deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-40372
Published: 2023-10-17
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted SQL statement using External Tables.  IBM X-Force ID:  263499.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/263499; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7047561
CVE: CVE-2023-40373
Published: 2023-10-17
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table expressions.  IBM X-Force ID:  263574.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/263574; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7047563
CVE: CVE-2023-45152
Published: 2023-10-17
Description: Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.
CVSS Score: 2.0 (LOW)
CWE: CWE-918, CWE-918
References: https://github.com/engelsystem/engelsystem/commit/ee7d30b33935ea001705f438fec8ffd05734f295; https://github.com/engelsystem/engelsystem/security/advisories/GHSA-jj9g-75wf-6ppf; https://github.com/engelsystem/engelsystem/commit/ee7d30b33935ea001705f438fec8ffd05734f295
CVE: CVE-2023-45659
Published: 2023-10-17
Description: Engelsystem is a shift planning system for chaos events.  If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability.
CVSS Score: 3.6 (LOW)
CWE: CWE-613
References: https://github.com/engelsystem/engelsystem/commit/dbb089315ff3d8aabc11445e78fb50765208b27d; https://github.com/engelsystem/engelsystem/security/advisories/GHSA-f6mm-3v2h-jm6x; https://github.com/engelsystem/engelsystem/commit/dbb089315ff3d8aabc11445e78fb50765208b27d
CVE: CVE-2023-4215
Published: 2023-10-17
Description: Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1295
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-15; https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-15
CVE: CVE-2022-22377
Published: 2023-10-17
Description: IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  IBM X-Force ID:  221827.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221827; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/221827
CVE: CVE-2022-22384
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to modify messages returned from the server due to hazardous input validation. IBM X-Force ID: 221961.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221961; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/221961
CVE: CVE-2021-20581
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain sensitive information due to insufficient session expiration.  IBM X-Force ID:  199324.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199324; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/199324
CVE: CVE-2021-29913
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premise 11.5 could allow an authenticated user to obtain sensitive information or perform unauthorized actions due to improper input validation.  IBM X-Force ID:  207898.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/207898; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/207898
CVE: CVE-2021-38859
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain version number information using a specially crafted HTTP request that could be used in further attacks against the system.  IBM X-Force ID:  207899.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/207899; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/207899
CVE: CVE-2022-22375
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  IBM X-Force ID:  221681.


CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221681; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/221681
CVE: CVE-2022-22380
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates.  IBM X-Force ID:  221957.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221957; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/221957
CVE: CVE-2022-22385
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text.  IBM X-Force ID:  221962.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221962; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/221962
CVE: CVE-2022-22386
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  IBM X-Force ID:  221963.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221963; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/221963
CVE: CVE-2022-43889
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks against the system.  IBM X-Force ID:  240452.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240452; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/240452
CVE: CVE-2022-43893
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload.  IBM X-Force ID:  240634.


CVSS Score: 2.7 (LOW)
CWE: CWE-400, CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240534; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/240534
CVE: CVE-2022-43891
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  240454.


CVSS Score: 2.7 (LOW)
CWE: CWE-209, CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240454; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/240454
CVE: CVE-2022-43892
Published: 2023-10-17
Description: 
IBM Security Verify Privilege On-Premises 11.5 does not validate, or incorrectly validates, a certificate which could disclose sensitive information which could aid further attacks against the system.  IBM X-Force ID:  240455.


