deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38667
Published: 2023-08-22
Description: Stack-based buffer over-read in function disasm in nasm 2.16 allows attackers to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392812; https://bugzilla.nasm.us/show_bug.cgi?id=3392812
CVE: CVE-2023-38668
Published: 2023-08-22
Description: Stack-based buffer over-read in disasm in nasm 2.16 allows attackers to cause a denial of service (crash).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392811; https://bugzilla.nasm.us/show_bug.cgi?id=3392811
CVE: CVE-2023-38732
Published: 2023-08-22
Description: 
IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs. IBM X-Force ID: 262289.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262289; https://www.ibm.com/support/pages/node/7028221; https://exchange.xforce.ibmcloud.com/vulnerabilities/262289
CVE: CVE-2023-38996
Published: 2023-08-22
Description: An issue in all versions of Douran DSGate allows a local authenticated privileged attacker to execute arbitrary code via the debug command.
CVSS Score: 6.7 (MEDIUM)
References: https://douran.com/en-US/Dourtal/4797/page/DSGate; https://douran.com/fa-IR/Dourtal/4797/page/DSGate; https://gist.github.com/RNPG/53b579da330ba896aa8dc2d901e5e400
CVE: CVE-2023-39141
Published: 2023-08-22
Description: webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e; https://github.com/ziahamza/webui-aria2/blob/109903f0e2774cf948698cd95a01f77f33d7dd2c/node-server.js#L10; https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e
CVE: CVE-2023-39599
Published: 2023-08-22
Description: Cross-Site Scripting (XSS) vulnerability in CSZ CMS v.1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Social Settings parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/desencrypt/CVE/blob/main/CVE-2023-39599/Readme.md; https://github.com/desencrypt/CVE/blob/main/CVE-2023-39599/Readme.md; https://github.com/desencrypt/CVE/tree/main/CVE-2023-2
CVE: CVE-2023-3699
Published: 2023-08-22
Description: An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

CVSS Score: 8.7 (HIGH)
CWE: CWE-269
References: https://www.asustor.com/security/security_advisory_detail?id=29; https://www.asustor.com/security/security_advisory_detail?id=29
CVE: CVE-2023-4212
Published: 2023-08-22
Description: 
​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-234-02; https://hub.tranetechnologies.com/docs/DOC-216377; https://www.trane.com/commercial/north-america/us/en/contact-us/locate-sales-offices.html
CVE: CVE-2023-4475
Published: 2023-08-22
Description: An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

CVSS Score: 7.5 (HIGH)
CWE: CWE-552, CWE-552
References: https://www.asustor.com/security/security_advisory_detail?id=30; https://www.asustor.com/security/security_advisory_detail?id=30
CVE: CVE-2023-33850
Published: 2023-08-22
Description: IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203, CWE-203
References: https://www.ibm.com/support/pages/node/7010369; https://www.ibm.com/support/pages/node/7022413; https://www.ibm.com/support/pages/node/7022414
CVE: CVE-2020-24113
Published: 2023-08-22
Description: Directory Traversal vulnerability in Contacts File Upload Interface in Yealink W60B version 77.83.0.85, allows attackers to gain sensitive information and cause a denial of service (DoS).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://fuo.fi/CVE-2020-24113/; https://fuo.fi/CVE-2020-24113/
CVE: CVE-2023-38733
Published: 2023-08-22
Description: 
IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from installation logs.  IBM X-Force Id:  262293.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262293; https://www.ibm.com/support/pages/node/7028223; https://exchange.xforce.ibmcloud.com/vulnerabilities/262293
CVE: CVE-2023-38734
Published: 2023-08-22
Description: 
IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory.  IBM X-Force ID:  262481.


CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262481; https://www.ibm.com/support/pages/node/7028227; https://exchange.xforce.ibmcloud.com/vulnerabilities/262481
CVE: CVE-2023-39026
Published: 2023-08-22
Description: Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/174491/FileMage-Gateway-1.10.9-Local-File-Inclusion.html; https://raindayzz.com/technicalblog/2023/08/20/FileMage-Vulnerability.html; https://www.filemage.io/docs/updates.html#change-log
CVE: CVE-2023-40370
Published: 2023-08-22
Description: 
IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled.  IBM X-Force ID:  263470.


CVSS Score: 3.7 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/263470; https://www.ibm.com/support/pages/node/7028218; https://exchange.xforce.ibmcloud.com/vulnerabilities/263470
CVE: CVE-2023-4427
Published: 2023-08-23
Description: Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://packetstormsecurity.com/files/174951/Chrome-ReduceJSLoadPropertyWithEnumeratedKey-Out-Of-Bounds-Access.html; https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html; https://crbug.com/1470668
CVE: CVE-2023-4428
Published: 2023-08-23
Description: Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html; https://crbug.com/1470477; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
CVE: CVE-2023-4429
Published: 2023-08-23
Description: Use after free in Loader in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html; https://crbug.com/1469754; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
CVE: CVE-2023-4430
Published: 2023-08-23
Description: Use after free in Vulkan in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html; https://crbug.com/1469542; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
CVE: CVE-2023-4431
Published: 2023-08-23
Description: Out of bounds memory access in Fonts in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html; https://crbug.com/1469348; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
CVE: CVE-2023-39984
Published: 2023-08-23
Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Hitachi EH-VIEW (KeypadDesigner) allows local attackers to potentially disclose information and execute arbitray code on affected EH-VIEW installations. User interaction is required to exploit the vulnerabilities in that the user must open a malicious file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-119
References: https://www.hitachi.com/hirt/hitachi-sec/2023/002.html; https://www.hitachi.com/hirt/hitachi-sec/2023/002.html
CVE: CVE-2023-39985
Published: 2023-08-23
Description: ** UNSUPPORTED WHEN ASSIGNED ** Out-of-bounds Write vulnerability in Hitachi EH-VIEW (Designer) allows local attackers to potentially execute arbitray code on affected EH-VIEW installations. User interaction is required to exploit the vulnerabilities in that the user must open a malicious file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.hitachi.com/hirt/hitachi-sec/2023/002.html; https://www.hitachi.com/hirt/hitachi-sec/2023/002.html
CVE: CVE-2023-39986
Published: 2023-08-23
Description: ** UNSUPPORTED WHEN ASSIGNED ** Out-of-bounds Read vulnerability in Hitachi EH-VIEW (Designer) allows local attackers to potentially disclose information on affected EH-VIEW installations. User interaction is required to exploit the vulnerabilities in that the user must open a malicious file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.hitachi.com/hirt/hitachi-sec/2023/002.html; https://www.hitachi.com/hirt/hitachi-sec/2023/002.html
CVE: CVE-2023-3495
Published: 2023-08-23
Description: ** UNSUPPORTED WHEN ASSIGNED ** Out-of-bounds Write vulnerability in Hitachi EH-VIEW (KeypadDesigner) allows local attackers to potentially execute arbitray code on affected EH-VIEW installations. User interaction is required to exploit the vulnerabilities in that the user must open a malicious file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.hitachi.com/hirt/hitachi-sec/2023/002.html; https://www.hitachi.com/hirt/hitachi-sec/2023/002.html
CVE: CVE-2023-4404
Published: 2023-08-23
Description: The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://plugins.trac.wordpress.org/browser/charitable/tags/1.7.0.12/includes/users/class-charitable-user.php#L866; https://www.wordfence.com/threat-intel/vulnerabilities/id/522ecc1c-5834-4325-9234-79cf712213f3?source=cve; https://plugins.trac.wordpress.org/browser/charitable/tags/1.7.0.12/includes/users/class-charitable-user.php#L866
CVE: CVE-2023-38585
Published: 2023-08-23
Description: Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://download.ganzsecurity.pl/; https://ganzsecurity.com/release/1578/digimasterpixelmaster-security-notice; https://jvn.jp/en/vu/JVNVU92545432/
CVE: CVE-2023-40158
Published: 2023-08-23
Description: Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
CVSS Score: 8.8 (HIGH)
CWE: CWE-912
References: https://download.ganzsecurity.pl/; https://ganzsecurity.com/release/1578/digimasterpixelmaster-security-notice; https://jvn.jp/en/vu/JVNVU92545432/
CVE: CVE-2023-40144
Published: 2023-08-23
Description: OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://download.ganzsecurity.pl/; https://ganzsecurity.com/release/1578/digimasterpixelmaster-security-notice; https://jvn.jp/en/vu/JVNVU92545432/
CVE: CVE-2023-40282
Published: 2023-08-23
Description: Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's Management Screen. As a result, sensitive information may be obtained and/or the settings may be changed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://jvn.jp/en/jp/JVN55217369/; https://network.mobile.rakuten.co.jp/product/internet/rakuten-wifi-pocket/support/; https://jvn.jp/en/jp/JVN55217369/
CVE: CVE-2023-4041
Published: 2023-08-23
Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787, CWE-913, CWE-120, CWE-494
References: https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000XT8GsQAL?operationContext=S1; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000XT8GsQAL?operationContext=S1
CVE: CVE-2023-41098
Published: 2023-08-23
Description: An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/09fb0cba65eab9341e81f1cbebc2ae10be34a2b7; https://github.com/MISP/MISP/commit/09fb0cba65eab9341e81f1cbebc2ae10be34a2b7
CVE: CVE-2023-41100
Published: 2023-08-23
Description: An issue was discovered in the hcaptcha (aka hCaptcha for EXT:form) extension before 2.1.2 for TYPO3. It fails to check that the required captcha field is submitted in the form data. allowing a remote user to bypass the CAPTCHA check.
