deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4592
Published: 2023-11-03
Description: A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie session details of an authenticated user, resulting in a session hijacking.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wpn-xm-serverstack; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wpn-xm-serverstack
CVE: CVE-2022-45805
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paytm Paytm Payment Gateway paytm-payments allows SQL Injection.This issue affects Paytm Payment Gateway: from n/a through 2.7.3.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-3-auth-sql-injection-sqli-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-3-auth-sql-injection-sqli-vulnerability?_s_id=cve
CVE: CVE-2022-46808
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems ARMember armember-membership allows SQL Injection.This issue affects ARMember: from n/a through 3.4.11.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-3-4-11-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-3-4-11-sql-injection?_s_id=cve
CVE: CVE-2022-46859
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-1-auth-sql-injection-sqli-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-1-auth-sql-injection-sqli-vulnerability?_s_id=cve
CVE: CVE-2022-47426
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Neshan Maps Platform Neshan Maps neshan-maps allows SQL Injection.This issue affects Neshan Maps: from n/a through 1.1.4.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/neshan-maps/wordpress-neshan-maps-plugin-1-1-4-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/neshan-maps/wordpress-neshan-maps-plugin-1-1-4-sql-injection?_s_id=cve
CVE: CVE-2022-47445
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Web-X Be POPIA Compliant be-popia-compliant allows SQL Injection.This issue affects Be POPIA Compliant: from n/a through 1.2.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/be-popia-compliant/wordpress-be-popia-compliant-plugin-1-2-0-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/be-popia-compliant/wordpress-be-popia-compliant-plugin-1-2-0-sql-injection?_s_id=cve
CVE: CVE-2023-25960
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zendrop Zendrop – Global Dropshipping zendrop-dropshipping-and-fulfillment allows SQL Injection.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/zendrop-dropshipping-and-fulfillment/wordpress-zendrop-global-dropshipping-plugin-1-0-0-arbitrary-code-execution?_s_id=cve; https://patchstack.com/database/vulnerability/zendrop-dropshipping-and-fulfillment/wordpress-zendrop-global-dropshipping-plugin-1-0-0-arbitrary-code-execution?_s_id=cve
CVE: CVE-2023-26015
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Chris Richardson MapPress Maps for WordPress mappress-google-maps-for-wordpress allows SQL Injection.This issue affects MapPress Maps for WordPress: from n/a through 2.85.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/mappress-google-maps-for-wordpress/wordpress-mappress-maps-for-wordpress-plugin-2-85-4-authenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mappress-google-maps-for-wordpress/wordpress-mappress-maps-for-wordpress-plugin-2-85-4-authenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-3961
Published: 2023-11-03
Description: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://access.redhat.com/errata/RHSA-2023:6209; https://access.redhat.com/errata/RHSA-2023:6744; https://access.redhat.com/errata/RHSA-2023:7371
CVE: CVE-2023-46947
Published: 2023-11-03
Description: Subrion 4.2.1 has a remote command execution vulnerability in the backend.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/intelliants/subrion/issues/909; https://github.com/intelliants/subrion/issues/909
CVE: CVE-2023-5707
Published: 2023-11-03
Description: The SEO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slider' shortcode and post meta in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/seo-slider/trunk/includes/shortcode.php?rev=2367856#L68; https://plugins.trac.wordpress.org/browser/seo-slider/trunk/includes/shortcode.php?rev=2367856#L71; https://plugins.trac.wordpress.org/changeset/2987802/seo-slider#file3
CVE: CVE-2023-5945
Published: 2023-11-03
Description: The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the responsive_video_gallery_with_lightbox_video_management_func() function. This makes it possible for unauthenticated attackers to delete videos hosted from the video slider via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/wp-plugins/wp-responsive-video-gallery-with-lightbox/blob/master/wp-responsive-video-gallery-with-lightbox.php; https://plugins.trac.wordpress.org/browser/wp-responsive-video-gallery-with-lightbox/tags/1.0.1/wp-responsive-video-gallery-with-lightbox.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/dc052b00-65a7-4668-8bdd-b06d69d12a4a?source=cve
CVE: CVE-2023-5088
Published: 2023-11-03
Description: A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-821, CWE-662
References: https://access.redhat.com/errata/RHSA-2024:2135; https://access.redhat.com/errata/RHSA-2024:2962; https://access.redhat.com/security/cve/CVE-2023-5088
CVE: CVE-2023-5946
Published: 2023-11-03
Description: The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/1428184/digirisk/trunk/modules/society/controller/group.controller.01.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d41355ed-77d0-48b3-bbb3-4cc3b4df4b2a?source=cve; https://plugins.trac.wordpress.org/changeset/1428184/digirisk/trunk/modules/society/controller/group.controller.01.php
CVE: CVE-2022-46818
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopi Ramasamy Email posts to subscribers allows SQL Injection.This issue affects Email posts to subscribers: from n/a through 6.2.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/email-posts-to-subscribers/wordpress-email-posts-to-subscribers-plugin-6-2-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/email-posts-to-subscribers/wordpress-email-posts-to-subscribers-plugin-6-2-sql-injection?_s_id=cve
CVE: CVE-2023-46404
Published: 2023-11-03
Description: PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://bitbucket.org/utmandrew/pcrs/commits/5f18bcbb383b7d73f7a8b399cc52b23597d752ae; https://github.com/windecks/CVE-2023-46404; https://bitbucket.org/utmandrew/pcrs/commits/5f18bcbb383b7d73f7a8b399cc52b23597d752ae
CVE: CVE-2023-46980
Published: 2023-11-03
Description: An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/sajaljat/CVE-2023-46980/tree/main; https://youtu.be/3Mz2lSElg7Y; https://github.com/sajaljat/CVE-2023-46980/tree/main
CVE: CVE-2023-23368
Published: 2023-11-03
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2376 build 20230421 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2376 build 20230421 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-23-31; https://www.qnap.com/en/security-advisory/qsa-23-31
CVE: CVE-2023-23369
Published: 2023-11-03
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions:
Multimedia Console 2.1.2 ( 2023/05/04 ) and later
Multimedia Console 1.4.8 ( 2023/05/05 ) and later
QTS 5.1.0.2399 build 20230515 and later
QTS 4.3.6.2441 build 20230621 and later
QTS 4.3.4.2451 build 20230621 and later
QTS 4.3.3.2420 build 20230621 and later
QTS 4.2.6 build 20230621 and later
Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later
Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

CVSS Score: 9.0 (CRITICAL)
CWE: CWE-77, CWE-78, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-23-35; https://www.qnap.com/en/security-advisory/qsa-23-35
CVE: CVE-2023-25700
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-unauthenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-25800
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.2.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-multiple-student-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-multiple-student-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-25990
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-multiple-tutor-instructor-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-multiple-tutor-instructor-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-32121
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Highfivery LLC Zero Spam for WordPress allows SQL Injection.This issue affects Zero Spam for WordPress: from n/a through 5.4.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/zero-spam/wordpress-zero-spam-for-wordpress-plugin-5-4-4-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/zero-spam/wordpress-zero-spam-for-wordpress-plugin-5-4-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-32508
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolf van Gelder Order Your Posts Manually allows SQL Injection.This issue affects Order Your Posts Manually: from n/a through 2.2.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/order-your-posts-manually/wordpress-order-your-posts-manually-plugin-2-2-5-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/order-your-posts-manually/wordpress-order-your-posts-manually-plugin-2-2-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-34179
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Inc. Groundhogg allows SQL Injection.This issue affects Groundhogg: from n/a through 2.7.11.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-2-7-10-3-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-2-7-10-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-36529
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQL Injection.This issue affects Houzez - Real Estate WordPress Theme: from n/a through 1.3.4.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/houzez-crm/wordpress-houzez-crm-plugin-1-3-3-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/houzez-crm/wordpress-houzez-crm-plugin-1-3-3-sql-injection?_s_id=cve
CVE: CVE-2023-39299
Published: 2023-11-03
Description: A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following versions:
Music Station 4.8.11 and later
Music Station 5.1.16 and later
Music Station 5.3.23 and later

CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-23-61; https://www.qnap.com/en/security-advisory/qsa-23-61
CVE: CVE-2023-39301
Published: 2023-11-03
Description: A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2514 build 20230906 and later
QTS 5.1.1.2491 build 20230815 and later
QuTS hero h5.0.1.2515 build 20230907 and later
QuTS hero h5.1.1.2488 build 20230812 and later
QuTScloud c5.1.0.2498 and later

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://www.qnap.com/en/security-advisory/qsa-23-51; https://www.qnap.com/en/security-advisory/qsa-23-51
CVE: CVE-2023-3893
Published: 2023-11-03
Description: A security issue was discovered in Kubernetes where a user that can 
create pods on Windows nodes running kubernetes-csi-proxy may be able to
 escalate to admin privileges on those nodes. Kubernetes clusters are 
only affected if they include Windows nodes running 
kubernetes-csi-proxy.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/kubernetes/kubernetes/issues/119594; https://groups.google.com/g/kubernetes-security-announce/c/lWksE2BoCyQ; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-3172
Published: 2023-11-03
Description: A security issue was discovered in kube-apiserver that allows an 
aggregated API server to redirect client traffic to any URL.  This could
 lead to the client performing unexpected actions as well as forwarding 
the client's API server credentials to third parties.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/kubernetes/kubernetes/issues/112513; https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-43554
Published: 2023-11-03
Description: Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt
CVE: CVE-2022-43555
Published: 2023-11-03
Description: Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt
CVE: CVE-2022-44569
Published: 2023-11-03
Description: A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://help.ivanti.com/res/help/en_US/IA/2023/Admin/Content/relnotes.htm; https://help.ivanti.com/res/help/en_US/IA/2023/Admin/Content/relnotes.htm
CVE: CVE-2023-41725
Published: 2023-11-03
Description: Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt
CVE: CVE-2023-41726
Published: 2023-11-03
Description: Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt
CVE: CVE-2023-47233
Published: 2023-11-03
Description: The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this "could be exploited in a real world scenario." This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.suse.com/show_bug.cgi?id=1216702; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0f7352557a35ab7888bc7831411ec8a3cbe20d78; https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
CVE: CVE-2023-47234
Published: 2023-11-03
Description: An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes).
CVSS Score: 7.5 (HIGH)
References: https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html; https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf
CVE: CVE-2023-47235
Published: 2023-11-03
Description: An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome.
CVSS Score: 7.5 (HIGH)
References: https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html; https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b
CVE: CVE-2023-36677
Published: 2023-11-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Injection.This issue affects SP Project & Document Manager: from n/a through 4.67.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-67-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-67-sql-injection?_s_id=cve
CVE: CVE-2023-45189
Published: 2023-11-03
Description: A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result in access to client vault credentials.  This difficult to exploit vulnerability could allow a low privileged attacker to programmatically access client vault credentials.  IBM X-Force ID:  268752.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/268752; https://www.ibm.com/support/pages/node/7065204; https://exchange.xforce.ibmcloud.com/vulnerabilities/268752