deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-25784
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bon Plan Gratos Sticky Ad Bar plugin <= 1.3.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sticky-ad-bar/wordpress-sticky-ad-bar-plugin-plugin-1-3-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/sticky-ad-bar/wordpress-sticky-ad-bar-plugin-plugin-1-3-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25786
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Thom Stark Eyes Only: User Access Shortcode plugin <= 1.8.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/eyes-only-user-access-shortcode/wordpress-eyes-only-user-access-shortcode-plugin-1-8-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/eyes-only-user-access-shortcode/wordpress-eyes-only-user-access-shortcode-plugin-1-8-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25787
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wbolt team WP资源下载管理 plugin <= 1.3.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/download-info-page/wordpress-wp-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/download-info-page/wordpress-wp-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25789
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tapfiliate plugin <= 3.0.12 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/tapfiliate/wordpress-tapfiliate-plugin-3-0-12-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/tapfiliate/wordpress-tapfiliate-plugin-3-0-12-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25792
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XiaoMac WP Open Social plugin <= 5.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/open-social/wordpress-wp-open-social-plugin-5-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/open-social/wordpress-wp-open-social-plugin-5-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25797
Published: 2023-05-03
Description: Auth. Stored Cross-Site Scripting (XSS) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/vslider/wordpress-vslider-multi-image-slider-for-wordpress-plugin-4-1-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/vslider/wordpress-vslider-multi-image-slider-for-wordpress-plugin-4-1-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-40302
Published: 2023-05-03
Description: An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/FRRouting/frr/releases; https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html; https://www.debian.org/security/2023/dsa-5495
CVE: CVE-2022-40318
Published: 2023-05-03
Description: An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case. NOTE: this behavior occurs in bgp_open_option_parse in the bgp_open.c file, a different location (with a different attack vector) relative to CVE-2022-40302.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/FRRouting/frr/releases; https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html; https://www.debian.org/security/2023/dsa-5495
CVE: CVE-2022-43681
Published: 2023-05-03
Description: An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, throwing a SIGABRT signal and exiting. This results in a bgpd daemon restart, causing a Denial-of-Service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://forescout.com; https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html; https://www.debian.org/security/2023/dsa-5495
CVE: CVE-2023-1383
Published: 2023-05-03
Description: An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible.

This issue affects:

Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. 
Insignia TV with FireOS versions prior to 7.6.3.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-841
References: https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/; https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/
CVE: CVE-2023-22713
Published: 2023-05-03
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin <= 2.1.8 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpdm-gutenberg-blocks/wordpress-gutenberg-blocks-by-wordpress-download-manager-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpdm-gutenberg-blocks/wordpress-gutenberg-blocks-by-wordpress-download-manager-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25796
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Include WP BaiDu Submit plugin <= 1.2.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-baidu-submit/wordpress-wp-baidu-submit-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-baidu-submit/wordpress-wp-baidu-submit-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25798
Published: 2023-05-03
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Olevmedia Olevmedia Shortcodes plugin <= 1.1.9 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/olevmedia-shortcodes/wordpress-olevmedia-shortcodes-plugin-1-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/olevmedia-shortcodes/wordpress-olevmedia-shortcodes-plugin-1-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-1384
Published: 2023-05-03
Description: The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run

This issue affects:

Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5.
Insignia TV with FireOS versions prior to 7.6.3.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/; https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/
CVE: CVE-2023-1385
Published: 2023-05-03
Description: Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services.

This issue affects:

Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5.
Insignia TV with FireOS 7.6.3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-330
References: https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/; https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/
CVE: CVE-2023-23708
Published: 2023-05-03
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin <= 3.9.4 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/visualizer/wordpress-visualizer-tables-and-charts-manager-for-wordpress-plugin-3-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/visualizer/wordpress-visualizer-tables-and-charts-manager-for-wordpress-plugin-3-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23820
Published: 2023-05-03
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-profilepress-plugin-4-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-profilepress-plugin-4-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-22683
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themis Solutions, Inc. Clio Grow plugin <= 1.0.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/clio-grow-form/wordpress-clio-grow-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/clio-grow-form/wordpress-clio-grow-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23874
Published: 2023-05-03
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Metaphor Creations Ditty plugin <= 3.0.32 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/ditty-news-ticker/wordpress-ditty-wordpress-plugin-responsive-slider-list-and-ticker-display-plugin-3-0-32-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ditty-news-ticker/wordpress-ditty-wordpress-plugin-responsive-slider-list-and-ticker-display-plugin-3-0-32-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23876
Published: 2023-05-03
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TMS-Plugins wpDataTables plugin <= 2.1.49 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-wordpress-tables-table-charts-plugin-plugin-2-1-49-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-wordpress-tables-table-charts-plugin-plugin-2-1-49-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25979
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Video Gallery by Total-Soft Video Gallery plugin <= 1.7.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gallery-videos/wordpress-video-gallery-youtube-gallery-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gallery-videos/wordpress-video-gallery-youtube-gallery-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-46852
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Table Builder plugin <= 1.4.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-table-builder/wordpress-wp-table-builder-wordpress-table-plugin-plugin-1-4-6-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-table-builder/wordpress-wp-table-builder-wordpress-table-plugin-plugin-1-4-6-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-22372
Published: 2023-05-03
Description: 
In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-924
References: https://my.f5.com/manage/s/article/K000132522; https://my.f5.com/manage/s/article/K000132522
CVE: CVE-2023-23785
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DgCult Exquisite PayPal Donation plugin <= v2.0.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/exquisite-paypal-donation/wordpress-exquisite-paypal-donation-plugin-v2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/exquisite-paypal-donation/wordpress-exquisite-paypal-donation-plugin-v2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23808
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sergey Panasenko Sponsors Carousel plugin <= 4.02 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sponsors-carousel/wordpress-sponsors-carousel-plugin-4-02-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sponsors-carousel/wordpress-sponsors-carousel-plugin-4-02-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23809
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Moris Dov Stock market charts from finviz plugin <= 1.0.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/stock-market-charts-from-finviz/wordpress-stock-market-charts-from-finviz-plugin-1-0-cross-site-scripting-xss-vulnerability; https://patchstack.com/database/vulnerability/stock-market-charts-from-finviz/wordpress-stock-market-charts-from-finviz-plugin-1-0-cross-site-scripting-xss-vulnerability
CVE: CVE-2023-24461
Published: 2023-05-03
Description: 
An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://my.f5.com/manage/s/article/K000132539; https://my.f5.com/manage/s/article/K000132539
CVE: CVE-2023-24594
Published: 2023-05-03
Description: 
When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://my.f5.com/manage/s/article/K000133132; https://my.f5.com/manage/s/article/K000133132
CVE: CVE-2023-27378
Published: 2023-05-03
Description: 
Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://my.f5.com/manage/s/article/K000132726; https://my.f5.com/manage/s/article/K000132726
CVE: CVE-2023-28406
Published: 2023-05-03
Description: A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained.  


