rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-0615 
A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: Kernel
Published: 2023-02-06T00:00:00.000Z
CVE-2023-0616 
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacker could send a crafted message with this structure to attempt a DoS attack. This vulnerability affects Thunderbird < 102.8.
Problem types: description: User Interface lockup with messages combining S/MIME and OpenPGP
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2023-06-02T00:00:00.000Z
CVE-2023-0617 TRENDNet TEW-811DRU httpd guestnetwork.asp buffer overflow
A vulnerability was found in TRENDNet TEW-811DRU 1.0.10.0. It has been classified as critical. This affects an unknown part of the file /wireless/guestnetwork.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219957 was assigned to this vulnerability.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: TRENDNet
product: TEW-811DRU
CVSS v3.1: version: 3.1
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseSeverity: HIGH
Credits: lang: en
value: leetsun (VulDB User)
Published: 2023-02-01T16:45:08.636Z
CVE-2023-0618 TRENDnet TEW-652BRP Web Service cfg_op.ccp memory corruption
A vulnerability was found in TRENDnet TEW-652BRP 3.04B01. It has been declared as critical. This vulnerability affects unknown code of the file cfg_op.ccp of the component Web Service. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219958 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: TRENDnet
product: TEW-652BRP
CVSS v3.1: version: 3.1
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseSeverity: HIGH
Credits: lang: en
value: leetsun (VulDB User)
Published: 2023-02-01T16:49:39.431Z
CVE-2023-0619 Kraken.io Image Optimizer <= 2.6.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update
The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset image optimizations.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: karim79
product: Kraken.io Image Optimizer
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2023-02-01T19:03:40.110Z
CVE-2023-0620 Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command.

This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: HashiCorp
product: Vault
default_status: unaffected
vendor: HashiCorp
product: Vault Enterprise
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Yuval Ostrovsky, Gal Goldshtein, Daniel Abeles of Oxeye
Published: 2023-03-30T00:28:13.301Z
CVE-2023-0621 CVE-2023-0621
Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds read vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in reads past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.
Problem types: description: CWE-125 Out-of-bounds Read
Affected products: vendor: Horner Automation
product: Cscape Envision RV
Published: 2023-03-09T21:13:06.983Z
CVE-2023-0622 CVE-2023-0622
Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.
Problem types: description: CWE-787 Out-of-bounds Write
Affected products: vendor: Horner Automation
product: Cscape Envision RV
Published: 2023-03-09T21:10:55.755Z
CVE-2023-0623 CVE-2023-0623
Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.
Problem types: description: CWE-787 Out-of-bounds Write
Affected products: vendor: Horner Automation
product: Cscape Envision RV
Published: 2023-03-09T21:12:00.661Z
CVE-2023-0624 
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.
Problem types: description: Reflected cross-site scripting (XSS)
Affected products: vendor: n/a
product: OrangeScrum
Published: 2023-02-09T00:00:00.000Z
CVE-2023-0625 Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog
Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog.

This issue affects Docker Desktop: before 4.12.0.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
cwe_id: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: Docker Inc.
product: Docker Desktop
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Masato Kinugawa
Published: 2023-09-25T15:31:09.114Z
CVE-2023-0626 Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route 
Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route.

This issue affects Docker Desktop: before 4.12.0.


Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Docker Inc.
product: Docker Desktop
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Masato Kinugawa
lang: en
value: Mohan Pedhapati
Published: 2023-09-25T15:31:38.283Z
CVE-2023-0627 Docker Desktop 4.11.x allows --no-windows-containers flag bypass
Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affects Docker Desktop: 4.11.X.


Problem types: cwe_id: CWE-501
description: CWE-501: Trust Boundary Violation
Affected products: vendor: Docker Inc.
product: Docker Desktop
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Cure53
Published: 2023-09-25T15:31:58.782Z
CVE-2023-0628 Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL
Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Docker Inc.
product: Docker Desktop
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: @suanve
Published: 2023-03-13T11:16:30.426Z
CVE-2023-0629 Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers
Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket).

The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges.
This issue has been fixed in Docker Desktop 4.17.0. 

Affected Docker Desktop versions: from 4.13.0 before 4.17.0.


Problem types: cwe_id: CWE-424
description: CWE-424: Improper Protection of Alternate Path
cwe_id: CWE-501
description: CWE-501: Trust Boundary Violation
Affected products: vendor: Docker Inc.
product: Docker Desktop
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2023-03-13T11:16:41.171Z
CVE-2023-0630 Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL Injection
The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Slimstat Analytics
default_status: unaffected
Credits: lang: en
value: Marc Montpas
lang: en
value: WPScan
Published: 2023-03-20T15:52:13.523Z
CVE-2023-0631 Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Paid Memberships Pro
default_status: unaffected
Credits: lang: en
value: Marc Montpas
lang: en
value: WPScan
Published: 2023-03-20T15:52:10.755Z
CVE-2023-0632 Inefficient Regular Expression Complexity in GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry.
Problem types: cwe_id: CWE-1333
description: CWE-1333: Inefficient Regular Expression Complexity
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-08-01T23:36:30.662Z
CVE-2023-0633 In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE
In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop: before 4.12.0.


Problem types: cwe_id: CWE-88
description: CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: Docker Inc.
product: Docker Desktop
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Cure53
Published: 2023-09-25T15:32:20.271Z
CVE-2023-0635 Privilege escalation to root
Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Privilege Escalation.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.01; NEXUS Series: from 3.0;0 before 3.07.01; MATRIX Series: from 3.0;0 before 3.07.01.
Problem types: cwe_id: CWE-1391
description: CWE-1391: Use of Weak Credentials
Affected products: vendor: ABB Ltd.
product: ASPECT®-Enterprise
default_status: unaffected
vendor: ABB Ltd.
product: NEXUS Series
default_status: unaffected
vendor: ABB Ltd.
product: MATRIX Series
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ABB would like to thank Prism Infosec for identifying this vulnerability in its products and for dealing with it in a professional manner.
Published: 2023-06-05T03:42:04.704Z
CVE-2023-0636 Remote Code Execution via Command Injection
Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Command Injection.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.0; NEXUS Series: from 3.0;0 before 3.07.0; MATRIX Series: from 3.0;0 before 3.07.1.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: ABB Ltd.
product: ASPECT®-Enterprise
default_status: unaffected
vendor: ABB Ltd.
product: NEXUS Series
default_status: unaffected
vendor: ABB Ltd.
product: MATRIX Series
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ABB would like to thank Prism Infosec for identifying this vulnerability in its products and for dealing with it in a professional manner.
Published: 2023-06-05T03:45:09.898Z
CVE-2023-0637 TRENDnet TEW-811DRU Web Management Interface wan.asp memory corruption
A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. This affects an unknown part of the file wan.asp of the component Web Management Interface. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220017 was assigned to this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: TRENDnet
product: TEW-811DRU
CVSS v3.1: version: 3.1
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
baseSeverity: MEDIUM
Credits: lang: en
value: leetsun (VulDB User)
Published: 2023-02-02T08:00:48.824Z
CVE-2023-0638 TRENDnet TEW-811DRU Web Interface command injection
A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-220018 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: TRENDnet
product: TEW-811DRU
CVSS v3.1: version: 3.1
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseSeverity: HIGH
Credits: lang: en
value: leetsun (VulDB User)
Published: 2023-02-02T08:05:07.549Z
CVE-2023-0639 TRENDnet TEW-652BRP Web Management Interface get_set.ccp cross site scripting
A vulnerability was found in TRENDnet TEW-652BRP 3.04b01 and classified as problematic. This issue affects some unknown processing of the file get_set.ccp of the component Web Management Interface. The manipulation of the argument nextPage leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-220019.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: TRENDnet
product: TEW-652BRP
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: leetsun (VulDB User)
Published: 2023-02-02T08:10:13.488Z
CVE-2023-0640 TRENDnet TEW-652BRP Web Interface ping.ccp command injection
A vulnerability was found in TRENDnet TEW-652BRP 3.04b01. It has been classified as critical. Affected is an unknown function of the file ping.ccp of the component Web Interface. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220020.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: TRENDnet
product: TEW-652BRP
CVSS v3.1: version: 3.1
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseSeverity: HIGH
Credits: lang: en
value: leetsun (VulDB User)
Published: 2023-02-02T08:14:07.356Z
CVE-2023-0641 PHPGurukul Employee Leaves Management System changepassword.php weak password
A vulnerability was found in PHPGurukul Employee Leaves Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file changepassword.php. The manipulation of the argument newpassword/confirmpassword leads to weak password requirements. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-220021 was assigned to this vulnerability.
Problem types: cwe_id: CWE-521
description: CWE-521 Weak Password Requirements
Affected products: vendor: PHPGurukul
product: Employee Leaves Management System
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Credits: lang: en
value: Affan (VulDB User)
Published: 2023-02-02T08:16:53.067Z
CVE-2023-0642 Cross-Site Request Forgery (CSRF) in squidex/squidex
Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: squidex
product: squidex/squidex
Published: 2023-02-02T00:00:00.000Z
CVE-2023-0643 Improper Handling of Additional Special Element in squidex/squidex
Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.
Problem types: cwe_id: CWE-167
description: CWE-167 Improper Handling of Additional Special Element
Affected products: vendor: squidex
product: squidex/squidex
Published: 2023-02-02T00:00:00.000Z
CVE-2023-0644 PushAssist <= 3.0.8 - Reflected Cross-Site Scripting
The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Push Notifications for WordPress by PushAssist
default_status: affected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2023-05-15T12:15:40.717Z