deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2108
Published: 2023-04-16
Description: A vulnerability has been found in SourceCodester Judging Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_contestant.php. The manipulation of the argument contestant_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226147.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/hackerzyq/mycve/blob/main/vendors/oretnom23/judging-management-system/SQLi-1.md; https://vuldb.com/?ctiid.226147; https://vuldb.com/?id.226147
CVE: CVE-2023-30474
Published: 2023-04-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ultimate-noindex-nofollow-tool-ii/wordpress-ultimate-noindex-nofollow-tool-ii-plugin-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-noindex-nofollow-tool-ii/wordpress-ultimate-noindex-nofollow-tool-ii-plugin-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-30537
Published: 2023-04-16
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the styles properties `FlamingoThemesCode.WebHome`. This page is installed by default. The vulnerability has been patched in XWiki versions 13.10.11, 14.4.7 and 14.10.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/df596f[PII_REDACTED]f8899ca122af8f3df0fe2e8; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vrr8-fp7c-7qgp; https://jira.xwiki.org/browse/XWIKI-20280
CVE: CVE-2023-30542
Published: 2023-04-16
Description: OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.3; https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-93hq-5wgc-jc82; https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.3
CVE: CVE-2022-43458
Published: 2023-04-16
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Code Tides Advanced Floating Content plugin <= 1.2.1 versions.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-floating-content-lite/wordpress-advanced-floating-content-plugin-1-2-1-multiple-auth-cross-site-scripting-xss-vulnerabilities?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-floating-content-lite/wordpress-advanced-floating-content-plugin-1-2-1-multiple-auth-cross-site-scripting-xss-vulnerabilities?_s_id=cve
CVE: CVE-2022-43480
Published: 2023-04-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/homepage-pop-up/wordpress-homepage-pop-up-plugin-1-2-5-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/homepage-pop-up/wordpress-homepage-pop-up-plugin-1-2-5-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-44734
Published: 2023-04-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/car-rental/wordpress-car-rental-by-bestwebsoft-plugin-1-1-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/car-rental/wordpress-car-rental-by-bestwebsoft-plugin-1-1-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45849
Published: 2023-04-16
Description: Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/activello/wordpress-activello-theme-1-4-4-auth-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/activello/wordpress-activello-theme-1-4-4-auth-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-22687
Published: 2023-04-16
Description: Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.
CVSS Score: 3.7 (LOW)
CWE: CWE-922
References: https://patchstack.com/database/vulnerability/freesoul-deactivate-plugins/wordpress-freesoul-deactivate-plugins-plugin-manager-and-cleanup-plugin-1-9-4-0-content-spoofing?_s_id=cve; https://patchstack.com/database/vulnerability/freesoul-deactivate-plugins/wordpress-freesoul-deactivate-plugins-plugin-manager-and-cleanup-plugin-1-9-4-0-content-spoofing?_s_id=cve
CVE: CVE-2023-2109
Published: 2023-04-17
Description: Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/chatwoot/chatwoot/commit/a06a5a574ad908b0ef2db7b47d05c3774eeb493d; https://huntr.dev/bounties/fd5999fd-b1fd-44b4-ae2e-8f95b5c3d1b6; https://github.com/chatwoot/chatwoot/commit/a06a5a574ad908b0ef2db7b47d05c3774eeb493d
CVE: CVE-2023-24831
Published: 2023-04-17
Description: Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3.

Attackers could login without authorization. This is fixed in 0.13.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l; https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l
CVE: CVE-2023-30770
Published: 2023-04-17
Description: A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation. An attacker can exploit this vulnerability to execute arbitrary code. Affected ADM versions include: 4.0.6.REG2, 4.1.0 and below as well as 4.2.0.RE71 and below.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.asustor.com/security/security_advisory_detail?id=21; https://www.asustor.com/security/security_advisory_detail?id=21
CVE: CVE-2023-1109
Published: 2023-04-17
Description: In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://cert.vde.com/en/advisories/VDE-2023-003/; https://github.com/advisories/GHSA-w923-8w64-f5gh; https://cert.vde.com/en/advisories/VDE-2023-003/
CVE: CVE-2023-22946
Published: 2023-04-17
Description: In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that 
spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its 
default of "false", and is not overridden by submitted applications.



CVSS Score: 6.4 (MEDIUM)
CWE: CWE-269
References: https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv; https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv
CVE: CVE-2023-30771
Published: 2023-04-17
Description: Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database.

This problem is fixed from version 0.13.4 of iotdb-web-workbench onwards.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2023/04/18/7; https://lists.apache.org/thread/08nc3dr6lshfppx0pzmz5vbggdnzpojb; http://www.openwall.com/lists/oss-security/2023/04/18/7
CVE: CVE-2023-2017
Published: 2023-04-17
Description: Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.

CVSS Score: 8.8 (HIGH)
CWE: CWE-184, CWE-1336, CWE-94
References: https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2023; https://github.com/shopware/platform/security/advisories/GHSA-7v2v-9rm4-7m8f; https://starlabs.sg/advisories/23/23-2017/
CVE: CVE-2023-1723
Published: 2023-04-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veragroup Mobile Assistant allows SQL Injection.This issue affects Mobile Assistant: before 21.S.2343.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0228; https://www.usom.gov.tr/bildirim/tr-23-0228
CVE: CVE-2022-44726
Published: 2023-04-17
Description: The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-050.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-050.txt
CVE: CVE-2023-0277
Published: 2023-04-17
Description: The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
CVSS Score: 7.2 (HIGH)
References: https://bulletin.iese.de/post/wc-fields-factory_1-4-5; https://wpscan.com/vulnerability/69ffb2f1-b291-49bf-80a8-08d03ceca53b; https://bulletin.iese.de/post/wc-fields-factory_1-4-5
CVE: CVE-2023-0367
Published: 2023-04-17
Description: The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/d7685af2-6034-49ea-93ef-4debe72689bc; https://wpscan.com/vulnerability/d7685af2-6034-49ea-93ef-4debe72689bc
CVE: CVE-2023-0374
Published: 2023-04-17
Description: The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ddb10f2e-73b8-444c-90b2-5c84cdf6de5c; https://wpscan.com/vulnerability/ddb10f2e-73b8-444c-90b2-5c84cdf6de5c
CVE: CVE-2023-0764
Published: 2023-04-17
Description: The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription vulnerability. The attacker must have at least the privileges of the Author role.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/d48c6c50-3734-4191-9833-0d9b09b1bd8a; https://wpscan.com/vulnerability/d48c6c50-3734-4191-9833-0d9b09b1bd8a
CVE: CVE-2023-0765
Published: 2023-04-17
Description: The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/2699cefa-1cae-4ef3-ad81-7f3db3fcce25; https://wpscan.com/vulnerability/2699cefa-1cae-4ef3-ad81-7f3db3fcce25
CVE: CVE-2023-0889
Published: 2023-04-17
Description: Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/c39473a7-47fc-4bce-99ad-28d03f41e74e; https://wpscan.com/vulnerability/c39473a7-47fc-4bce-99ad-28d03f41e74e
CVE: CVE-2023-1274
Published: 2023-04-17
Description: The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/267acb2c-1a95-487f-a714-516de05d2b2f; https://wpscan.com/vulnerability/267acb2c-1a95-487f-a714-516de05d2b2f
CVE: CVE-2023-1282
Published: 2023-04-17
Description: The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/8a9548c5-59ea-46b0-bfa5-a0f7a259351a; https://wpscan.com/vulnerability/f4b2617f-5235-4587-9eaf-d0f6bb23dc27; https://wpscan.com/vulnerability/8a9548c5-59ea-46b0-bfa5-a0f7a259351a
CVE: CVE-2023-1325
Published: 2023-04-17
Description: The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/5f37cbf3-2388-4582-876c-6a7b0943c2a7; https://wpscan.com/vulnerability/5f37cbf3-2388-4582-876c-6a7b0943c2a7
CVE: CVE-2023-1331
Published: 2023-04-17
Description: The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack.
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/f81d9340-cf7e-46c4-b669-e61f2559cb8c; https://wpscan.com/vulnerability/f81d9340-cf7e-46c4-b669-e61f2559cb8c
CVE: CVE-2023-1371
Published: 2023-04-17
Description: The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/ad5c167e-77f7-453c-9443-df6e07705d89; https://wpscan.com/vulnerability/ad5c167e-77f7-453c-9443-df6e07705d89
CVE: CVE-2023-1373
Published: 2023-04-17
Description: The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/fa38f3e6-e04c-467c-969b-0f[PII_REDACTED]; https://wpscan.com/vulnerability/fa38f3e6-e04c-467c-969b-0f[PII_REDACTED]
CVE: CVE-2023-1413
Published: 2023-04-17
Description: The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/6938fee5-3510-45e6-8112-c9e2b30f6881; https://wpscan.com/vulnerability/6938fee5-3510-45e6-8112-c9e2b30f6881
CVE: CVE-2023-1427
Published: 2023-04-17
Description: - The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.
CVSS Score: 4.9 (MEDIUM)
References: https://wpscan.com/vulnerability/c8917ba2-4cb3-4b09-8a49-b7c612254946; https://wpscan.com/vulnerability/c8917ba2-4cb3-4b09-8a49-b7c612254946
CVE: CVE-2023-1473
Published: 2023-04-17
Description: The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/a6e6c67b-7d9b-4fdb-8115-c33add7bfc3d; https://wpscan.com/vulnerability/a6e6c67b-7d9b-4fdb-8115-c33add7bfc3d
CVE: CVE-2023-27733
Published: 2023-04-17
Description: DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Ephemeral1y/Vulnerability/blob/master/DedeCMS/5.7.98/DedeCMS-v5.7.98-RCE.md; https://sha999-crypto.github.io/2023/02/28/Dedecms%20background%20SQL%20injection%20vulnerability/; https://github.com/Ephemeral1y/Vulnerability/blob/master/DedeCMS/5.7.98/DedeCMS-v5.7.98-RCE.md
CVE: CVE-2023-27844
Published: 2023-04-17
Description: SQL injection vulnerability found in PrestaShopleurlrewrite v.1.0 and before allow a remote attacker to gain privileges via the Dispatcher::getController component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://friends-of-presta.github.io/security-advisories/modules/2023/04/13/leurlrewrite.html; https://litextension.com/migration-services/seo-urls-migrations.html#page%232; https://friends-of-presta.github.io/security-advisories/modules/2023/04/13/leurlrewrite.html
CVE: CVE-2023-1873
Published: 2023-04-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Faturamatik Bircard allows SQL Injection.This issue affects Bircard: before 23.04.05.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.faturamatik.com.tr/tr/hizmetlerimiz/bircard; https://www.usom.gov.tr/bildirim/tr-23-0231; https://www.faturamatik.com.tr/tr/hizmetlerimiz/bircard
CVE: CVE-2023-27755
Published: 2023-04-17
Description: go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/gobbscom/go-bbs/issues/10; https://github.com/gobbscom/go-bbs/issues/10
CVE: CVE-2023-1831
Published: 2023-04-17
Description: Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).

CVSS Score: 7.2 (HIGH)
CWE: CWE-200, CWE-319
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-27705
Published: 2023-04-17
Description: APNG_Optimizer v1.4 was discovered to contain a buffer overflow via the component /apngopt/ubuntu.png.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://bitbucket.org/tiangeng_zq/cve/src/main/; https://sourceforge.net/projects/apng/files/APNG_Optimizer/; https://bitbucket.org/tiangeng_zq/cve/src/main/
CVE: CVE-2023-29665
Published: 2023-04-17
Description: D-Link DIR823G_V1.0.2B05 was discovered to contain a stack overflow via the NewPassword parameters in SetPasswdSettings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1/boSetPasswdSettings; https://www.dlink.com/en/security-bulletin/; https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1/boSetPasswdSettings
CVE: CVE-2023-25504
Published: 2023-04-17
Description: A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery
attacks and query internal resources on behalf of the server where Superset
is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://www.openwall.com/lists/oss-security/2023/04/18/8; https://lists.apache.org/thread/tdnzkocfsqg2sbbornnp9g492fn4zhtx; http://www.openwall.com/lists/oss-security/2023/04/18/8
CVE: CVE-2023-27525
Published: 2023-04-17
Description: An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1


CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://lists.apache.org/thread/wpv7b17zjg2pmvpfkdd6nn8sco8y2q77; https://lists.apache.org/thread/wpv7b17zjg2pmvpfkdd6nn8sco8y2q77
CVE: CVE-2015-10102
Published: 2023-04-17
Description: A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to open redirect. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 2aaecd4e0c7c6c1dc4e6a593163d5f7aa0fa5d5b. It is recommended to upgrade the affected component. VDB-226118 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/wp-plugins/freshdesk-support/commit/2aaecd4e0c7c6c1dc4e6a593163d5f7aa0fa5d5b; https://vuldb.com/?ctiid.226118; https://vuldb.com/?id.226118