deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-48831
Published: 2023-12-07
Description: A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: http://packetstormsecurity.com/files/176039; https://www.phpjabbers.com/availability-booking-calendar/#sectionDemo; http://packetstormsecurity.com/files/176039
CVE: CVE-2023-48833
Published: 2023-12-07
Description: A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://packetstormsecurity.com/files/176042; https://www.phpjabbers.com/time-slots-booking-calendar/; http://packetstormsecurity.com/files/176042
CVE: CVE-2023-48834
Published: 2023-12-07
Description: A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://packetstormsecurity.com/files/176043; https://www.phpjabbers.com/car-rental-script/; http://packetstormsecurity.com/files/176043
CVE: CVE-2023-48835
Published: 2023-12-07
Description: Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/176045; https://www.phpjabbers.com/car-rental-script/; http://packetstormsecurity.com/files/176045
CVE: CVE-2023-48836
Published: 2023-12-07
Description: Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/176046; https://www.phpjabbers.com/car-rental-script/; http://packetstormsecurity.com/files/176046
CVE: CVE-2023-48837
Published: 2023-12-07
Description: Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/176048; https://www.phpjabbers.com/car-rental-script/; http://packetstormsecurity.com/files/176048
CVE: CVE-2023-48838
Published: 2023-12-07
Description: Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/176054; https://www.phpjabbers.com/appointment-scheduler/; http://packetstormsecurity.com/files/176054
CVE: CVE-2023-48839
Published: 2023-12-07
Description: Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/176055; https://www.phpjabbers.com/appointment-scheduler/; http://packetstormsecurity.com/files/176055
CVE: CVE-2023-48840
Published: 2023-12-07
Description: A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://packetstormsecurity.com/files/176056; https://www.phpjabbers.com/appointment-scheduler/; http://packetstormsecurity.com/files/176056
CVE: CVE-2023-48841
Published: 2023-12-07
Description: Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/176058; https://www.phpjabbers.com/appointment-scheduler/; http://packetstormsecurity.com/files/176058
CVE: CVE-2023-49225
Published: 2023-12-07
Description: A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN45891816/; https://support.ruckuswireless.com/security_bulletins/323; https://jvn.jp/en/jp/JVN45891816/
CVE: CVE-2023-48860
Published: 2023-12-07
Description: TOTOLINK N300RT version 3.2.4-B20[PII_REDACTED] has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-N300RT-RCE.md; https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-N300RT-RCE.md
CVE: CVE-2023-48861
Published: 2023-12-07
Description: DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitrary code via urlmon.dll.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/xieqiang11/POC4/blob/main/README.md; https://github.com/xieqiang11/POC4/blob/main/README.md
CVE: CVE-2023-50164
Published: 2023-12-07
Description: An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-552
References: http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html; https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-45362
Published: 2023-12-07
Description: Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918, CWE-918
References: https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2023-41804
Published: 2023-12-07
Description: Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/astra-sites/wordpress-starter-templates-plugin-3-2-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/astra-sites/wordpress-starter-templates-plugin-3-2-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2023-46641
Published: 2023-12-07
Description: Server-Side Request Forgery (SSRF) vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.24.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/12-step-meeting-list/wordpress-12-step-meeting-list-plugin-3-14-24-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/12-step-meeting-list/wordpress-12-step-meeting-list-plugin-3-14-24-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2023-49746
Published: 2023-12-07
Description: Server-Side Request Forgery (SSRF) vulnerability in Softaculous Team SpeedyCache – Cache, Optimization, Performance.This issue affects SpeedyCache – Cache, Optimization, Performance: from n/a through 1.1.2.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://patchstack.com/database/vulnerability/speedycache/wordpress-speedycache-plugin-1-1-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/speedycache/wordpress-speedycache-plugin-1-1-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2023-35039
Published: 2023-12-07
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://patchstack.com/database/vulnerability/bdvs-password-reset/wordpress-password-reset-with-code-for-wordpress-rest-api-plugin-0-0-15-privilege-escalation-due-to-weak-pin-generation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bdvs-password-reset/wordpress-password-reset-with-code-for-wordpress-rest-api-plugin-0-0-15-privilege-escalation-due-to-weak-pin-generation-vulnerability?_s_id=cve
CVE: CVE-2023-35909
Published: 2023-12-07
Description: Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-6-25-denial-of-service-attack-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-6-25-denial-of-service-attack-vulnerability?_s_id=cve
CVE: CVE-2023-47779
Published: 2023-12-07
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/cf7-constant-contact/wordpress-integration-for-contact-form-7-and-constant-contact-plugin-1-1-4-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cf7-constant-contact/wordpress-integration-for-contact-form-7-and-constant-contact-plugin-1-1-4-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-48325
Published: 2023-12-07
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages.This issue affects Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: from n/a through 1.5.1.5.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/page-builder-add/wordpress-landing-page-builder-plugin-1-5-1-5-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/page-builder-add/wordpress-landing-page-builder-plugin-1-5-1-5-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-45762
Published: 2023-12-07
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Michael Uno (miunosoft) Responsive Column Widgets.This issue affects Responsive Column Widgets: from n/a through 1.2.7.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/responsive-column-widgets/wordpress-responsive-column-widgets-plugin-1-2-7-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/responsive-column-widgets/wordpress-responsive-column-widgets-plugin-1-2-7-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-47548
Published: 2023-12-07
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site.This issue affects Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site: from n/a through 1.3.2.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/integrate-google-drive/wordpress-integrate-google-drive-plugin-1-3-0-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/integrate-google-drive/wordpress-integrate-google-drive-plugin-1-3-0-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-49955
Published: 2023-12-07
Description: An issue was discovered in Dalmann OCPP.Core before 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It does not validate the length of the chargePointVendor field in a BootNotification message, potentially leading to server instability and a denial of service when processing excessively large inputs. NOTE: the vendor's perspective is "OCPP.Core is intended for use in a protected environment/network."
CVSS Score: 7.5 (HIGH)
References: https://github.com/dallmann-consulting/OCPP.Core/issues/32; https://github.com/dallmann-consulting/OCPP.Core/issues/32
CVE: CVE-2023-49956
Published: 2023-12-07
Description: An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. A StopTransaction message with any random transactionId terminates active transactions.
CVSS Score: 7.5 (HIGH)
References: https://github.com/dallmann-consulting/OCPP.Core/issues/34; https://github.com/dallmann-consulting/OCPP.Core/issues/34
CVE: CVE-2023-49957
Published: 2023-12-07
Description: An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It permits multiple transactions with the same connectorId and idTag, contrary to the expected ConcurrentTx status. This could result in critical transaction management and billing errors. NOTE: the vendor's perspective is "Imagine you've got two cars in your family and want to charge both in parallel on the same account/token? Why should that be rejected?"
CVSS Score: 7.5 (HIGH)
References: https://github.com/dallmann-consulting/OCPP.Core/issues/35; https://github.com/dallmann-consulting/OCPP.Core/issues/35
CVE: CVE-2023-49958
Published: 2023-12-07
Description: An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is accepted. This could be exploited to alter transaction records or impact system integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/dallmann-consulting/OCPP.Core/issues/36; https://github.com/dallmann-consulting/OCPP.Core/issues/36
CVE: CVE-2023-39167
Published: 2023-12-07
Description: In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://seclists.org/fulldisclosure/2023/Nov/5; http://seclists.org/fulldisclosure/2023/Nov/10; https://seclists.org/fulldisclosure/2023/Nov/5
CVE: CVE-2023-39168
Published: 2023-12-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it's a duplicate of CVE-2023-39167.
CVE: CVE-2023-39172
Published: 2023-12-07
Description: The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319, CWE-319
References: https://seclists.org/fulldisclosure/2023/Nov/4; http://seclists.org/fulldisclosure/2023/Nov/4; https://seclists.org/fulldisclosure/2023/Nov/4
CVE: CVE-2023-46974
Published: 2023-12-07
Description: Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the page parameter in the URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yte121/CVE-2023-46974/; https://youtu.be/5oVfJHT_-Ys; https://github.com/yte121/CVE-2023-46974/
CVE: CVE-2023-49424
Published: 2023-12-07
Description: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121, CWE-787
References: https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetVirtualServerCfg.md; https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetVirtualServerCfg.md
CVE: CVE-2023-39169
Published: 2023-12-07
Description: The affected devices use publicly available default credentials with administrative privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://seclists.org/fulldisclosure/2023/Nov/3; http://seclists.org/fulldisclosure/2023/Nov/10; https://seclists.org/fulldisclosure/2023/Nov/3
CVE: CVE-2023-39170
Published: 2023-12-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it's a duplicate of CVE-2023-39169.
CVE: CVE-2023-39171
Published: 2023-12-07
Description: SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.
CVSS Score: 7.2 (HIGH)
CWE: CWE-668
References: https://seclists.org/fulldisclosure/2023/Nov/2; http://seclists.org/fulldisclosure/2023/Nov/2; https://seclists.org/fulldisclosure/2023/Nov/2
CVE: CVE-2023-49425
Published: 2023-12-07
Description: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ef4tless/vuln/blob/master/iot/AX12/setMacFilterCfg.md; https://github.com/ef4tless/vuln/blob/master/iot/AX12/setMacFilterCfg.md
CVE: CVE-2023-49426
Published: 2023-12-07
Description: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetStaticRouteCfg.md; https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetStaticRouteCfg.md
CVE: CVE-2023-49428
Published: 2023-12-07
Description: Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetOnlineDevName.md; https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetOnlineDevName.md
CVE: CVE-2023-49437
Published: 2023-12-07
Description: Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetNetControlList-3.md; https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetNetControlList-3.md
CVE: CVE-2023-49429
Published: 2023-12-07
Description: Tenda AX9 V22.03.01.46 was discovered to contain a SQL command injection vulnerability in the 'setDeviceInfo' feature through the 'mac' parameter at /goform/setModules.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/ef4tless/vuln/blob/master/iot/AX9/setDeviceInfo.md; https://github.com/ef4tless/vuln/blob/master/iot/AX9/setDeviceInfo.md
CVE: CVE-2023-49430
Published: 2023-12-07
Description: Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetStaticRouteCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetStaticRouteCfg.md; https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetStaticRouteCfg.md
CVE: CVE-2023-49431
Published: 2023-12-07
Description: Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetOnlineDevName.md; https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetOnlineDevName.md
CVE: CVE-2023-49432
Published: 2023-12-07
Description: Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'deviceList' parameter at /goform/setMacFilterCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ef4tless/vuln/blob/master/iot/AX9/setMacFilterCfg.md; https://github.com/ef4tless/vuln/blob/master/iot/AX9/setMacFilterCfg.md
CVE: CVE-2023-49433
Published: 2023-12-07
Description: Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetVirtualServerCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetVirtualServerCfg.md; https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetVirtualServerCfg.md
CVE: CVE-2023-49434
Published: 2023-12-07
Description: Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetNetControlList.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetNetControlList.md; https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetNetControlList.md
CVE: CVE-2023-49435
Published: 2023-12-07
Description: Tenda AX9 V22.03.01.46 is vulnerable to command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetNetControlList-3.md; https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetNetControlList-3.md
CVE: CVE-2023-49436
Published: 2023-12-07
Description: Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetNetControlList-2.md; https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetNetControlList-2.md
CVE: CVE-2023-49492
Published: 2023-12-07
Description: DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Hebing123/cve/issues/2; https://github.com/Hebing123/cve/issues/2
CVE: CVE-2023-49493
Published: 2023-12-07
Description: DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Hebing123/cve/issues/2; https://github.com/Hebing123/cve/issues/2
CVE: CVE-2023-49967
Published: 2023-12-07
Description: Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-776
References: https://github.com/typecho/typecho/issues/1648; https://github.com/typecho/typecho/issues/1648
CVE: CVE-2023-6588
Published: 2023-12-07
Description: 


Offline mode is always enabled, even if permission disallows it, in 
Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and 
earlier. This allows an attacker with access to the Workspace 
application to access credentials when offline.





CVSS Score: 6.5 (MEDIUM)
References: https://devolutions.net/security/advisories/DEVO-2023-0022/; https://devolutions.net/security/advisories/DEVO-2023-0022/
CVE: CVE-2023-49402
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function localMsg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_localMsg/w30e_localMsg.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_localMsg/w30e_localMsg.md