deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41896
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the allowed max size, TensorFlow will crash. We have patched the issue in GitHub commit 39ec7eaf1428e90c37787e5b3fbd68ebd3c48860. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-1284
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/mirror_pad_op.cc; https://github.com/tensorflow/tensorflow/commit/39ec7eaf1428e90c37787e5b3fbd68ebd3c48860; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rmg2-f698-wq35
CVE: CVE-2022-41897
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. If `FractionMaxPoolGrad` is given outsize inputs `row_pooling_sequence` and `col_pooling_sequence`, TensorFlow will crash. We have patched the issue in GitHub commit d71090c3e5ca325bdf4b02eb236cfb3ee823e927. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-125
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/fractional_max_pool_op.cc; https://github.com/tensorflow/tensorflow/commit/d71090c3e5ca325bdf4b02eb236cfb3ee823e927; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f2w8-jw48-fr7j
CVE: CVE-2022-41898
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. If `SparseFillEmptyRowsGrad` is given empty inputs, TensorFlow will crash. We have patched the issue in GitHub commit af4a6a3c8b95022c351edae94560acc61253a1b8. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sparse_fill_empty_rows_op_gpu.cu.cc; https://github.com/tensorflow/tensorflow/commit/af4a6a3c8b95022c351edae94560acc61253a1b8; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hq7g-wwwp-q46h
CVE: CVE-2022-41899
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaOptimizer`. We have patched the issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-617
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sdca_internal.cc; https://github.com/tensorflow/tensorflow/commit/80ff197d03db2a70c6a111f97dcdacad1b0babfa; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-27rc-728f-x5w2
CVE: CVE-2022-41900
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or remote code execution. We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cherry pick this commit on TensorFlow 2.10.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-787
References: https://github.com/tensorflow/tensorflow/commit/216525144ee7c910296f5b05d214ca1327c9ce48; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xvwp-h6jv-7472; https://github.com/tensorflow/tensorflow/commit/216525144ee7c910296f5b05d214ca1327c9ce48
CVE: CVE-2022-41901
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail in `tf.raw_ops.SparseMatrixNNZ`. We have patched the issue in GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-617
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sparse/sparse_matrix.h; https://github.com/tensorflow/tensorflow/commit/f856d02e5322821aad155dad9b3acab1e9f5d693; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-g9fm-r5mm-rf9f
CVE: CVE-2022-41907
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have patched the issue in GitHub commit 00c821af032ba9e5f5fa3fe14690c8d28a657624. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-131
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/resize_nearest_neighbor_op.cc; https://github.com/tensorflow/tensorflow/commit/00c821af032ba9e5f5fa3fe14690c8d28a657624; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-368v-7v32-52fx
CVE: CVE-2022-41908
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`. We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc; https://github.com/tensorflow/tensorflow/commit/9f03a9d3bafe902c1e6beb105b2f24172f238645; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mv77-9g28-cwg3
CVE: CVE-2022-41909
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `tf.raw_ops.CompositeTensorVariantToComponents`. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-476
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc; https://github.com/tensorflow/tensorflow/commit/660ce5a89eb6766834bdc303d2ab3902aef99d3d; https://github.com/tensorflow/tensorflow/commit/bf594d08d377dc6a3354d9fdb494b32d45f91971
CVE: CVE-2022-41911
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's the underlying storage) and then we typecast it to the element type. However, conversions from `char` to `bool` are undefined if the `char` is not `0` or `1`, so sanitizers/fuzzers will crash. The issue has been patched in GitHub commit `1be74370327`. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1, TensorFlow 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-704
References: https://github.com/tensorflow/tensorflow/blob/807cae8a807960fd7ac2313cde73a11fc15e7942/tensorflow/core/framework/tensor.cc#L1200-L1227; https://github.com/tensorflow/tensorflow/commit/1be[PII_REDACTED]82a357adbf9b77dcb994fe8b508; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pf36-r9c6-h97j
