CVE-2023-38943
Published: 2023-08-05
Description: ShuiZe_0x727 v1.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /iniFile/config.ini.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/0x727/ShuiZe_0x727; https://github.com/0x727/ShuiZe_0x727/issues/160; https://github.com/0x727/ShuiZe_0x727
CVE: CVE-2023-36095
Published: 2023-08-05
Description: An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://langchain.com; https://github.com/hwchase17/langchain; https://github.com/langchain-ai/langchain/issues/5872
CVE: CVE-2023-39508
Published: 2023-08-05
Description: Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0

This issue affects Apache Airflow: before 2.6.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200, CWE-250
References: http://seclists.org/fulldisclosure/2023/Jul/43; https://github.com/apache/airflow/pull/29706; https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15
CVE: CVE-2023-4165
Published: 2023-08-05
Description: A vulnerability, which was classified as critical, was found in Tongda OA. This affects an unknown part of the file general/system/seal_manage/iweboffice/delete_seal.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-236181 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/nagenanhai/cve/blob/main/sql.md; https://vuldb.com/?ctiid.236181; https://vuldb.com/?id.236181
CVE: CVE-2023-4166
Published: 2023-08-05
Description: A vulnerability has been found in Tongda OA and classified as critical. This vulnerability affects unknown code of the file general/system/seal_manage/dianju/delete_log.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-236182 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Das1yGa0/cve/blob/main/sql.md; https://vuldb.com/?ctiid.236182; https://vuldb.com/?id.236182
CVE: CVE-2023-4167
Published: 2023-08-05
Description: A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic. This issue affects some unknown processing of the file /web/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-236183.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/whoamiecho/vuls/blob/main/emby.md; https://vuldb.com/?ctiid.236183; https://vuldb.com/?id.236183
CVE: CVE-2023-4168
Published: 2023-08-05
Description: A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of the component Redirect Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/174015/Adlisting-Classified-Ads-2.14.0-Information-Disclosure.html; https://vuldb.com/?ctiid.236184; https://vuldb.com/?id.236184
CVE: CVE-2023-4169
Published: 2023-08-05
Description: A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/sys/set_passwd of the component Administrator Password Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-236185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/blakespire/repoforcve/tree/main/RG-EW1200G; https://vuldb.com/?ctiid.236185; https://vuldb.com/?id.236185
CVE: CVE-2023-4187
Published: 2023-08-05
Description: Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/instantsoft/icms2/commit/1dbc3e6c8fbf5d2dc551cb27fad0de3584dee40f; https://huntr.dev/bounties/14941381-b669-4756-94fc-cce172472f8b; https://github.com/instantsoft/icms2/commit/1dbc3e6c8fbf5d2dc551cb27fad0de3584dee40f
CVE: CVE-2023-4170
Published: 2023-08-05
Description: A vulnerability was found in DedeBIZ 6.2.10. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Article Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-236186 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Wkingxc/CVE/blob/master/dedebiz_XSS.pdf; https://vuldb.com/?ctiid.236186; https://vuldb.com/?id.236186
CVE: CVE-2023-4188
Published: 2023-08-05
Description:  SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/instantsoft/icms2/commit/1dbc3e6c8fbf5d2dc551cb27fad0de3584dee40f; https://huntr.dev/bounties/fe9809b6-40ad-4e81-9197-a9aa42e8a7bf; https://github.com/instantsoft/icms2/commit/1dbc3e6c8fbf5d2dc551cb27fad0de3584dee40f
CVE: CVE-2023-4189
Published: 2023-08-05
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/instantsoft/icms2/commit/1dbc3e6c8fbf5d2dc551cb27fad0de3584dee40f; https://huntr.dev/bounties/b00e6986-64e7-464e-ba44-e42476bfcdc4; https://github.com/instantsoft/icms2/commit/1dbc3e6c8fbf5d2dc551cb27fad0de3584dee40f
CVE: CVE-2023-4171
Published: 2023-08-05
Description: A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file \Service\FileDownload.ashx. The manipulation of the argument Files leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-236206 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-24
References: https://github.com/nagenanhai/cve/blob/main/duqu.md; https://vuldb.com/?ctiid.236206; https://vuldb.com/?id.236206
CVE: CVE-2023-30491
Published: 2023-08-05
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.8 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/patron-button-and-widgets-by-codebard/wordpress-codebard-s-patron-button-and-widgets-for-patreon-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/patron-button-and-widgets-by-codebard/wordpress-codebard-s-patron-button-and-widgets-for-patreon-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34010
Published: 2023-08-05
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in submodule of David Lingren Media Library Assistant plugin  <= 3.0.7 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/media-library-assistant/wordpress-media-library-assistant-plugin-3-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/media-library-assistant/wordpress-media-library-assistant-plugin-3-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34377
Published: 2023-08-05
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joseph C Dolson My Content Management plugin <= 1.7.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/my-content-management/wordpress-my-content-management-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/my-content-management/wordpress-my-content-management-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-36678
Published: 2023-08-05
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-content-copy-protector/wordpress-wp-content-copy-protection-no-right-click-plugin-3-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-content-copy-protector/wordpress-wp-content-copy-protection-no-right-click-plugin-3-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve