rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-0355 CVE-2023-0355
Akuvox E11 uses a hard-coded cryptographic key, which could allow an attacker to decrypt sensitive information.
Problem types: description: CWE-321 Use of Hard-Coded Cryptographic Key
Affected products: vendor: Akuvok
product: E11
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2023-03-13T19:57:47.690Z
CVE-2023-0356 

SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining sensitive information. 




 
Problem types: cwe_id: CWE-261
description: CWE-261 Weak Encoding For Password
Affected products: vendor: SOCOMEC
product: MODULYS GP 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Javier Fernandez Beré and Aarón Flecha Menéndez of S21sec reported this vulnerability to CISA.
Published: 2023-01-24T18:40:13.224Z
CVE-2023-0357 
Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. This is possible because the application does not correctly validate the attachments sent by customers in the ticket.
Problem types: description: Stored cross-site scripting (XSS)
Affected products: vendor: n/a
product: Helpy
Published: 2023-04-04T00:00:00.000Z
CVE-2023-0358 Use After Free in gpac/gpac
Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: gpac
product: gpac/gpac
Published: 2023-01-18T00:00:00.000Z
CVE-2023-0359 ipv6: Missing ipv6  nullptr-check in handle_ra_input
A missing nullptr-check in handle_ra_input can cause a nullptr-deref.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: zephyrproject-rtos
product: Zephyr
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-07-10T04:21:21.203Z
CVE-2023-0360 Location Weather < 1.3.4 - Contributor+ Stored XSS
The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Location Weather
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:33.325Z
CVE-2023-0361 
A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.
Problem types: description: side-channel
Affected products: vendor: n/a
product: gnutls
Published: 2023-02-15T00:00:00.000Z
CVE-2023-0362 Themify Portfolio Post < 1.2.2 - Contributor+ Stored XSS
Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Themify Portfolio Post
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:01.690Z
CVE-2023-0363 Scheduled Announcements Widget < 1.0 - Contributor+ Stored XSS
The Scheduled Announcements Widget WordPress plugin before 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Scheduled Announcements Widget
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-04-10T13:17:52.212Z
CVE-2023-0364 real.Kit < 5.1.1 - Contributor+ Stored XSS
The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: real.Kit
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-20T15:52:14.304Z
CVE-2023-0365 React Webcam <= 1.2.0 - Contributor+ Stored XSS
The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: React Webcam
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-20T15:52:09.937Z
CVE-2023-0366 Loan Comparison < 1.5.3 - Contributor+ Stored XSS via shortcode
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Loan Comparison
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:59.725Z
CVE-2023-0367 Pricing Tables For WPBakery Page Builder < 3.0 - Contributor+ Stored XSS
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-04-17T12:17:44.774Z
CVE-2023-0368 Responsive Tabs For WPBakery Page Builder  <= 1.1 - Contributor+ Stored XSS
The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Responsive Tabs For WPBakery Page Builder (formerly Visual Composer)
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-06-19T10:52:48.139Z
CVE-2023-0369 GoToWP <= 5.1.1 - Contributor+ Stored XSS
The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: GoToWP
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-20T15:52:11.669Z
CVE-2023-0370 WPB Advanced FAQ <= 1.0.6 - Contributor+ Stored XSS
The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WPB Advanced FAQ
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-20T15:52:19.368Z
CVE-2023-0371 EmbedSocial < 1.1.28 - Contributor+ Stored XSS
The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: EmbedSocial
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:52.506Z
CVE-2023-0372 EmbedStories < 0.7.5 - Contributor+ Stored XSS
The EmbedStories WordPress plugin before 0.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: EmbedStories
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:49.266Z
CVE-2023-0373 Lightweight Accordion < 1.5.15 - Contributor+ Stored XSS
The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Lightweight Accordion
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:09.595Z
CVE-2023-0374 W4 Post List < 2.4.6 - Contributor+ Stored XSS
The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: W4 Post List
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-04-17T12:17:38.355Z
CVE-2023-0375 Easy Affiliate Links < 3.7.1 - Contributor+ Stored XSS
The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Affiliate Links
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:38.098Z
CVE-2023-0376 Qubely < 1.8.5 - Contributor+ Stored XSS
The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Qubely
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2024-01-16T15:55:51.086Z
CVE-2023-0377 Scriptless Social Sharing < 3.2.2 - Contributor+ Stored XSS
The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Scriptless Social Sharing
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-06T13:34:05.264Z
CVE-2023-0378 Greenshift < 5.0 - Contributor+ Stored XSS
The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Greenshift
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:43.727Z
CVE-2023-0379 Spotlight Social Feeds < 1.4.3 - Contributor+ Stored XSS
The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Spotlight Social Feeds [Block, Shortcode, and Widget]
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:31:59.320Z
CVE-2023-0380 Easy Digital Downloads < 3.1.0.5 - Contributor+ Stored XSS
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Digital Downloads
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:35.659Z
CVE-2023-0381 GigPress <= 2.3.28 - Subscriber+ SQLi
The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: GigPress
default_status: affected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-02-27T15:24:32.174Z
CVE-2023-0382 Uncontrolled Resource Consumption in M-Files Server
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1

 due to uncontrolled memory consumption.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: M-Files
product: M-Files Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-04-05T06:13:59.289Z
CVE-2023-0383 Uncontrolled Resource Consuption in M-Files Server
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1

 due to uncontrolled memory consumption.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: M-Files
product: M-Files Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-04-20T08:00:31.910Z
CVE-2023-0384 Uncontrolled Resource Consuption in M-Files Server
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1

 due to uncontrolled memory consumption for a scheduled job.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: M-Files
product: M-Files Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-04-20T08:02:10.554Z
CVE-2023-0385 Custom 404 Pro <= 3.7.1 - Cross-Site Request Forgery
The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrect nonce validation on the custom_404_pro_admin_init function. This makes it possible for unauthenticated attackers to delete logs, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: kunalnagar
product: Custom 404 Pro
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2023-01-18T14:18:55.171Z
CVE-2023-0386 
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
Problem types: cwe_id: CWE-282
description: CWE-282
Affected products: vendor: n/a
product: Kernel
Published: 2023-03-22T00:00:00.000Z
CVE-2023-0388 Random Text <= 0.3.0 - Subscriber+ SQLi
The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Random Text
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-04-24T18:30:54.683Z
CVE-2023-0389 Calculated Fields Form < 1.1.151 - Admin+ Stored Cross-Site Scripting via Dropdown Fields
The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Calculated Fields Form
default_status: unaffected
Credits: lang: en
value: Numan Rajkotiya
lang: en
value: WPScan
Published: 2024-01-16T15:56:07.623Z
CVE-2023-0391 MGT-COMMERCE CloudPanel Shared Certificate
MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor this has been addressed in version 2.2.1.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: MGT-COMMERCE
product: CloudPanel
default_status: unaffected
Credits: lang: en
value: Tod Beardsley of Rapid7
Published: 2023-03-21T19:25:25.895Z
CVE-2023-0392 
The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.
Problem types: cwe_id: CWE-428
description: Unquoted Search Path or Element
Affected products: vendor: Okta
product: LDAP Agent
default_status: unaffected
Published: 2023-11-08T20:37:14.786Z
CVE-2023-0394 
A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2023-01-24T00:00:00.000Z
CVE-2023-0395 menu shortcode <= 1.0 - Contributor+ Stored XSS via Shortcode
The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: menu shortcode
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-27T15:37:46.234Z
CVE-2023-0396 Buffer Overreads in Bluetooth HCI
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
Problem types: cwe_id: CWE-126
description: Buffer Over-read (CWE-126)
Affected products: vendor: zephyrproject-rtos
product: zephyr
Published: 2023-01-19T00:00:00.000Z
CVE-2023-0397 DoS: Invalid Initialization in le_read_buffer_size_complete
A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.
Problem types: cwe_id: CWE-703
description: Improper Check or Handling of Exceptional Conditions (CWE-703)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
Published: 2023-01-19T00:00:00.000Z
CVE-2023-0398 Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: modoboa
product: modoboa/modoboa
Published: 2023-01-19T00:00:00.000Z