CVE: CVE-2021-22141
Published: 2022-11-18
Description: An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964; https://www.elastic.co/community/security/; https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964
CVE: CVE-2021-31739
Published: 2022-11-18
Description: The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient address.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.pentagrid.ch/en/blog/multiple-vulnerabilities-in-seppmail/; https://www.pentagrid.ch/en/blog/multiple-vulnerabilities-in-seppmail/
CVE: CVE-2021-33621
Published: 2022-11-18
Description: The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD/
CVE: CVE-2021-37936
Published: 2022-11-18
Description: It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077; https://www.elastic.co/community/security/; https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077
CVE: CVE-2022-31694
Published: 2022-11-18
Description: InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may allow an attacker to plant a malicious DLL in the installer parent directory to allow executing code with the privileges of the installer (when the popup triggers the loading of the library). Exploiting these type of vulnerabilities generally require that an attacker has access to a vulnerable machine to plant the malicious DLL.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://blog.installbuilder.com/2022/11/installbuilder-22100-released.html; https://blog.installbuilder.com/2022/11/installbuilder-22100-released.html
CVE: CVE-2022-34827
Published: 2022-11-18
Description: Carel Boss Mini 1.5.0 has Improper Access Control.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-284
References: https://github.com/mandiant/Vulnerability-Disclosures; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0040/MNDT-2022-0040.md; https://github.com/mandiant/Vulnerability-Disclosures
CVE: CVE-2022-38871
Published: 2022-11-18
Description: In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/free5gc/free5gc/issues/198; https://github.com/free5gc/free5gc/issues/198
CVE: CVE-2022-40130
Published: 2022-11-18
Description: Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://patchstack.com/database/vulnerability/wp-polls/wordpress-wp-polls-plugin-2-76-0-race-condition-vulnerability?_s_id=cve; https://wordpress.org/plugins/wp-polls/#developers; https://patchstack.com/database/vulnerability/wp-polls/wordpress-wp-polls-plugin-2-76-0-race-condition-vulnerability?_s_id=cve
CVE: CVE-2022-40216
Published: 2022-11-18
Description: Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-10-69-messaging-block-bypass-vulnerability?_s_id=cve; https://wordpress.org/plugins/bp-better-messages/#developers; https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-10-69-messaging-block-bypass-vulnerability?_s_id=cve
CVE: CVE-2022-40695
Published: 2022-11-18
Description: Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/seo-redirection/wordpress-seo-redirection-plugin-plugin-8-9-multiple-cross-site-scripting-csrf-vulnerabilities?_s_id=cve; https://wordpress.org/plugins/seo-redirection/#developers; https://patchstack.com/database/vulnerability/seo-redirection/wordpress-seo-redirection-plugin-plugin-8-9-multiple-cross-site-scripting-csrf-vulnerabilities?_s_id=cve
CVE: CVE-2022-40698
Published: 2022-11-18
Description: Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-40963
Published: 2022-11-18
Description: Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-pagebuilder/wordpress-wp-page-builder-plugin-1-2-6-multiple-auth-stored-cross-site-scripting-xss-vulnerabilities?_s_id=cve; https://wordpress.org/plugins/wp-pagebuilder/; https://patchstack.com/database/vulnerability/wp-pagebuilder/wordpress-wp-page-builder-plugin-1-2-6-multiple-auth-stored-cross-site-scripting-xss-vulnerabilities?_s_id=cve
CVE: CVE-2022-41135
Published: 2022-11-18
Description: Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://patchstack.com/database/vulnerability/modula-best-grid-gallery/wordpress-modula-plugin-2-6-9-unauth-plugin-settings-change-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/modula-best-grid-gallery/wordpress-modula-plugin-2-6-9-unauth-plugin-settings-change-vulnerability?_s_id=cve
CVE: CVE-2022-41615
Published: 2022-11-18
Description: Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://patchstack.com/database/vulnerability/agile-store-locator/wordpress-store-locator-plugin-1-4-5-cross-site-scripting-xss-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/agile-store-locator/; https://patchstack.com/database/vulnerability/agile-store-locator/wordpress-store-locator-plugin-1-4-5-cross-site-scripting-xss-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-41618
Published: 2022-11-18
Description: Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress.
