deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-0450
Published: 2023-04-05
Description: An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users.
CVSS Score: 3.7 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0450.json; https://gitlab.com/gitlab-org/gitlab/-/issues/388962; https://hackerone.com/reports/1831547
CVE: CVE-2023-0838
Published: 2023-04-05
Description: An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0838.json; https://gitlab.com/gitlab-org/gitlab/-/issues/391685; https://hackerone.com/reports/1871136
CVE: CVE-2023-1071
Published: 2023-04-05
Description: An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue from an epic.
CVSS Score: 3.1 (LOW)
CWE: CWE-863, CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1071.json; https://gitlab.com/gitlab-org/gitlab/-/issues/385434; https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1071.json
CVE: CVE-2023-1167
Published: 2023-04-05
Description: Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-285
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1167.json; https://gitlab.com/gitlab-org/gitlab/-/issues/392715; https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1167.json
CVE: CVE-2023-1417
Published: 2023-04-05
Description: An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-639
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1417.json; https://gitlab.com/gitlab-org/gitlab/-/issues/396720; https://hackerone.com/reports/1892200
CVE: CVE-2023-1708
Published: 2023-04-05
Description: An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-77, CWE-94
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1708.json; https://gitlab.com/gitlab-org/gitlab/-/issues/387185; https://hackerone.com/reports/1805604
CVE: CVE-2023-1710
Published: 2023-04-05
Description: A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1710.json; https://gitlab.com/gitlab-org/gitlab/-/issues/388242; https://hackerone.com/reports/1829768
CVE: CVE-2023-1787
Published: 2023-04-05
Description: An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1787.json; https://gitlab.com/gitlab-org/gitlab/-/issues/394817; https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1787.json
CVE: CVE-2022-31888
Published: 2023-04-05
Description: Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384, CWE-384
References: https://checkmarx.com/blog/securing-open-source-solutions-a-study-of-osticket-vulnerabilities/; https://github.com/osTicket/osTicket/commit/85a76f403a3a116176d0798f39a4c430181d8364; https://github.com/osTicket/osTicket/releases/tag/v1.16.3
CVE: CVE-2022-31889
Published: 2023-04-05
Description: Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a[PII_REDACTED]ae.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://checkmarx.com/blog/securing-open-source-solutions-a-study-of-osticket-vulnerabilities/; https://github.com/osTicket/osTicket-plugins/commit/047a1c3ae4f12f8952bbdad8143d5b74fdac14b1; https://checkmarx.com/blog/securing-open-source-solutions-a-study-of-osticket-vulnerabilities/
CVE: CVE-2022-31890
Published: 2023-04-05
Description: SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a[PII_REDACTED]ae via the order parameter to the getOrder function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://checkmarx.com/blog/securing-open-source-solutions-a-study-of-osticket-vulnerabilities/; https://github.com/osTicket/osTicket-plugins/commit/0b59afbd2d4ccd[PII_REDACTED]a9aaf1ec05b5071e; https://checkmarx.com/blog/securing-open-source-solutions-a-study-of-osticket-vulnerabilities/
CVE: CVE-2023-23815
Published: 2023-04-06
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Jackson Multi-column Tag Map plugin <= 17.0.24 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/multi-column-tag-map/wordpress-multi-column-tag-map-plugin-17-0-24-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/multi-column-tag-map/wordpress-multi-column-tag-map-plugin-17-0-24-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23981
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud Conversational Forms for ChatBot plugin <= 1.1.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/conversational-forms/wordpress-conversational-forms-for-chatbot-plugin-1-1-6-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/conversational-forms/wordpress-conversational-forms-for-chatbot-plugin-1-1-6-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23982
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGear.Pro WPFrom Email plugin <= 1.8.8 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpfrom-email/wordpress-wpfrom-email-plugin-1-8-8-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wpfrom-email/wordpress-wpfrom-email-plugin-1-8-8-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-29415
Published: 2023-04-06
Description: An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A denial of service (process hang) can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/kspalaiologos/bzip3/compare/1.2.3...1.3.0; https://github.com/kspalaiologos/bzip3/issues/95; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JLSE25SV7K2NB6FTFT4UHJOJUHBHYHY/
CVE: CVE-2023-29416
Published: 2023-04-06
Description: An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A bz3_decode_block out-of-bounds write can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/kspalaiologos/bzip3/commit/bfa5bf82b53715dfedf048e5859a46cf248668ff; https://github.com/kspalaiologos/bzip3/compare/1.2.3...1.3.0; https://github.com/kspalaiologos/bzip3/issues/92
CVE: CVE-2023-29417
Published: 2023-04-06
Description: An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3_decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a contract violation, and thus the report is invalid.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/kspalaiologos/bzip3/issues/97; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JLSE25SV7K2NB6FTFT4UHJOJUHBHYHY/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NA7S7HDUAINOTCSWQZ5LIW756DYY22V2/
CVE: CVE-2023-29418
Published: 2023-04-06
Description: An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an xwrite out-of-bounds read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/kspalaiologos/bzip3/commit/aae16d107f804f69000c09cd92027a140968cc9d; https://github.com/kspalaiologos/bzip3/compare/1.2.2...1.2.3; https://github.com/kspalaiologos/bzip3/issues/92
CVE: CVE-2023-29419
Published: 2023-04-06
Description: An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a bz3_decode_block out-of-bounds read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/kspalaiologos/bzip3/commit/8ec8ce7d3d58bf42dabc47e4cc53aa27051bd602; https://github.com/kspalaiologos/bzip3/compare/1.2.2...1.2.3; https://github.com/kspalaiologos/bzip3/issues/92
CVE: CVE-2023-29420
Published: 2023-04-06
Description: An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a crash caused by an invalid memmove in bz3_decode_block.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://github.com/kspalaiologos/bzip3/commit/bb06deb85f1c249838eb938e0dab271d4194f8fa; https://github.com/kspalaiologos/bzip3/compare/1.2.2...1.2.3; https://github.com/kspalaiologos/bzip3/issues/92
CVE: CVE-2023-29421
Published: 2023-04-06
Description: An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an out-of-bounds write in bz3_decode_block.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/kspalaiologos/bzip3/compare/1.2.2...1.2.3; https://github.com/kspalaiologos/bzip3/issues/94; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JLSE25SV7K2NB6FTFT4UHJOJUHBHYHY/
CVE: CVE-2023-23971
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodePeople WP Time Slots Booking Form plugin <= 1.1.81 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-1-81-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-1-81-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23972
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smplug-in Social Like Box and Page by WpDevArt plugin <= 0.8.39 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/like-box/wordpress-social-like-box-and-page-by-wpdevart-plugin-0-8-39-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/like-box/wordpress-social-like-box-and-page-by-wpdevart-plugin-0-8-39-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23979
Published: 2023-04-06
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/quick-event-manager/wordpress-quick-event-manager-plugin-9-7-4-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/quick-event-manager/wordpress-quick-event-manager-plugin-9-7-4-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23987
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPEverest User Registration plugin <= 2.3.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/user-registration/wordpress-user-registration-custom-registration-form-login-form-and-user-profile-for-wordpress-plugin-2-3-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/user-registration/wordpress-user-registration-custom-registration-form-login-form-and-user-profile-for-wordpress-plugin-2-3-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25542
Published: 2023-04-06
Description: 
Dell Trusted Device Agent, versions prior to 5.3.0, contain(s) an improper installation permissions vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to escalated privileges.


CVSS Score: 7.0 (HIGH)
CWE: CWE-276, CWE-276
References: https://www.dell.com/support/kbdoc/en-us/000209461/dsa-2023-074; https://www.dell.com/support/kbdoc/en-us/000209461/dsa-2023-074
CVE: CVE-2023-28046
Published: 2023-04-06
Description: 
Dell Display Manager, versions 2.1.0 and prior, contains an arbitrary file or folder deletion vulnerability during uninstallation A local low privilege attacker could potentially exploit this vulnerability, leading to the deletion of arbitrary files on the operating system with high privileges.


CVSS Score: 6.6 (MEDIUM)
CWE: CWE-272
References: https://www.dell.com/support/kbdoc/en-us/000211727/dsa-2023; https://www.dell.com/support/kbdoc/en-us/000211727/dsa-2023
CVE: CVE-2023-23980
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MailOptin Popup Builder Team MailOptin plugin <= 1.2.54.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mailoptin/wordpress-mailoptin-plugin-1-2-54-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/mailoptin/wordpress-mailoptin-plugin-1-2-54-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23996
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-paid-membership-ecommerce-registration-form-login-form-user-profile-paywall-restrict-content-profilepress-plugin-4-5-3-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-paid-membership-ecommerce-registration-form-login-form-user-profile-paywall-restrict-content-profilepress-plugin-4-5-3-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23998
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikRentCar Car Rental Management System plugin <= 1.3.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/vikrentcar/wordpress-vikrentcar-car-rental-management-system-plugin-1-3-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/vikrentcar/wordpress-vikrentcar-car-rental-management-system-plugin-1-3-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-24001
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yannick Lefebvre Modal Dialog plugin <= 3.5.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/modal-dialog/wordpress-modal-dialog-plugin-3-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/modal-dialog/wordpress-modal-dialog-plugin-3-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24006
Published: 2023-04-06
Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Link Software LLC WP Terms Popup plugin <= 2.6.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-terms-popup/wordpress-wp-terms-popup-terms-and-conditions-and-privacy-policy-wordpress-popups-plugin-2-6-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-terms-popup/wordpress-wp-terms-popup-terms-and-conditions-and-privacy-policy-wordpress-popups-plugin-2-6-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-1802
Published: 2023-04-06
Description: In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected. 

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://docs.docker.com/desktop/release-notes/#4180; https://github.com/docker/for-win/issues/13344; https://docs.docker.com/desktop/release-notes/#4180
CVE: CVE-2023-24002
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart YouTube Embed, Playlist and Popup by WpDevArt plugin <= 2.6.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/youtube-video-player/wordpress-youtube-embed-playlist-and-popup-by-wpdevart-plugin-2-6-3-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/youtube-video-player/wordpress-youtube-embed-playlist-and-popup-by-wpdevart-plugin-2-6-3-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-24003
Published: 2023-04-06
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Timersys WP Popups – WordPress Popup plugin <= 2.1.4.8 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-popups-lite/wordpress-wp-popups-wordpress-popup-builder-plugin-2-1-4-8-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-popups-lite/wordpress-wp-popups-wordpress-popup-builder-plugin-2-1-4-8-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-24004
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Image and Video Lightbox, Image PopUp plugin <= 2.1.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/lightbox-popup/wordpress-image-and-video-lightbox-image-popup-plugin-2-1-5-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/lightbox-popup/wordpress-image-and-video-lightbox-image-popup-plugin-2-1-5-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-0652
Published: 2023-04-06
Description: Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files.
As Cloudflare WARP client for Windows (up to version 2022.5.309.0) allowed creation of mount points from its ProgramData folder, during installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.



CVSS Score: 7.0 (HIGH)
CWE: CWE-59, CWE-59
References: https://developers.cloudflare.com/warp-client/get-started/windows/; https://github.com/cloudflare/advisories/security/advisories/GHSA-xmhj-9p83-xvw9; https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release
CVE: CVE-2023-23898
Published: 2023-04-06
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeThemes Blocksy Companion plugin <= 1.8.67 versions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/blocksy-companion/wordpress-blocksy-companion-plugin-1-8-67-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/blocksy-companion/wordpress-blocksy-companion-plugin-1-8-67-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24383
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Namaste! LMS plugin <= 2.5.9.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/namaste-lms/wordpress-namaste-lms-plugin-2-5-9-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/namaste-lms/wordpress-namaste-lms-plugin-2-5-9-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-24387
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Organization chart plugin <= 1.4.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/organization-chart/wordpress-wpdevart-organization-chart-plugin-1-4-4-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/organization-chart/wordpress-wpdevart-organization-chart-plugin-1-4-4-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-24403
Published: 2023-04-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP For The Win bbPress Voting plugin <= 2.1.11.0 versions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bbp-voting/wordpress-bbpress-voting-plugin-2-1-11-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bbp-voting/wordpress-bbpress-voting-plugin-2-1-11-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24411
Published: 2023-04-06
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kerry Kline BNE Testimonials plugin <= 2.0.7 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/bne-testimonials/wordpress-bne-testimonials-plugin-2-0-7-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/bne-testimonials/wordpress-bne-testimonials-plugin-2-0-7-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-46793
Published: 2023-04-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-product-feed-pro/wordpress-product-feed-pro-for-woocommerce-plugin-12-3-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-product-feed-pro/wordpress-product-feed-pro-for-woocommerce-plugin-12-3-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-1908
Published: 2023-04-06
Description: A vulnerability was found in SourceCodester Simple Mobile Comparison Website 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/categories/view_category.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225150 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Kerkong/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.225150; https://vuldb.com/?id.225150