CVSS Score: 3.7 (LOW)
CWE: CWE-295, CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240455; https://www.ibm.com/support/pages/node/7047202; https://exchange.xforce.ibmcloud.com/vulnerabilities/240455
CVE: CVE-2023-34207
Published: 2023-10-17
Description: Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authenticated users to perform arbitrary system commands with ‘NT Authority\SYSTEM‘ privilege via a crafted ZIP archive.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://zuso.ai/Advisory/ZA-2023-04; https://zuso.ai/Advisory/ZA-2023-04
CVE: CVE-2023-34208
Published: 2023-10-17
Description: Path Traversal in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to extract files into arbitrary directories via a crafted ZIP archive.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://zuso.ai/Advisory/ZA-2023-05; https://zuso.ai/Advisory/ZA-2023-05
CVE: CVE-2023-34209
Published: 2023-10-17
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to obtain the absolute path via unencrypted VIEWSTATE parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-497
References: https://zuso.ai/Advisory/ZA-2023-06; https://zuso.ai/Advisory/ZA-2023-06
CVE: CVE-2023-34210
Published: 2023-10-17
Description: SQL Injection in create customer group function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to execute arbitrary SQL commands via the ctl00$ContentPlaceHolder1$txtCustSQL parameter.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89, CWE-89
References: https://zuso.ai/Advisory/ZA-2023-07; https://zuso.ai/Advisory/ZA-2023-07
CVE: CVE-2023-45357
Published: 2023-10-17
Description: Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 (6.14.0) is also a fixed release.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617; https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617
CVE: CVE-2023-45358
Published: 2023-10-17
Description: Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release.
CVSS Score: 8.5 (HIGH)
CWE: CWE-79
References: https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617; https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617
CVE: CVE-2023-45375
Published: 2023-10-17
Description: In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModuleFrontController::postProcess().`
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/12/pireospay.html; https://security.friendsofpresta.org/modules/2023/10/12/pireospay.html
CVE: CVE-2023-45386
Published: 2023-10-17
Description: In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::searchcategory()`, `extratabspro::searchproduct()` and `extratabspro::searchmanufacturer().'
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/12/extratabspro.html; https://security.friendsofpresta.org/modules/2023/10/12/extratabspro.html
CVE: CVE-2023-44693
Published: 2023-10-17
Description: D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_sql_%20importexport.md; https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_sql_%20importexport.md
CVE: CVE-2023-44694
Published: 2023-10-17
Description: D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_rce_%20mailrecvview.md; https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_rce_%20mailrecvview.md
CVE: CVE-2023-39456
Published: 2023-10-17
Description: Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2.

Users are recommended to upgrade to version 9.2.3, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/
CVE: CVE-2023-41752
Published: 2023-10-17
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2.

Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q; https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/
CVE: CVE-2023-4089
Published: 2023-10-17
Description: On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.
CVSS Score: 2.7 (LOW)
CWE: CWE-610
References: https://cert.vde.com/en/advisories/VDE-2023-046/; https://cert.vde.com/en/advisories/VDE-2023-046/
CVE: CVE-2023-42497
Published: 2023-10-17
Description: Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.

CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42497; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42497
CVE: CVE-2023-4399
Published: 2023-10-17
Description: Grafana is an open-source platform for monitoring and observability. 

In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts.

However, the restriction can be bypassed used punycode encoding of the characters in the request address.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-183
References: https://grafana.com/security/security-advisories/cve-2023-4399/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://grafana.com/security/security-advisories/cve-2023-4399/
CVE: CVE-2023-24385
Published: 2023-10-17
Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in David Lingren Media Library Assistant plugin <= 3.11 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/media-library-assistant/wordpress-media-library-assistant-plugin-3-11-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/media-library-assistant/wordpress-media-library-assistant-plugin-3-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-42629
Published: 2023-10-17
Description: Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629; https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629
CVE: CVE-2023-44309
Published: 2023-10-17
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44309; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44309
CVE: CVE-2023-44310
Published: 2023-10-17
Description: Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44310; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44310
CVE: CVE-2023-44311
Published: 2023-10-17
Description: Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44311; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44311
CVE: CVE-2023-44990
Published: 2023-10-17
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/bulk-editor/wordpress-wolf-plugin-1-0-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bulk-editor/wordpress-wolf-plugin-1-0-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45005
Published: 2023-10-17
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Castos Seriously Simple Stats plugin <= 1.5.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/seriously-simple-stats/wordpress-seriously-simple-stats-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seriously-simple-stats/wordpress-seriously-simple-stats-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5339
Published: 2023-10-17
Description: Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged. 


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5522
Published: 2023-10-17
Description: Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile app of users when viewing that particular channel. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-45003
Published: 2023-10-17
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin <= 2.2.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-social-feed/wordpress-social-feed-plugin-2-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-social-feed/wordpress-social-feed-plugin-2-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45010
Published: 2023-10-17
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex MacArthur Complete Open Graph plugin <= 3.4.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/complete-open-graph/wordpress-complete-open-graph-plugin-3-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/complete-open-graph/wordpress-complete-open-graph-plugin-3-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-39902
Published: 2023-10-17
Description: A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus.
CVSS Score: 7.0 (HIGH)
CWE: CWE-281
References: https://community.nxp.com/t5/i-MX-Security/U-Boot-Secondary-Program-Loader-Authentication-Vulnerability-CVE/ta-p/1736196; https://nxp.com; https://community.nxp.com/t5/i-MX-Security/U-Boot-Secondary-Program-Loader-Authentication-Vulnerability-CVE/ta-p/1736196