CVSS Score: 3.7 (LOW)
CWE: CWE-200, CWE-532
References: https://patchstack.com/database/vulnerability/media-library-assistant/wordpress-media-library-assistant-plugin-3-00-unauthenticated-error-log-disclosure-vulnerability?_s_id=cve; https://wordpress.org/plugins/media-library-assistant/#developers; https://patchstack.com/database/vulnerability/media-library-assistant/wordpress-media-library-assistant-plugin-3-00-unauthenticated-error-log-disclosure-vulnerability?_s_id=cve
CVE: CVE-2022-41634
Published: 2022-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/media-library-plus/wordpress-media-library-folders-plugin-7-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/media-library-plus/#developers; https://patchstack.com/database/vulnerability/media-library-plus/wordpress-media-library-folders-plugin-7-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-41643
Published: 2022-11-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/accessibility/wordpress-accessibility-plugin-1-0-1-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/accessibility/#developers; https://patchstack.com/database/vulnerability/accessibility/wordpress-accessibility-plugin-1-0-1-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-41655
Published: 2022-11-18
Description: Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/phone-orders-for-woocommerce/wordpress-phone-orders-for-woocommerce-plugin-3-7-1-auth-sensitive-data-exposure-vulnerability?_s_id=cve; https://wordpress.org/plugins/phone-orders-for-woocommerce/#developers; https://patchstack.com/database/vulnerability/phone-orders-for-woocommerce/wordpress-phone-orders-for-woocommerce-plugin-3-7-1-auth-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2022-41685
Published: 2022-11-18
Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/hungarian-pickup-points-for-woocommerce/wordpress-csomagpontok-es-szallitasi-cimkek-woocommerce-hez-plugin-1-9-0-2-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve; https://patchstack.com/database/vulnerability/integration-for-szamlazzhu-woocommerce/wordpress-integration-for-szamlazz-hu-woocommerce-plugin-5-6-3-2-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve; https://wordpress.org/plugins/hungarian-pickup-points-for-woocommerce/#developers
CVE: CVE-2022-41788
Published: 2022-11-18
Description: Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/soledad/wordpress-soledad-premium-theme-8-2-5-auth-cross-site-scripting-xss-vulnerability?_s_id=cve; https://themeforest.net/item/soledad-multiconcept-blogmagazine-wp-theme/12945398; https://patchstack.com/database/vulnerability/soledad/wordpress-soledad-premium-theme-8-2-5-auth-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-41839
Published: 2022-11-18
Description: Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/loginpress/wordpress-loginpress-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/loginpress/wordpress-loginpress-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-42459
Published: 2022-11-18
Description: Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264, CWE-269, CWE-269
References: https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-7-1-auth-wordpress-options-change-vulnerability?_s_id=cve; https://wordpress.org/plugins/image-hover-effects-ultimate/; https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-7-1-auth-wordpress-options-change-vulnerability?_s_id=cve
CVE: CVE-2022-42497
Published: 2022-11-18
Description: Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/vulnerability/api2cart-bridge-connector/wordpress-api2cart-bridge-connector-plugin-1-1-0-arbitrary-code-execution-vulnerability?_s_id=cve; https://wordpress.org/plugins/api2cart-bridge-connector/#developers; https://patchstack.com/database/vulnerability/api2cart-bridge-connector/wordpress-api2cart-bridge-connector-plugin-1-1-0-arbitrary-code-execution-vulnerability?_s_id=cve
CVE: CVE-2022-42698
Published: 2022-11-18
Description: Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://patchstack.com/database/vulnerability/api2cart-bridge-connector/wordpress-api2cart-bridge-connector-plugin-1-1-0-arbitrary-file-upload-vulnerability?_s_id=cve; https://wordpress.org/plugins/api2cart-bridge-connector/#developers; https://patchstack.com/database/vulnerability/api2cart-bridge-connector/wordpress-api2cart-bridge-connector-plugin-1-1-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2022-42883
Published: 2022-11-18
Description: Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-10-sensitive-information-disclosure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-10-sensitive-information-disclosure-vulnerability?_s_id=cve
CVE: CVE-2022-43492
Published: 2022-11-18
Description: Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-comments-wpdiscuz-plugin-7-4-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://wordpress.org/plugins/wpdiscuz/#developers; https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-comments-wpdiscuz-plugin-7-4-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve