deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3051
Published: 2023-06-03
Description: The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azh_post' shortcode in versions up to, and including, 1.27.133 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L2845; https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L2856; https://www.wordfence.com/threat-intel/vulnerabilities/id/24[PII_REDACTED]-4f19-9ca3-340d006432db?source=cve
CVE: CVE-2023-3052
Published: 2023-06-03
Description: The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_add_post', 'azh_duplicate_post', 'azh_update_post' and 'azh_remove_post' functions. This makes it possible for unauthenticated attackers to create, modify, and delete a post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4085; https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4137; https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4159
CVE: CVE-2023-3053
Published: 2023-06-03
Description: The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and post status.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4085; https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4137; https://www.wordfence.com/threat-intel/vulnerabilities/id/dd56cb73-1c40-44b1-b713-c0291832d988?source=cve
CVE: CVE-2023-3055
Published: 2023-06-03
Description: The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_save' function. This makes it possible for unauthenticated attackers to update the post content and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L2721; https://www.wordfence.com/threat-intel/vulnerabilities/id/2efeffa2-b21a-4aa1-93b0-51c775758ab1?source=cve; https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L2721
CVE: CVE-2023-33143
Published: 2023-06-03
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33143; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33143; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-0583
Published: 2023-06-03
Description: The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://plugins.trac.wordpress.org/browser/vk-blocks/trunk/inc/vk-blocks/App/RestAPI/BlockMeta/class-vk-blocks-entrypoint.php; https://plugins.trac.wordpress.org/changeset/2921566/vk-blocks/tags/1.57.1.0/inc/vk-blocks/App/RestAPI/BlockMeta/class-vk-blocks-entrypoint.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/12a94f5b-bc30-4a65-b397-54488c836ec3?source=cve
CVE: CVE-2023-0584
Published: 2023-06-03
Description: The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_font_awesome_version' option to an arbitrary value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://plugins.trac.wordpress.org/browser/vk-blocks/trunk/inc/vk-blocks/font-awesome/class-vk-blocks-font-awesome-api.php; https://plugins.trac.wordpress.org/changeset/2927751; https://www.wordfence.com/threat-intel/vulnerabilities/id/b90b7f6c-df7f-48a5-b283-cf5facbd71e5?source=cve
CVE: CVE-2023-2298
Published: 2023-06-03
Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in versions up to, and including, 4.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/changeset/2930545/meeting-scheduler-by-vcita/trunk/vcita-api-functions.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2930545%40meeting-scheduler-by-vcita&new=2930545%40meeting-scheduler-by-vcita&sfp_email=&sfph_mail=
CVE: CVE-2023-2299
Published: 2023-06-03
Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.2 due to a missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the plugin's settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-api-functions.php; https://plugins.trac.wordpress.org/changeset/3104980/meeting-scheduler-by-vcita/trunk/vcita-api-functions.php
CVE: CVE-2023-2300
Published: 2023-06-03
Description: The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/contact-form-with-a-meeting-scheduler-by-vcita/trunk/system/parse_vcita_callback.php#L55; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2932978%40contact-form-with-a-meeting-scheduler-by-vcita%2Ftrunk&old=2746467%40contact-form-with-a-meeting-scheduler-by-vcita%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-2301
Published: 2023-06-03
Description: The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. This is due to missing nonce validation on the ls_parse_vcita_callback function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. While the Cross-Site Scripting issue was patched in version 4.10.1, the plugin is still technically vulnerable to Cross-Site Request Forgery since a capability check but no nonce check was added in 4.10.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/contact-form-with-a-meeting-scheduler-by-vcita/trunk/system/parse_vcita_callback.php#L55; https://plugins.trac.wordpress.org/changeset/3200766/contact-form-with-a-meeting-scheduler-by-vcita/trunk/system/parse_vcita_callback.php
CVE: CVE-2023-2302
Published: 2023-06-03
Description: The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-callback.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2933281%40lead-capturing-call-to-actions-by-vcita%2Ftrunk&old=2748059%40lead-capturing-call-to-actions-by-vcita%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-2303
Published: 2023-06-03
Description: The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.5. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-callback.php; https://plugins.trac.wordpress.org/changeset/3257683/lead-capturing-call-to-actions-by-vcita/trunk/vcita-callback.php
CVE: CVE-2023-2404
Published: 2023-06-03
Description: The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/crm-customer-relationship-management-by-vcita/trunk/vcita-callback.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2924386%40crm-customer-relationship-management-by-vcita&new=2924386%40crm-customer-relationship-management-by-vcita&sfp_email=&sfph_mail=
CVE: CVE-2023-2405
Published: 2023-06-03
Description: The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/crm-customer-relationship-management-by-vcita/trunk/vcita-callback.php; https://plugins.trac.wordpress.org/changeset/3256449/crm-customer-relationship-management-by-vcita/trunk/vcita-callback.php
CVE: CVE-2023-2406
Published: 2023-06-03
Description: The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/event-registration-calendar-by-vcita/trunk/system/parse_vcita_callback.php#L55; https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/trunk/system/parse_vcita_callback.php
CVE: CVE-2023-2407
Published: 2023-06-03
Description: The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing nonce validation in the ls_parse_vcita_callback() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/event-registration-calendar-by-vcita/trunk/system/parse_vcita_callback.php#L55; https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/trunk/system/parse_vcita_callback.php
CVE: CVE-2023-2415
Published: 2023-06-03
Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to logout a vctia connected account which would cause a denial of service on the appointment scheduler.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php#L55; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2924763%40meeting-scheduler-by-vcita&new=2924763%40meeting-scheduler-by-vcita&sfp_email=&sfph_mail=
CVE: CVE-2023-2416
Published: 2023-06-03
Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the vcita_logout_callback function in versions up to, and including, 4.5. This makes it possible for unauthenticated to logout a vctia connected account which would cause a denial of service on the appointment scheduler, via a forged request granted they can trick a site user into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita; https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php#L55; https://plugins.trac.wordpress.org/changeset/3200129/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php?old=3191356&old_path=meeting-scheduler-by-vcita%2Ftrunk%2Fvcita-ajax-function.php
CVE: CVE-2023-3083
Published: 2023-06-03
Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://github.com/nilsteampassnet/teampass/commit/79731553fa305d45dabb7a227f3074d56d7c94c1; https://huntr.dev/bounties/c6b29e46-02e0-43ad-920f-28ac482ea2ab; https://github.com/nilsteampassnet/teampass/commit/79731553fa305d45dabb7a227f3074d56d7c94c1
CVE: CVE-2023-3084
Published: 2023-06-03
Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/nilsteampassnet/teampass/commit/61b9b7d4e33bbaad2cd61a7ee988f9c22298bf1a; https://huntr.dev/bounties/4b86b56b-c51b-4be8-8ee4-6e385d1e9e8a; https://github.com/nilsteampassnet/teampass/commit/61b9b7d4e33bbaad2cd61a7ee988f9c22298bf1a
CVE: CVE-2023-3085
Published: 2023-06-03
Description: A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b[PII_REDACTED]04. This issue affects the function run_action of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument request_path leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 22.10_b[PII_REDACTED]13 is able to address this issue. The patch is named 24d7da2416b9ab246825c33c213fe939a89b369c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230663.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/x-wrt/luci/commit/24d7da2416b9ab246825c33c213fe939a89b369c; https://github.com/x-wrt/luci/releases/tag/22.10_b[PII_REDACTED]13; https://vuldb.com/?ctiid.230663
CVE: CVE-2023-32582
Published: 2023-06-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kyle Maurer Don8 plugin <= 0.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/don8/wordpress-don8-plugin-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/don8/wordpress-don8-plugin-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-3086
Published: 2023-06-03
Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/nilsteampassnet/teampass/commit/1c0825b67eb8f8b5ecc418ff7614423a275e6a79; https://huntr.dev/bounties/17be9e8a-abe8-41db-987f-1d5b0686ae20; https://github.com/nilsteampassnet/teampass/commit/1c0825b67eb8f8b5ecc418ff7614423a275e6a79
CVE: CVE-2023-3091
Published: 2023-06-04
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Captura up to 8.0.0. It has been declared as critical. This vulnerability affects unknown code in the library CRYPTBASE.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitation appears to be difficult. The identifier of this vulnerability is VDB-230668. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://vuldb.com/?ctiid.230668; https://vuldb.com/?id.230668; https://vuldb.com/?ctiid.230668
CVE: CVE-2023-3094
Published: 2023-06-04
Description: A vulnerability classified as critical has been found in code-projects Agro-School Management System 1.0. Affected is the function doUpdateQuestion of the file btn_functions.php. The manipulation of the argument question_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230670 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/hotencode/CveHub/blob/main/Agro-School%20Management%20System%20btn_functions.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.230670; https://vuldb.com/?id.230670
CVE: CVE-2023-3095
Published: 2023-06-04
Description: Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/nilsteampassnet/teampass/commit/774985f62f[PII_REDACTED]04927fba2cb6ef701612; https://huntr.dev/bounties/35c899a9-40a0-4e17-bfb5-2a1430bc83c4; https://github.com/nilsteampassnet/teampass/commit/774985f62f[PII_REDACTED]04927fba2cb6ef701612
CVE: CVE-2015-10111
Published: 2023-06-04
Description: A vulnerability was found in Watu Quiz Plugin up to 2.6.7 on WordPress. It has been rated as critical. This issue affects the function watu_exams of the file controllers/exam.php of the component Exam Handler. The manipulation of the argument quiz leads to sql injection. The attack may be initiated remotely. Upgrading to version 2.6.8 is able to address this issue. The patch is named bf42e7cfd819a3e76cf3e1465697e89f4830590c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230651.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/wp-plugins/watu/commit/bf42e7cfd819a3e76cf3e1465697e89f4830590c; https://vuldb.com/?ctiid.230651; https://vuldb.com/?id.230651
CVE: CVE-2013-10027
Published: 2023-06-04
Description: A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060ec9c2e7f7ca70. It is recommended to upgrade the affected component. VDB-230658 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/wp-plugins/blogger-importer/commit/b83fa4f862b0f19a54cfee76060ec9c2e7f7ca70; https://vuldb.com/?ctiid.230658; https://vuldb.com/?id.230658
CVE: CVE-2013-10028
Published: 2023-06-04
Description: A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the function style_newsletter of the file lettreinfo.php. The manipulation of the argument email leads to cross site scripting. The attack may be launched remotely. The name of the patch is 3339b42316c5edf73e56eb209b6a3bb3e868d6ed. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230660.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/eelv-newsletter/commit/3339b42316c5edf73e56eb209b6a3bb3e868d6ed; https://vuldb.com/?ctiid.230660; https://vuldb.com/?id.230660
CVE: CVE-2023-22862
Published: 2023-06-05
Description: IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-523, CWE-522
References: https://www.ibm.com/support/pages/node/7001053; https://exchange.xforce.ibmcloud.com/vulnerabilities/244107; https://www.ibm.com/support/pages/node/7001053
CVE: CVE-2023-27285
Published: 2023-06-05
Description: IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system.  IBM X-Force ID:  248625.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-119
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248625; https://www.ibm.com/support/pages/node/7001053; https://exchange.xforce.ibmcloud.com/vulnerabilities/248625