deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-125105
Published: 2023-06-05
Description: A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of the argument exclusion_list/blc_custom_fields leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.10.2 is able to address this issue. The patch is named 90615fe9b0b6f9e6fb254d503c302e53a202e561. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230659.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/broken-link-checker/commit/90615fe9b0b6f9e6fb254d503c302e53a202e561; https://github.com/wp-plugins/broken-link-checker/releases/tag/1.10.2; https://vuldb.com/?ctiid.230659
CVE: CVE-2023-0041
Published: 2023-06-05
Description: IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration.  IBM X-Force ID:  243657.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/243657; https://www.ibm.com/support/pages/node/7000021; https://exchange.xforce.ibmcloud.com/vulnerabilities/243657
CVE: CVE-2023-27861
Published: 2023-06-05
Description: IBM Maximo Application Suite - Manage Component 8.8.0 and 8.9.0 transmits sensitive information in cleartext that could be intercepted by an attacker using man in the middle techniques.  IBM X-Force ID:  249208.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249208; https://www.ibm.com/support/pages/node/6999917; https://exchange.xforce.ibmcloud.com/vulnerabilities/249208
CVE: CVE-2023-32334
Published: 2023-06-05
Description: IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.  IBM X-Force ID:  255074.
CVSS Score: 3.7 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/255074; https://www.ibm.com/support/pages/node/6999721; https://www.ibm.com/support/pages/node/6999747
CVE: CVE-2023-34407
Published: 2023-06-05
Description: OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://cybir.com/2023/cve/proof-of-concept-checkpoint-learning-harbinger-systems-offline-player-multiple-poc-for-cl-4-0-6-0-2-lfi-excessive-rights/; https://cybir.com/2023/cve/proof-of-concept-checkpoint-learning-harbinger-systems-offline-player-multiple-poc-for-cl-4-0-6-0-2-lfi-excessive-rights/
CVE: CVE-2023-34408
Published: 2023-06-05
Description: DokuWiki before 2023-04-04a allows XSS via RSS titles.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/dokuwiki/dokuwiki/compare/release-2023-04-04...release-2023-04-04a; https://github.com/dokuwiki/dokuwiki/pull/3967; https://huntr.dev/bounties/c6119106-1a5c-464c-94dd-ee7c5d0bece0/
CVE: CVE-2023-34410
Published: 2023-06-05
Description: An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://codereview.qt-project.org/c/qt/qtbase/+/477560; https://codereview.qt-project.org/c/qt/qtbase/+/480002; https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
CVE: CVE-2023-0635
Published: 2023-06-05
Description: Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Privilege Escalation.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.01; NEXUS Series: from 3.0;0 before 3.07.01; MATRIX Series: from 3.0;0 before 3.07.01.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1391
References: https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2023-0636
Published: 2023-06-05
Description: Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Command Injection.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.0; NEXUS Series: from 3.0;0 before 3.07.0; MATRIX Series: from 3.0;0 before 3.07.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2023-32217
Published: 2023-06-05
Description: IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-470, CWE-470
References: https://www.sailpoint.com/security-advisories/sailpoint-identityiq-unsafe-use-of-reflection-vulnerability-cve-2023-32217/; https://www.sailpoint.com/security-advisories/sailpoint-identityiq-unsafe-use-of-reflection-vulnerability-cve-2023-32217/
CVE: CVE-2023-34411
Published: 2023-06-05
Description: The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://github.com/00xc/xml-rs/commit/0f084d45aa53e4a[PII_REDACTED]5f59f2bd7d59a9f; https://github.com/netvl/xml-rs/commit/c09549a187e62d39d40467f129e64abf32efc35c; https://github.com/netvl/xml-rs/compare/0.8.13...0.8.14
CVE: CVE-2023-3096
Published: 2023-06-05
Description: A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects the function changedSource. The manipulation leads to improper access controls. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.1-130 is able to address this issue. It is recommended to upgrade the affected component. VDB-230686 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/i900008/vulndb/blob/main/kylinos_vul1.md; https://vuldb.com/?ctiid.230686; https://vuldb.com/?id.230686
CVE: CVE-2023-3097
Published: 2023-06-05
