deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4909
Published: 2023-07-29
Description: Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially perform an ASLR bypass via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html; https://crbug.com/1356211; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE: CVE-2022-4910
Published: 2023-07-29
Description: Inappropriate implementation in Autofill in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 5.4 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html; https://crbug.com/1279268; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE: CVE-2022-4911
Published: 2023-07-29
Description: Insufficient data validation in DevTools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html; https://crbug.com/1349493; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4912
Published: 2023-07-29
Description: Type Confusion in MathML in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1350909; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4913
Published: 2023-07-29
Description: Inappropriate implementation in Extensions in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to spoof extension storage via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1183604; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4914
Published: 2023-07-29
Description: Heap buffer overflow in PrintPreview in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1232402; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4915
Published: 2023-07-29
Description: Inappropriate implementation in URL Formatting in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html; https://crbug.com/1329541; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4916
Published: 2023-07-29
Description: Use after free in Media in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html; https://crbug.com/1317714; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4917
Published: 2023-07-29
Description: Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full screen notification via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html; https://crbug.com/1311683; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4918
Published: 2023-07-29
Description: Use after free in UI in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1315102; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4919
Published: 2023-07-29
Description: Use after free in Base Internals in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1312450; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4920
Published: 2023-07-29
Description: Heap buffer overflow in Blink in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1306861; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4921
Published: 2023-07-29
Description: Use after free in Accessibility in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html; https://crbug.com/1262902; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4922
Published: 2023-07-29
Description: Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html; https://crbug.com/1261191; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4923
Published: 2023-07-29
Description: Inappropriate implementation in Omnibox in Google Chrome prior to 99.0.4844.51 allowed an attacker in a privileged network position to perform a man-in-the-middle attack via malicious network traffic. (Chromium security severity: Low)
CVSS Score: 3.1 (LOW)
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html; https://crbug.com/1251065; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4924
Published: 2023-07-29
Description: Use after free in WebRTC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html; https://crbug.com/1272967; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4925
Published: 2023-07-29
Description: Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splitting via malicious network traffic. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html; https://crbug.com/1238309; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4926
Published: 2023-07-29
Description: Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html; https://crbug.com/1368230; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-2311
Published: 2023-07-29
Description: Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1354505; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE: CVE-2023-2313
Published: 2023-07-29
Description: Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a malicious file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1335974; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE: CVE-2023-2314
Published: 2023-07-29
Description: Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/813542; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE: CVE-2023-36542
Published: 2023-07-29
Description: Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2023/Jul/43; http://www.openwall.com/lists/oss-security/2023/07/29/1; https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof
CVE: CVE-2023-32225
Published: 2023-07-30
Description:  Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - 

A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-32226
Published: 2023-07-30
Description:  Sysaid -  CWE-552: Files or Directories Accessible to External Parties - 

Authenticated users may exfiltrate files from the server via an unspecified method.


CVSS Score: 8.3 (HIGH)
CWE: CWE-552, CWE-552
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-32227
Published: 2023-07-30
Description:  Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-37213
Published: 2023-07-30
Description:  Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection'
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-37214
Published: 2023-07-30
Description: 
Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-37215
Published: 2023-07-30
Description:  JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-37216
Published: 2023-07-30
Description:   

 AnaSystem SensMini M4 – Using the configuration tool, an authenticated user can cause Denial of Service for the device


CVSS Score: 7.5 (HIGH)
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-37217
Published: 2023-07-30
Description:  Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-37218
Published: 2023-07-30
Description:  Tadiran Telecom Aeonix - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-37219
Published: 2023-07-30
Description:  Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File
CVSS Score: 7.3 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-43831
Published: 2023-07-31
Description: IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.6.1 could allow a local user to obtain escalated privileges on a host without proper security context settings configured.  IBM X-Force ID:  238941.
CVSS Score: 7.4 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238941; https://www.ibm.com/support/pages/node/7015067; https://exchange.xforce.ibmcloud.com/vulnerabilities/238941
CVE: CVE-2023-35016
Published: 2023-07-31
Description: IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  257772.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/25772; https://www.ibm.com/support/pages/node/7014397; https://exchange.xforce.ibmcloud.com/vulnerabilities/25772
CVE: CVE-2023-35019
Published: 2023-07-31
Description: IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  IBM X-Force ID:  257873.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257873; https://www.ibm.com/support/pages/node/7014397; https://exchange.xforce.ibmcloud.com/vulnerabilities/257873
CVE: CVE-2023-4005
Published: 2023-07-31
Description: Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://github.com/fossbilling/fossbilling/commit/20c23b051eb690cb4ae60a257f6bb46eb3aae2d1; https://huntr.dev/bounties/f0aacce1-79bc-4765-95f1-7e824433b9e4; https://github.com/fossbilling/fossbilling/commit/20c23b051eb690cb4ae60a257f6bb46eb3aae2d1
CVE: CVE-2023-4006
Published: 2023-07-31
Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://github.com/thorsten/phpmyfaq/commit/03946eca488724251eaed8d9d36fed92e6d8fd22; https://huntr.dev/bounties/36149a42-cbd5-445e-a371-e351c899b189; https://github.com/thorsten/phpmyfaq/commit/03946eca488724251eaed8d9d36fed92e6d8fd22
CVE: CVE-2023-4007
Published: 2023-07-31
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/40eb[PII_REDACTED]908e83c2bef4c228751fd43a0e; https://huntr.dev/bounties/e891dcbc-2092-49d3-9518-23e37187a5ea; https://github.com/thorsten/phpmyfaq/commit/40eb[PII_REDACTED]908e83c2bef4c228751fd43a0e
CVE: CVE-2020-4868
Published: 2023-07-31
Description: IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  190744.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190744; https://www.ibm.com/support/pages/node/7015393; https://exchange.xforce.ibmcloud.com/vulnerabilities/190744
CVE: CVE-2023-22595
Published: 2023-07-31
Description: IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  244076.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.ibm.com/support/pages/node/7014929; https://www.ibm.com/support/pages/node/7014929; https://www.ibm.com/support/pages/node/7014929
CVE: CVE-2023-24971
Published: 2023-07-31
Description: 
IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 could allow a user to cause a denial of service due to the deserializing of untrusted serialized Java objects. IBM X-Force ID: 246976.


CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/246976; https://www.ibm.com/support/pages/node/7014933; https://exchange.xforce.ibmcloud.com/vulnerabilities/246976
CVE: CVE-2023-34358
Published: 2023-07-31
Description: ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to a device which contains a specific user agent, causing the httpd binary to crash during a string comparison performed within web.c, resulting in a DoS condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.twcert.org.tw/tw/cp-132-7279-05760-1.html; https://www.twcert.org.tw/tw/cp-132-7279-05760-1.html
CVE: CVE-2023-34359
Published: 2023-07-31
Description: ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to the device which causes the httpd binary to crash within the "do_json_decode()" function of ej.c, resulting in a DoS condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.twcert.org.tw/tw/cp-132-7280-bea85-1.html; https://www.twcert.org.tw/tw/cp-132-7280-bea85-1.html
CVE: CVE-2023-34360
Published: 2023-07-31
Description: A stored cross-site scripting (XSS) issue was discovered within the Custom User Icons functionality of ASUS RT-AX88U running firmware versions 3.0.0.4.388.23110 and prior.  After a remote attacker logging in device with regular user privilege, the remote attacker can perform a Stored Cross-site Scripting (XSS) attack by uploading image which containing JavaScript code.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://https://www.twcert.org.tw/tw/cp-132-7281-dc87d-1.html; https://https://www.twcert.org.tw/tw/cp-132-7281-dc87d-1.html
CVE: CVE-2022-4888
Published: 2023-07-31
Description: The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2, Advanced Free Gifts WordPress plugin before 1.0.2, Gift Registry for WooCommerce WordPress plugin through 1.0.1, Image Watermark for WooCommerce WordPress plugin before 1.0.1, Order Approval for WooCommerce WordPress plugin before 1.1.0, Order Tracking for WooCommerce WordPress plugin before 1.0.2, Price Calculator for WooCommerce WordPress plugin through 1.0.3, Product Dynamic Pricing and Discounts WordPress plugin through 1.0.6, Product Labels and Stickers WordPress plugin through 1.0.1 have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/2c2379d0-e373-4587-a747-429d7ee8f6cc; https://wpscan.com/vulnerability/2c2379d0-e373-4587-a747-429d7ee8f6cc
CVE: CVE-2023-0602
Published: 2023-07-31
Description: The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/c357f93d-4f21-4cd9-9378-d97756c75255; https://wpscan.com/vulnerability/c357f93d-4f21-4cd9-9378-d97756c75255
CVE: CVE-2023-3130
Published: 2023-07-31
Description: The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/6e167864-c304-402e-8b2d-d47b5a3767d1; https://wpscan.com/vulnerability/6e167864-c304-402e-8b2d-d47b5a3767d1