deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-32725
Published: 2023-12-18
Description: The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-565, CWE-565
References: https://support.zabbix.com/browse/ZBX-23854; https://support.zabbix.com/browse/ZBX-23854
CVE: CVE-2023-32726
Published: 2023-12-18
Description: The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.
CVSS Score: 3.9 (LOW)
CWE: CWE-754, CWE-754
References: https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BYSYLA7VTHR25CBLYO5ZLEJFGU7HTHQB/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMFKNV5E4LG2DIZNPRWQ2ENH75H6UEQT/
CVE: CVE-2023-32727
Published: 2023-12-18
Description: An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.zabbix.com/browse/ZBX-23857; https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html; https://support.zabbix.com/browse/ZBX-23857
CVE: CVE-2023-32728
Published: 2023-12-18
Description: The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20, CWE-94
References: https://support.zabbix.com/browse/ZBX-23858; https://support.zabbix.com/browse/ZBX-23858
CVE: CVE-2023-49854
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tribe Interactive Caddy – Smart Side Cart for WooCommerce.This issue affects Caddy – Smart Side Cart for WooCommerce: from n/a through 1.9.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/caddy/wordpress-caddy-plugin-1-9-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/caddy/wordpress-caddy-plugin-1-9-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-49855
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in BinaryCarpenter Menu Bar Cart Icon For WooCommerce By Binary Carpenter.This issue affects Menu Bar Cart Icon For WooCommerce By Binary Carpenter: from n/a through 1.49.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/bc-menu-cart-woo/wordpress-bc-menu-bar-cart-icon-for-woocommerce-by-binary-carpenter-plugin-1-49-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bc-menu-cart-woo/wordpress-bc-menu-bar-cart-icon-for-woocommerce-by-binary-carpenter-plugin-1-49-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-50372
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type Page Template: from n/a through 1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/custom-post-type-page-template/wordpress-custom-post-type-page-template-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-post-type-page-template/wordpress-custom-post-type-page-template-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28053
Published: 2023-12-18
Description: 
Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to some information disclosure.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000220547/dsa-2023-358-security-update-for-dell-networker-virtual-edition-ssh-cryptographic-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220547/dsa-2023-358-security-update-for-dell-networker-virtual-edition-ssh-cryptographic-vulnerabilities
CVE: CVE-2022-41677
Published: 2023-12-18
Description: An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilities) about the device itself and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html; https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html
CVE: CVE-2023-32230
Published: 2023-12-18
Description: An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-703
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html
CVE: CVE-2023-35867
Published: 2023-12-18
Description: An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-703
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html
CVE: CVE-2023-39509
Published: 2023-12-18
Description: A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS of the camera.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-77
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-638184-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-638184-BT.html
CVE: CVE-2023-3430
Published: 2023-12-18
Description: A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and could cause a crash, leading to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2218380; https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/3840; https://bugzilla.redhat.com/show_bug.cgi?id=2218380
CVE: CVE-2023-3628
Published: 2023-12-18
Description: A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-304
References: https://access.redhat.com/errata/RHSA-2023:5396; https://access.redhat.com/security/cve/CVE-2023-3628; https://bugzilla.redhat.com/show_bug.cgi?id=2217924
CVE: CVE-2023-3629
Published: 2023-12-18
Description: A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-304
References: https://access.redhat.com/errata/RHSA-2023:5396; https://access.redhat.com/security/cve/CVE-2023-3629; https://bugzilla.redhat.com/show_bug.cgi?id=2217926
CVE: CVE-2023-47038
Published: 2023-12-18
Description: A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
CVSS Score: 7.0 (HIGH)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/errata/RHSA-2024:2228; https://access.redhat.com/errata/RHSA-2024:3128; https://access.redhat.com/security/cve/CVE-2023-47038
CVE: CVE-2023-4320
Published: 2023-12-18
Description: An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.
CVSS Score: 7.6 (HIGH)
CWE: CWE-613, CWE-613
References: https://access.redhat.com/errata/RHSA-2024:2010; https://access.redhat.com/security/cve/CVE-2023-4320; https://bugzilla.redhat.com/show_bug.cgi?id=2231814
CVE: CVE-2023-5056
Published: 2023-12-18
Description: A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://access.redhat.com/errata/RHSA-2023:6219; https://access.redhat.com/security/cve/CVE-2023-5056; https://bugzilla.redhat.com/show_bug.cgi?id=2239517
CVE: CVE-2023-5115
Published: 2023-12-18
Description: An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-36, CWE-22
References: https://access.redhat.com/errata/RHSA-2023:5701; https://access.redhat.com/errata/RHSA-2023:5758; https://access.redhat.com/security/cve/CVE-2023-5115
CVE: CVE-2023-5236
Published: 2023-12-18
Description: A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
CVSS Score: 4.4 (MEDIUM)
References: https://access.redhat.com/errata/RHSA-2023:5396; https://access.redhat.com/security/cve/CVE-2023-5236; https://bugzilla.redhat.com/show_bug.cgi?id=2240999
CVE: CVE-2023-5384
Published: 2023-12-18
Description: A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
CVSS Score: 7.2 (HIGH)
CWE: CWE-312, CWE-312
References: https://access.redhat.com/errata/RHSA-2023:7676; https://access.redhat.com/security/cve/CVE-2023-5384; https://bugzilla.redhat.com/show_bug.cgi?id=2242156
CVE: CVE-2023-6228
Published: 2023-12-18
Description: An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.
CVSS Score: 3.3 (LOW)
CWE: CWE-787, CWE-787
References: https://access.redhat.com/errata/RHSA-2024:2289; https://access.redhat.com/errata/RHSA-2024:5079; https://access.redhat.com/security/cve/CVE-2023-6228
CVE: CVE-2022-40312
Published: 2023-12-18
Description: Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2023-46177
Published: 2023-12-18
Description: IBM MQ Appliance 9.3 LTS and 9.3 CD could allow a remote attacker to traverse directories on the system.  An attacker could send a specially crafted URL request to view arbitrary files on the system.  IBM X-Force ID:  269536.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/269536; https://www.ibm.com/support/pages/node/7091235; https://exchange.xforce.ibmcloud.com/vulnerabilities/269536
CVE: CVE-2023-49840
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Palscode Multi Currency For WooCommerce.This issue affects Multi Currency For WooCommerce: from n/a through 1.5.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wc-multi-currency/wordpress-multi-currency-for-woocommerce-plugin-1-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc-multi-currency/wordpress-multi-currency-for-woocommerce-plugin-1-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-49843
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in QuanticEdge First Order Discount Woocommerce.This issue affects First Order Discount Woocommerce: from n/a through 1.21.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/first-order-discount-woocommerce/wordpress-first-order-discount-woocommerce-plugin-1-21-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/first-order-discount-woocommerce/wordpress-first-order-discount-woocommerce-plugin-1-21-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-49844
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kevin Ohashi WPPerformanceTester.This issue affects WPPerformanceTester: from n/a through 2.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wpperformancetester/wordpress-wpperformancetester-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpperformancetester/wordpress-wpperformancetester-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-49853
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu – WooCommerce.This issue affects PayTR Taksit Tablosu – WooCommerce: from n/a through 1.3.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/paytr-taksit-tablosu-woocommerce/wordpress-paytr-taksit-tablosu-woocommerce-plugin-1-3-1-broken-authentication-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/paytr-taksit-tablosu-woocommerce/wordpress-paytr-taksit-tablosu-woocommerce-plugin-1-3-1-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2023-6778
Published: 2023-12-18
Description: Cross-site Scripting (XSS) - Stored in GitHub repository allegroai/clearml-server prior to 1.13.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/allegroai/clearml-server/commit/4684fd5b74af582c894b67a0a06e865c948b763a; https://huntr.com/bounties/5f3fffac-0358-48e6-a500-81bac13e0e2b; https://github.com/allegroai/clearml-server/commit/4684fd5b74af582c894b67a0a06e865c948b763a
CVE: CVE-2023-6817
Published: 2023-12-18
Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

We recommend upgrading past commit 317eb[PII_REDACTED]f2c9f5a8189de698c5354316a.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html; http://www.openwall.com/lists/oss-security/2023/12/22/13; http://www.openwall.com/lists/oss-security/2023/12/22/6
CVE: CVE-2023-33214
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/taggbox-widget/wordpress-taggbox-ugc-galleries-social-media-widgets-user-reviews-analytics-plugin-2-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/taggbox-widget/wordpress-taggbox-ugc-galleries-social-media-widgets-user-reviews-analytics-plugin-2-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47787
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-bookings/wordpress-woocommerce-bookings-plugin-2-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-bookings/wordpress-woocommerce-bookings-plugin-2-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47789
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-shipping-canada-post/wordpress-woocommerce-canada-post-shipping-plugin-2-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-shipping-canada-post/wordpress-woocommerce-canada-post-shipping-plugin-2-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47806
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through 1.3.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/disable-user-login/wordpress-disable-user-login-plugin-1-3-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/disable-user-login/wordpress-disable-user-login-plugin-1-3-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48755
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/teachpress/wordpress-teachpress-plugin-9-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/teachpress/wordpress-teachpress-plugin-9-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48795
Published: 2023-12-18
Description: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-354, CWE-354
References: http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html; http://seclists.org/fulldisclosure/2024/Mar/21; http://www.openwall.com/lists/oss-security/2023/12/18/3
CVE: CVE-2023-46617
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: from n/a through 1.8.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/adfoxly/wordpress-adfoxly-ad-manager-adsense-ads-ads-txt-plugin-1-8-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/adfoxly/wordpress-adfoxly-ad-manager-adsense-ads-ads-txt-plugin-1-8-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48762
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48766
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in SVGator SVGator – Add Animated SVG Easily.This issue affects SVGator – Add Animated SVG Easily: from n/a through 1.2.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/svgator/wordpress-svgator-add-animated-svg-easily-plugin-1-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/svgator/wordpress-svgator-add-animated-svg-easily-plugin-1-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-6920
Published: 2023-12-18
Description: Rejected reason: This flaw was found to be a duplicate of CVE-2023-6927. Please see https://access.redhat.com/security/cve/CVE-2023-6927 for information about affected products and security errata.
CVE: CVE-2023-6691
Published: 2023-12-18
Description: 
Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and gain root privileges.





CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-01