Description: A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been rated as critical. This issue affects the function setMainSource. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.1-130 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230687. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/i900008/vulndb/blob/main/kylinos_vul2.md; https://vuldb.com/?ctiid.230687; https://vuldb.com/?id.230687
CVE: CVE-2023-3098
Published: 2023-06-05
Description: A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS. Affected is the function restore_all_sound_file. The manipulation leads to path traversal: '../filedir'. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.2-0kylin6k70-23 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230688. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-24, CWE-22
References: https://github.com/i900008/vulndb/blob/main/kylinos_vul3.md; https://vuldb.com/?ctiid.230688; https://vuldb.com/?id.230688
CVE: CVE-2023-3099
Published: 2023-06-05
Description: A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the library dbus.SystemBus of the component Arbitrary File Handler. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.2-0kylin6k70-23 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230689 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://github.com/i900008/vulndb/blob/main/kylinos_vul4.md; https://vuldb.com/?ctiid.230689; https://vuldb.com/?id.230689
CVE: CVE-2015-10112
Published: 2023-06-05
Description: A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress. Affected is the function admin_screen_logic of the file wooframework-branding.php. The manipulation of the argument url leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is f12fccd7b5eaf66442346f748c901ef504742f78. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230652.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/wp-plugins/wooframework-branding/commit/f12fccd7b5eaf66442346f748c901ef504742f78; https://vuldb.com/?ctiid.230652; https://vuldb.com/?id.230652
CVE: CVE-2023-3100
Published: 2023-06-05
Description: A vulnerability, which was classified as critical, has been found in IBOS 4.5.5. Affected by this issue is the function actionDel of the file ?r=dashboard/approval/del. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-230690 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/shulao2020/cve/blob/main/IBOS%20sql.md; https://vuldb.com/?ctiid.230690; https://vuldb.com/?id.230690
CVE: CVE-2023-3064
Published: 2023-06-05
Description: Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mobatime mobile application AMXGT100 through 1.3.20.


CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-922
References: https://borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html; https://borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html
CVE: CVE-2023-3065
Published: 2023-06-05
Description: Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT100 through 1.3.20.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html; https://borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html
CVE: CVE-2023-3066
Published: 2023-06-05
Description: Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20.


CVSS Score: 8.1 (HIGH)
CWE: CWE-863, CWE-639
References: https://borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html; https://borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html
CVE: CVE-2023-27989
Published: 2023-06-05
Description: A buffer overflow vulnerability in the CGI program of the Zyxel NR7101 firmware versions prior to  V1.00(ABUV.8)C0 could allow a remote authenticated attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-4g-lte-and-5g-nr-outdoor-routers; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-4g-lte-and-5g-nr-outdoor-routers
CVE: CVE-2022-4946
Published: 2023-06-05
Description: The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow users with a role as low as contributor to add a malicious shortcode to a page/post, which will redirect users to an arbitrary domain.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://wpscan.com/vulnerability/6e222018-a3e0-4af0-846c-6f00b67dfbc0; https://wpscan.com/vulnerability/6e222018-a3e0-4af0-846c-6f00b67dfbc0
CVE: CVE-2023-0152
Published: 2023-06-05
Description: The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8281fce2-6f24-4d3f-895f-4d[PII_REDACTED]; https://wpscan.com/vulnerability/8281fce2-6f24-4d3f-895f-4d[PII_REDACTED]
CVE: CVE-2023-0545
Published: 2023-06-05
Description: The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/b604afc8-61d0-4e98-8950-f3d29f9e9ee1; https://wpscan.com/vulnerability/b604afc8-61d0-4e98-8950-f3d29f9e9ee1
CVE: CVE-2023-0900
Published: 2023-06-05
Description: The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/f601e637-a486-4f3a-9077-4f294ace7ea1; https://wpscan.com/vulnerability/f601e637-a486-4f3a-9077-4f294ace7ea1
CVE: CVE-2023-2224
Published: 2023-06-05
Description: The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173725/WordPress-Seo-By-10Web-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/a76b6d22-1e00-428a-8a04-12162bd0d992; http://packetstormsecurity.com/files/173725/WordPress-Seo-By-10Web-Cross-Site-Scripting.html
CVE: CVE-2023-2337
Published: 2023-06-05
Description: The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/e5a6f834-80a4-406b-acae-57ffeec2e689; https://wpscan.com/vulnerability/e5a6f834-80a4-406b-acae-57ffeec2e689
CVE: CVE-2023-2472
Published: 2023-06-05
Description: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when the WPML plugin is also active and configured, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/b0e7665a-c8c3-4132-b8d7-8677a90118df; https://wpscan.com/vulnerability/b0e7665a-c8c3-4132-b8d7-8677a90118df
CVE: CVE-2023-2488
Published: 2023-06-05
Description: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/60226669-0b7b-441f-93d4-b5933e69478f; https://wpscan.com/vulnerability/60226669-0b7b-441f-93d4-b5933e69478f
CVE: CVE-2023-2489
Published: 2023-06-05
Description: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/dcbe3334-357a-4744-b50c-309d10cca30d; https://wpscan.com/vulnerability/dcbe3334-357a-4744-b50c-309d10cca30d
CVE: CVE-2023-2503
Published: 2023-06-05
Description: The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/07b1caf1-d00b-4075-b71a-0516d5604286; https://wpscan.com/vulnerability/07b1caf1-d00b-4075-b71a-0516d5604286
CVE: CVE-2023-2571
Published: 2023-06-05
Description: The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/2dc02e5c-1c89-4053-a6a7-29ee7b996183; https://wpscan.com/vulnerability/2dc02e5c-1c89-4053-a6a7-29ee7b996183
CVE: CVE-2023-2572
Published: 2023-06-05
Description: The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/2f7fe6e6-c3d0-4e27-8222-572d7a420153; https://wpscan.com/vulnerability/2f7fe6e6-c3d0-4e27-8222-572d7a420153
CVE: CVE-2023-2634
Published: 2023-06-05
Description: The Get your number WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/1df111aa-6057-47a2-8e8b-9ef5ec3bb472; https://wpscan.com/vulnerability/1df111aa-6057-47a2-8e8b-9ef5ec3bb472
CVE: CVE-2023-32766
Published: 2023-06-05
Description: Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=default&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d; https://github.com/gitpod-io/gitpod/commit/6771283c3406586e352337675b79ff2ca50f191b; https://github.com/gitpod-io/gitpod/compare/release-2022.11.2...2022.11.3
CVE: CVE-2023-33386
Published: 2023-06-05
Description: MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/b1ackc4t/MarsCTF/blob/V1.2.1/src/main/java/com/b1ackc4t/marsctfserver/service/impl/CTFFileServiceImpl.java#L46; https://github.com/b1ackc4t/MarsCTF/issues/10; https://github.com/b1ackc4t/MarsCTF/blob/V1.2.1/src/main/java/com/b1ackc4t/marsctfserver/service/impl/CTFFileServiceImpl.java#L46
CVE: CVE-2023-33518
Published: 2023-06-05
Description: emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668, CWE-203
References: https://github.com/emoncms/emoncms/issues/1856; https://github.com/emoncms/emoncms/issues/1856
CVE: CVE-2015-10113
Published: 2023-06-05
Description: A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admin_screen_logic of the file wooframework-tweaks.php. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is 3b57d405149c1a59d1119da6e0bb8212732c9c88. It is recommended to upgrade the affected component. The identifier VDB-230653 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://github.com/wp-plugins/wooframework-tweaks/commit/3b57d405149c1a59d1119da6e0bb8212732c9c88; https://vuldb.com/?ctiid.230653; https://vuldb.com/?id.230653
CVE: CVE-2015-10114
Published: 2023-06-05
Description: A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue is the function enable_custom_post_sidebars of the file classes/class-woo-sidebars.php. The manipulation of the argument sendback leads to open redirect. The attack may be launched remotely. Upgrading to version 1.4.2 is able to address this issue. The patch is identified as 1ac6d6ac26e185673f95fc1ccc56a392169ba601. It is recommended to upgrade the affected component. VDB-230654 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/wp-plugins/woosidebars/commit/1ac6d6ac26e185673f95fc1ccc56a392169ba601; https://vuldb.com/?ctiid.230654; https://vuldb.com/?id.230654
CVE: CVE-2023-33690
Published: 2023-06-05
Description: SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/lane711/sonicjs/pull/183; https://youtu.be/6ZuwA9CkQLg; https://github.com/lane711/sonicjs/pull/183