rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-4273 Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entry
A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/a:redhat:enterprise_linux:9::nfv
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/a:redhat:enterprise_linux:9::nfv
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Maxim Suhanov for reporting this issue.
Published: 2023-08-09T14:53:44.835Z
CVE-2023-4274 
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. This allows authenticated attackers with administrative privileges to delete the contents of arbitrary directories on the server, which can be a critical issue in a shared environments.
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: wpvividplugins
product: Migration, Backup, Staging – WPvivid
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
baseScore: 8.7
baseSeverity: HIGH
Credits: lang: en
value: Ivan Kuzymchak
Published: 2023-10-20T06:35:26.385Z
CVE-2023-4276 Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Change
The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abpr_profileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: johnkolbert
product: Absolute Privacy
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-08-10T06:53:58.090Z
CVE-2023-4277 Realia <= 1.4.0 - Cross-Site Request Forgery to User Email Change
The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing nonce validation on the 'process_change_profile_form' function. This makes it possible for unauthenticated attackers to change user email via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: pragmaticmates
product: Realia
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-08-10T06:53:57.359Z
CVE-2023-4278 MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
Problem types: description: CWE-269 Improper Privilege Management
Affected products: vendor: Unknown
product: MasterStudy LMS WordPress Plugin
default_status: unaffected
Credits: lang: en
value: Revan Arifio
lang: en
value: WPScan
Published: 2023-09-11T19:46:08.650Z
CVE-2023-4279 User Activity Log < 1.6.7 - IP Spoofing
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
Problem types: description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Unknown
product: User Activity Log
default_status: unaffected
Credits: lang: en
value: Bartlomiej Marek and Tomasz Swiadek
lang: en
value: WPScan
Published: 2023-09-04T11:27:04.063Z
CVE-2023-4280 Unvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory region
An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: silabs.com
product: GSDK
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-01-02T16:52:06.959Z
CVE-2023-4281 Activity Log < 2.8.8 - IP Spoofing
This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
Problem types: description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Unknown
product: Activity Log
default_status: unaffected
Credits: lang: en
value: Bartlomiej Marek and Tomasz Swiadek
lang: en
value: WPScan
Published: 2023-09-25T15:56:53.286Z
CVE-2023-4282 EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data
The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above, to delete plugin settings.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: wpdevteam
product: EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-08-10T11:05:42.912Z
CVE-2023-4283 EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpress_calendar' shortcode in versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wpdevteam
product: EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-08-10T11:05:43.454Z
CVE-2023-4284 Post Timeline < 2.2.6 - Reflected XSS
The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Post Timeline
default_status: unaffected
Credits: lang: en
value: tnt24
lang: en
value: WPScan
Published: 2023-09-04T11:26:59.291Z
CVE-2023-4289 WP Matterport Shortcode < 2.1.8 - Contributor+ Stored XSS via shortcode
The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Matterport Shortcode
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2023-10-16T19:39:24.537Z
CVE-2023-4290 WP Matterport Shortcode < 2.1.7 - Reflected XSS
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Matterport Shortcode
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-10-16T19:22:43.516Z
CVE-2023-4291 Frauscher FDS101 for FAdC/FAdCi remote code execution vulnerability
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE) vulnerability via manipulated parameters of the web interface without authentication. This could lead to a full compromise of the FDS101 device.



Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Frauscher
product: FDS101 for FAdC/FAdCi
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-09-21T06:17:57.646Z
CVE-2023-4292 Frauscher FDS101 for FAdC/FAdCi SQL injection vulnerability
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a SQL injection vulnerability via manipulated parameters of the web interface without authentication. The database contains limited, non-critical log information.




Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Frauscher
product: FDS101 for FAdC/FAdCi
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-09-21T06:18:43.430Z
CVE-2023-4293 Premium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: codename065
product: Premium Packages – Sell Digital Products Securely
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-08-12T07:42:51.694Z
CVE-2023-4294 URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: URL Shortify
default_status: unaffected
Credits: lang: en
value: Bartlomiej Marek and Tomasz Swiadek
lang: en
value: WPScan
Published: 2023-09-11T19:46:09.500Z
CVE-2023-4295 Mali GPU Kernel Driver allows improper GPU memory processing operations
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Arm Ltd
product: Valhall GPU Kernel Driver
default_status: unaffected
vendor: Arm Ltd
product: Arm 5th Gen GPU Architecture Kernel  Driver
default_status: unaffected
Credits: lang: en
value: Jann Horn at Google
Published: 2023-11-07T15:42:15.584Z
CVE-2023-4296 PTC Codebeamer Cross site scripting
​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting
Affected products: vendor: PTC
product: Codebeamer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Niklas Schilling of SEC Consult Vulnerability Lab reported this vulnerability to CISA.
Published: 2023-08-29T21:42:48.880Z
CVE-2023-4297 Mmm Simple File List <= 2.3 - Subscriber+ Arbitrary Directory Listing
The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Mmm Simple File List
default_status: affected
Credits: lang: en
value: Dmitrii
lang: en
value: WPScan
Published: 2023-11-27T16:22:01.657Z
CVE-2023-4298 123.chat < 1.3.1 - Admin+ Stored XSS
The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: 123.chat
default_status: unaffected
Credits: lang: en
value: Jonatas Souza Villa Flor
lang: en
value: WPScan
Published: 2023-09-04T11:27:04.835Z
CVE-2023-4299 Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication

Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.


Problem types: cwe_id: CWE-836
description: CWE-836
Affected products: vendor: Digi International 
product: Digi RealPort
default_status: unaffected
vendor: Digi International 
product: Digi RealPort
default_status: unaffected
vendor: Digi International 
product: Digi ConnectPort TS 8/16
default_status: unaffected
vendor: Digi International 
product: Digi Passport Console Server
default_status: unaffected
vendor: Digi International 
product: Digi ConnectPort LTS 8/16/32
default_status: unaffected
vendor: Digi International 
product: Digi CM Console Server
default_status: unaffected
vendor: Digi International 
product: Digi PortServer TS
default_status: unaffected
vendor: Digi International 
product: Digi PortServer TS MEI
default_status: unaffected
vendor: Digi International 
product: Digi PortServer TS MEI Hardened
default_status: unaffected
vendor: Digi International 
product: Digi PortServer TS M MEI
default_status: unaffected
vendor: Digi International 
product: Digi PortServer TS P MEI
default_status: unaffected
vendor: Digi International 
product: Digi One IAP Family
default_status: unaffected
vendor: Digi International 
product: Digi One IA
default_status: unaffected
vendor: Digi International 
product: Digi One SP IA
default_status: unaffected
vendor: Digi International 
product: ​Digi One SP
default_status: unaffected
vendor: Digi International 
product: Digi WR31
default_status: unaffected
vendor: Digi International 
product: Digi WR11 XT
default_status: unaffected
vendor: Digi International 
product: Digi WR44 R
default_status: unaffected
vendor: Digi International 
product: Digi WR21
default_status: unaffected
vendor: Digi International 
product: Digi Connect ES
default_status: unaffected
vendor: Digi International 
product: Digi Connect SP
default_status: unaffected
vendor: Digi International 
product: Digi 6350-SR
default_status: unaffected
vendor: Digi International 
product: Digi ConnectCore 8X products
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Reid Wightman of Dragos, Inc reported this vulnerability to Digi International.
Published: 2023-08-31T20:45:43.866Z
CVE-2023-4300 Import XML and RSS Feeds < 2.1.4 - Admin+ Arbitrary File Upload
The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution.
Problem types: description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: Import XML and RSS Feeds
default_status: unaffected
Credits: lang: en
value: Jonatas Souza Villa Flor
lang: en
value: WPScan
Published: 2023-09-25T15:56:51.782Z
CVE-2023-4301 CSRF vulnerability in Fortify Plugin allow capturing credentials
A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.


Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Jenkins Project
product: Jenkins Fortify Plugin
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Alvaro Muñoz (@pwntester), GitHub Security Lab
lang: en
value: Kevin Guerroudj, CloudBees, Inc.
Published: 2023-08-21T22:34:37.786Z
CVE-2023-4302 Missing permission checks in Fortify Plugin allow capturing credentials
A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.


Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Jenkins Project
product: Jenkins Fortify Plugin
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Alvaro Muñoz (@pwntester), GitHub Security Lab
lang: en
value: Kevin Guerroudj, CloudBees, Inc.
Published: 2023-08-21T22:34:30.865Z
CVE-2023-4303 HTML injection vulnerability in Fortify Plugin
Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Jenkins Project
product: Jenkins Fortify Plugin
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Kevin Guerroudj, CloudBees, Inc.
Published: 2023-08-21T22:34:20.563Z
CVE-2023-4304 Business Logic Errors in froxlor/froxlor
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.


Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: froxlor
product: froxlor/froxlor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Ahmed Hassan (ahmedvienna)
lang: en
value: Josef Hassan (josefjku)
Published: 2023-08-11T00:00:20.247Z
CVE-2023-4307 Lock User Account <= 1.0.3 - Arbitrary Account Lock/Unlock via CSRF
The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Lock User Account
default_status: affected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2023-09-11T19:46:04.810Z