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://my.f5.com/manage/s/article/K000132768; https://my.f5.com/manage/s/article/K000132768
CVE: CVE-2023-28656
Published: 2023-05-03
Description: NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639, CWE-639
References: https://my.f5.com/manage/s/article/K000133417; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://my.f5.com/manage/s/article/K000133417
CVE: CVE-2023-28724
Published: 2023-05-03
Description: NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.1 (HIGH)
CWE: CWE-276, CWE-276
References: https://my.f5.com/manage/s/article/K000133233; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://my.f5.com/manage/s/article/K000133233
CVE: CVE-2023-28742
Published: 2023-05-03
Description: 
When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://my.f5.com/manage/s/article/K000132972; https://my.f5.com/manage/s/article/K000132972
CVE: CVE-2023-29163
Published: 2023-05-03
Description: 
When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://my.f5.com/manage/s/article/K20145107; https://my.f5.com/manage/s/article/K20145107
CVE: CVE-2023-29240
Published: 2023-05-03
Description: An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://my.f5.com/manage/s/article/K000132719; https://my.f5.com/manage/s/article/K000132719
CVE: CVE-2023-23830
Published: 2023-05-03
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-profilepress-plugin-4-5-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-profilepress-plugin-4-5-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-23875
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Himanshu Bing Site Verification plugin using Meta Tag plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bing-site-verification-using-meta-tag/wordpress-bing-site-verification-plugin-using-meta-tag-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bing-site-verification-using-meta-tag/wordpress-bing-site-verification-plugin-using-meta-tag-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23881
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GreenTreeLabs Circles Gallery plugin <= 1.0.10 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/circles-gallery/wordpress-circles-gallery-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/circles-gallery/wordpress-circles-gallery-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25967
Published: 2023-05-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/peepso-core/wordpress-community-by-peepso-social-network-membership-registration-user-profiles-plugin-6-0-2-0-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/peepso-core/wordpress-community-by-peepso-social-network-membership-registration-user-profiles-plugin-6-0-2-0-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-26017
Published: 2023-05-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.10.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/job-postings/wordpress-jobs-for-wordpress-plugin-2-5-10-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/job-postings/wordpress-jobs-for-wordpress-plugin-2-5-10-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25826
Published: 2023-05-03
Description: Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html; https://github.com/OpenTSDB/opentsdb/pull/2275; https://www.synopsys.com/blogs/software-security/opentsdb/
CVE: CVE-2023-25827
Published: 2023-05-03
Description: 
Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a reflected XSS vulnerability with the suggestion endpoint.


CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/OpenTSDB/opentsdb/pull/2274; https://www.synopsys.com/blogs/software-security/opentsdb/; https://github.com/OpenTSDB/opentsdb/pull/2274
CVE: CVE-2017-11197
Published: 2023-05-03
Description: In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user via a bug within the "add printer" option.
CVSS Score: 7.8 (HIGH)
References: http://lp.cyberark.com/rs/316-CZP-275/images/ds-Viewfinity-102315-web.pdf; https://www.exploit-db.com/exploits/42319; http://lp.cyberark.com/rs/316-CZP-275/images/ds-Viewfinity-102315-web.pdf
CVE: CVE-2020-22429
Published: 2023-05-03
Description: redox-os v0.1.0 was discovered to contain a use-after-free bug via the gethostbyaddr() function at /src/header/netdb/mod.rs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://burtonqin.github.io/posts/2023/04/CVE-2020-22429/; https://gitlab.redox-os.org/redox-os/relibc/issues/159; https://burtonqin.github.io/posts/2023/04/CVE-2020-22429/