CVSS Score: 5.3 (MEDIUM)
References: https://typo3.org/security/advisory/typo3-ext-sa-2023-007; https://typo3.org/security/advisory/typo3-ext-sa-2023-007
CVE: CVE-2023-41104
Published: 2023-08-23
Description: libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://docs.varnish-software.com/security/VSV00012/; https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3; https://www.varnish-cache.org/security/VSV00012.html
CVE: CVE-2023-41105
Published: 2023-08-23
Description: An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
CVSS Score: 7.5 (HIGH)
CWE: CWE-426
References: https://github.com/python/cpython/issues/106242; https://github.com/python/cpython/pull/107981; https://github.com/python/cpython/pull/107982
CVE: CVE-2023-3899
Published: 2023-08-23
Description: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-285, CWE-863
References: https://access.redhat.com/errata/RHSA-2023:4701; https://access.redhat.com/errata/RHSA-2023:4702; https://access.redhat.com/errata/RHSA-2023:4703
CVE: CVE-2023-32119
Published: 2023-08-23
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPO365 | Mail Integration for Office 365 / Outlook plugin <= 1.9.0 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mail-integration-365/wordpress-wpo365-mail-integration-for-office-365-outlook-plugin-1-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mail-integration-365/wordpress-wpo365-mail-integration-for-office-365-outlook-plugin-1-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-4042
Published: 2023-08-23
Description: A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://access.redhat.com/errata/RHSA-2023:7053; https://access.redhat.com/security/cve/CVE-2023-4042; https://bugzilla.redhat.com/show_bug.cgi?id=1870257
CVE: CVE-2023-32236
Published: 2023-08-23
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Booking Ultra Pro Booking Ultra Pro Appointments Booking Calendar Plugin <= 1.1.8 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/booking-ultra-pro/wordpress-booking-ultra-pro-appointments-booking-calendar-plugin-plugin-1-1-4-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/booking-ultra-pro/wordpress-booking-ultra-pro-appointments-booking-calendar-plugin-plugin-1-1-4-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-32496
Published: 2023-08-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bill Minozzi Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin <= 7.31 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/stopbadbots/wordpress-block-bad-bots-and-stop-bad-bots-crawlers-and-spiders-and-anti-spam-protection-plugin-7-31-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stopbadbots/wordpress-block-bad-bots-and-stop-bad-bots-crawlers-and-spiders-and-anti-spam-protection-plugin-7-31-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32497
Published: 2023-08-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Supersoju Block Referer Spam plugin <= 1.1.9.4 versions.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/block-referer-spam/wordpress-block-referer-spam-plugin-1-1-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/block-referer-spam/wordpress-block-referer-spam-plugin-1-1-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32498
Published: 2023-08-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Easy Form team Easy Form by AYS plugin <= 1.2.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-form/wordpress-easy-form-by-ays-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-form/wordpress-easy-form-by-ays-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32499
Published: 2023-08-23
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tony Zeoli, Tony Hayes Radio Station by netmix® – Manage and play your Show Schedule in WordPress! plugin <= 2.4.0.9 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/radio-station/wordpress-radio-station-plugin-2-4-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/radio-station/wordpress-radio-station-plugin-2-4-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28994
Published: 2023-08-23
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UX-themes Flatsome plugin <= 3.16.8 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/flatsome/wordpress-flatsome-theme-3-16-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/flatsome/wordpress-flatsome-theme-3-16-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32300
Published: 2023-08-23
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpseo-local/wordpress-yoast-seo-local-plugin-14-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpseo-local/wordpress-yoast-seo-local-plugin-14-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve