deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-45688
Published: 2023-10-16
Description: Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690; https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/; https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
CVE: CVE-2023-45689
Published: 2023-10-16
Description: Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with administrative privileges to read any file on the filesystem via path traversal
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690; https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/; https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
CVE: CVE-2023-45690
Published: 2023-10-16
Description: Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690; https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/; https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
CVE: CVE-2023-45984
Published: 2023-10-16
Description: TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/setLanguageCfg.md; https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/setLanguageCfg.md
CVE: CVE-2023-45985
Published: 2023-10-16
Description: TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/setParentalRules.md; https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/setParentalRules.md
CVE: CVE-2023-40180
Published: 2023-10-16
Description:  silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. This issue has been addressed in versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://docs.silverstripe.org/en/developer_guides/graphql/security_and_best_practices/recursive_or_complex_queries; https://github.com/silverstripe/silverstripe-graphql/commit/f6d5976ec4608e51184b0db1ee5b9e9a99d2501c; https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-v23w-pppm-jh66
CVE: CVE-2023-43120
Published: 2023-10-16
Description: An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows attackers to gain escalated privileges via crafted HTTP request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114377; https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114377
CVE: CVE-2023-45148
Published: 2023-10-16
Description: Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgrade should change their config setting `memcache.distributed` to `\OC\Memcache\Redis` and install Redis instead of Memcached.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xmhp-7vr4-hp63; https://github.com/nextcloud/server/pull/40293; https://hackerone.com/reports/2110945
CVE: CVE-2023-45151
Published: 2023-10-16
Description: Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hhgv-jcg9-p4m9; https://github.com/nextcloud/server/pull/38398; https://hackerone.com/reports/1994324
CVE: CVE-2023-45660
Published: 2023-10-16
Description: Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/nextcloud/mail/pull/8459; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8j9x-fmww-qr37; https://hackerone.com/reports/1895874
CVE: CVE-2023-45669
Published: 2023-10-16
Description: WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version `0.9.1.RELEASE`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287
References: https://github.com/webauthn4j/webauthn4j-spring-security/commit/129700d74d83f9b9a82bf88ebc63707e3cb0a725; https://github.com/webauthn4j/webauthn4j-spring-security/security/advisories/GHSA-v9hx-v6vf-g36j; https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-sign-counter
CVE: CVE-2023-45683
Published: 2023-10-16
Description: github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/crewjam/saml/commit/b07b16cf83c4171d16da4d85608cb827f183cd79; https://github.com/crewjam/saml/security/advisories/GHSA-267v-3v32-g6q5; https://github.com/crewjam/saml/commit/b07b16cf83c4171d16da4d85608cb827f183cd79
CVE: CVE-2023-29484
Published: 2023-10-16
Description: In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://docs.terminalfour.com/articles/security-notices/cve-2023-29484/; https://docs.terminalfour.com/release-notes/83/16.html; https://docs.terminalfour.com/articles/security-notices/cve-2023-29484/
CVE: CVE-2023-3154
Published: 2023-10-16
Description: The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/ed099489-1db4-4b42-9f72-77de39c9e01e; https://wpscan.com/vulnerability/ed099489-1db4-4b42-9f72-77de39c9e01e
CVE: CVE-2023-3155
Published: 2023-10-16
Description: The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-552
References: https://wpscan.com/vulnerability/5c8473f4-4b52-430b-9140-b81b0a0901da; https://wpscan.com/vulnerability/5c8473f4-4b52-430b-9140-b81b0a0901da
CVE: CVE-2023-3279
Published: 2023-10-16
Description: The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks
CVSS Score: 4.9 (MEDIUM)
References: https://wpscan.com/vulnerability/3b7a7070-8d61-4ff8-b003-b4ff06221635; https://wpscan.com/vulnerability/3b7a7070-8d61-4ff8-b003-b4ff06221635
CVE: CVE-2023-3706
Published: 2023-10-16
Description: The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/daa4d93a-f8b1-4809-a18e-8ab63a05de5a; https://wpscan.com/vulnerability/daa4d93a-f8b1-4809-a18e-8ab63a05de5a
CVE: CVE-2023-3707
Published: 2023-10-16
Description: The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/541bbe4c-3295-4073-901d-763556269f48; https://wpscan.com/vulnerability/541bbe4c-3295-4073-901d-763556269f48
CVE: CVE-2023-3746
Published: 2023-10-16
Description: The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/c15a6032-6495-47a8-828c-37e55ed9665a; https://wpscan.com/vulnerability/c15a6032-6495-47a8-828c-37e55ed9665a
CVE: CVE-2023-43118
Published: 2023-10-16
Description: Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114379; https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114379
CVE: CVE-2023-43119
Published: 2023-10-16
Description: An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-284
References: https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114378; https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114378
CVE: CVE-2023-43121
Published: 2023-10-16
Description: A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7, and before 31.7.2 allows attackers to read arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114376; https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114376
CVE: CVE-2023-45149
Published: 2023-10-16
Description: Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the Nextcloud Talk app is upgraded to 15.0.8, 16.0.6 or 17.1.1. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7rf8-pqmj-rpqv; https://github.com/nextcloud/spreed/pull/10545; https://hackerone.com/reports/2094473
CVE: CVE-2023-45150
Published: 2023-10-16
Description: Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended that the Nextcloud Calendar app is upgraded to 4.4.4. The only workaround for users unable to upgrade is to disable the calendar app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-354
References: https://github.com/nextcloud/calendar/pull/5358; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452; https://hackerone.com/reports/2058337
CVE: CVE-2023-4289
Published: 2023-10-16
Description: The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/38c337c6-048f-4009-aef8-29c18afa6fdc; https://wpscan.com/vulnerability/38c337c6-048f-4009-aef8-29c18afa6fdc
CVE: CVE-2023-4290
Published: 2023-10-16
Description: The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/5fad5245-a089-4ba3-9958-1e2c3d066eea; https://wpscan.com/vulnerability/5fad5245-a089-4ba3-9958-1e2c3d066eea
CVE: CVE-2023-4388
Published: 2023-10-16
Description: The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/4086b62c-c527-4721-af63-7f2687c98648; https://wpscan.com/vulnerability/4086b62c-c527-4721-af63-7f2687c98648
CVE: CVE-2023-4643
Published: 2023-10-16
Description: The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/d9[PII_REDACTED]-435c-a67c-07951a1fc5b1; https://wpscan.com/vulnerability/d9[PII_REDACTED]-435c-a67c-07951a1fc5b1
CVE: CVE-2023-4646
Published: 2023-10-16
Description: The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/c34f8dcc-3be6-44ad-91a4-7c3a0ce2f9d7; https://wpscan.com/vulnerability/c34f8dcc-3be6-44ad-91a4-7c3a0ce2f9d7
CVE: CVE-2023-4666
Published: 2023-10-16
Description: The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be; https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be
CVE: CVE-2023-4687
Published: 2023-10-16
Description: The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/31596fc5-4203-40c4-9b0a-e8a37faafddd; https://wpscan.com/vulnerability/31596fc5-4203-40c4-9b0a-e8a37faafddd
CVE: CVE-2023-4691
Published: 2023-10-16
Description: The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/5085ec75-0795-4004-955d-e71b3d2c26c6; https://wpscan.com/vulnerability/5085ec75-0795-4004-955d-e71b3d2c26c6
CVE: CVE-2023-4725
Published: 2023-10-16
Description: The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/e9b9a594-c960-4692-823e-23fc60cca7e7; https://wpscan.com/vulnerability/e9b9a594-c960-4692-823e-23fc60cca7e7
CVE: CVE-2023-4776
Published: 2023-10-16
Description: The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/59dd3917-01cb-479f-a557-021b2a5147df; https://wpscan.com/vulnerability/59dd3917-01cb-479f-a557-021b2a5147df
CVE: CVE-2023-4783
Published: 2023-10-16
Description: The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/02928db8-ceb3-471a-b626-ca661d073e4f; https://wpscan.com/vulnerability/02928db8-ceb3-471a-b626-ca661d073e4f
CVE: CVE-2023-4795
Published: 2023-10-16
Description: The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/b8390b4a-b43f-4bf6-a61b-dfcbc7b2e7a0; https://wpscan.com/vulnerability/b8390b4a-b43f-4bf6-a61b-dfcbc7b2e7a0
CVE: CVE-2023-4798
Published: 2023-10-16
Description: The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/273a95bf-39fe-4ba7-bc14-9527acfd9f42; https://wpscan.com/vulnerability/273a95bf-39fe-4ba7-bc14-9527acfd9f42
CVE: CVE-2023-4800
Published: 2023-10-16
Description: The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/7eae1434-8c7a-4291-912d-a4a07b73ee56; https://wpscan.com/vulnerability/7eae1434-8c7a-4291-912d-a4a07b73ee56; https://wpscan.com/vulnerability/7eae1434-8c7a-4291-912d-a4a07b73ee56
CVE: CVE-2023-4805
Published: 2023-10-16
Description: The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/1049e940-49b1-4236-bea2-c636f35c5647; https://wpscan.com/vulnerability/1049e940-49b1-4236-bea2-c636f35c5647
CVE: CVE-2023-4811
Published: 2023-10-16
Description: The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/7f9271f2-4de4-4be3-8746-2a3f149eb1d1; https://wpscan.com/vulnerability/7f9271f2-4de4-4be3-8746-2a3f149eb1d1
CVE: CVE-2023-4819
Published: 2023-10-16
Description: The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a; https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a
CVE: CVE-2023-4820
Published: 2023-10-16
Description: The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432; https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432
CVE: CVE-2023-4821
Published: 2023-10-16
Description: The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensions. Therefore, an attacker can upload unsafe .shtml or .svg files containing malicious scripts.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/3ac0853b-03f7-44b9-aa9b-72df3e01a9b5; https://wpscan.com/vulnerability/3ac0853b-03f7-44b9-aa9b-72df3e01a9b5