rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-3945 phpscriptpoint Lawyer search.php cross site scripting
A vulnerability was found in phpscriptpoint Lawyer 1.6. It has been classified as problematic. This affects an unknown part of the file search.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235401 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: phpscriptpoint
product: Lawyer
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: skalvin (VulDB User)
Published: 2023-07-25T21:31:03.569Z
CVE-2023-3946 

A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.



Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Trellix
product: Trellix EPO
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Ben Leonard-Lagarde
lang: en
value: Freddie Sibley-Calder (Modux)
Published: 2023-07-26T05:10:44.967Z
CVE-2023-3947 Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: j_3rk
product: Video Conferencing with Zoom
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 3.7
baseSeverity: LOW
Credits: lang: en
value: István Márton
Published: 2023-07-26T03:34:28.251Z
CVE-2023-3949 Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint when release access on the public was set to only project members.
Problem types: cwe_id: CWE-201
description: CWE-201: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [ashish_r_padelkar](https://hackerone.com/ashish_r_padelkar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-12-01T07:02:13.130Z
CVE-2023-3950 Cleartext Storage of Sensitive Information in GitLab
An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.
Problem types: cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-09-01T10:30:46.990Z
CVE-2023-3953 

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory
Buffer vulnerability exists that could cause memory corruption when an authenticated user
opens a tampered log file from GP-Pro EX.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Schneider Electric
product: GP-Pro EX WinGP for iPC
default_status: unaffected
vendor: Schneider Electric
product: GP-Pro EX WinGP for PC/AT
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-08-09T14:02:44.472Z
CVE-2023-3954 MultiParcels Shipping For WooCommerce 1.15.2-1.15.3 - Reflected XSS
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: MultiParcels Shipping For WooCommerce
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-08-21T12:29:48.909Z
CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
A security issue was discovered in Kubernetes where a user
 that can create pods on Windows nodes may be able to escalate to admin 
privileges on those nodes. Kubernetes clusters are only affected if they
 include Windows nodes.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Kubernetes
product: kubelet
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: James Sturtevant
lang: en
value: Mark Rossetti
Published: 2023-10-31T20:36:54.352Z
CVE-2023-3956 InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver
The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: instawp
product: InstaWP Connect – 1-click WP Staging & Migration
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: István Márton
Published: 2023-07-27T06:54:14.804Z
CVE-2023-3957 ACF Photo Gallery Field <= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Update
The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or above, to update the user metas arbitrarily. The meta value can only be a string.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: navzme
product: ACF Photo Gallery Field
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-07-27T06:54:16.133Z
CVE-2023-3958 WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: frogerme
product: WP Remote Users Sync
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
baseScore: 8.5
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-08-16T04:36:00.625Z
CVE-2023-3959 Zavio IP Camera Stack-Based Buffer Overflow
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 

IP Cameras

with firmware version M2.1.6.05 are 
vulnerable to multiple instances of stack-based overflows. While 
processing XML elements from incoming network requests, the product does
 not sufficiently check or validate allocated buffer size. This may lead
 to remote code execution.


Problem types: cwe_id: CWE-121
description: CWE-121 Stack-Based Buffer Overflow
Affected products: vendor: Zavio
product: IP Camera CF7500
default_status: unaffected
vendor: Zavio
product: IP Camera CF7300
default_status: unaffected
vendor: Zavio
product: IP Camera CF7201
default_status: unaffected
vendor: Zavio
product: IP Camera CF7501
default_status: unaffected
vendor: Zavio
product: IP Camera CB3211
default_status: unaffected
vendor: Zavio
product: IP Camera CB3212
default_status: unaffected
vendor: Zavio
product: IP Camera CB5220
default_status: unaffected
vendor: Zavio
product: IP Camera CB6231
default_status: unaffected
vendor: Zavio
product: IP Camera B8520
default_status: unaffected
vendor: Zavio
product: IP Camera B8220
default_status: unaffected
vendor: Zavio
product: IP Camera CD321
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Attila Szasz 
Published: 2023-11-08T23:02:55.581Z
CVE-2023-3962 Winters <= 1.4.3 - Prototype Pollution to Reflected Cross-Site Scripting
The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: myshopkit
product: Winters - WordPress Blog Theme
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: longxi
Published: 2023-10-20T15:06:22.488Z
CVE-2023-3964 Incorrect Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [js_noob](https://hackerone.com/js_noob) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-12-01T07:02:18.158Z
CVE-2023-3965 nsc <= 1.0 - Prototype Pollution to Reflected Cross-Site Scripting
The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: National Show Centre
product: NSC WordPress Theme
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: longxi
Published: 2023-10-20T15:06:11.641Z
CVE-2023-3967 DoS Vulnerability in Hitachi Ops Center Common Services
Allocation of Resources Without Limits or Throttling vulnerability in Hitachi Ops Center Common Services on Linux allows DoS.This issue affects Hitachi Ops Center Common Services: before 10.9.3-00.


Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Hitachi
product: Hitachi Ops Center Common Services
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-10-03T01:04:00.870Z
CVE-2023-3969 GZ Scripts Availability Booking Calendar PHP HTTP POST Request index.php cross site scripting
A vulnerability, which was classified as problematic, has been found in GZ Scripts Availability Booking Calendar PHP 1.0. Affected by this issue is some unknown functionality of the file index.php of the component HTTP POST Request Handler. The manipulation of the argument promo_code leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235568.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: GZ Scripts
product: Availability Booking Calendar PHP
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2023-07-27T11:31:03.531Z
CVE-2023-3970 GZ Scripts Availability Booking Calendar PHP Image cross site scripting
A vulnerability, which was classified as problematic, was found in GZ Scripts Availability Booking Calendar PHP 1.0. This affects an unknown part of the file /index.php?controller=GzUser&action=edit&id=1 of the component Image Handler. The manipulation of the argument img leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235569 was assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: GZ Scripts
product: Availability Booking Calendar PHP
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2023-07-27T12:00:06.063Z
CVE-2023-3971 Controller: html injection in custom login info
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
Problem types: cwe_id: CWE-80
description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.3 for RHEL 8
cpes: cpe:/a:redhat:ansible_automation_platform_developer:2.3::el9
cpe:/a:redhat:ansible_automation_platform:2.3::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.3::el8
cpe:/a:redhat:ansible_automation_platform:2.3::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.3::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.3::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.3 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform_developer:2.3::el9
cpe:/a:redhat:ansible_automation_platform:2.3::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.3::el8
cpe:/a:redhat:ansible_automation_platform:2.3::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.3::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.3::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.4 for RHEL 8
cpes: cpe:/a:redhat:ansible_automation_platform:2.4::el8
cpe:/a:redhat:ansible_automation_platform:2.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.4 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform:2.4::el8
cpe:/a:redhat:ansible_automation_platform:2.4::el9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Kunal Pusdekar (redhat) for reporting this issue.
Published: 2023-10-04T14:26:01.621Z
CVE-2023-3973 Cross-site Scripting (XSS) - Reflected in jgraph/drawio
Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2023-07-27T14:33:11.271Z
CVE-2023-3974 OS Command Injection in jgraph/drawio
OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2023-07-27T14:33:31.671Z
CVE-2023-3975 OS Command Injection in jgraph/drawio
OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2023-07-27T14:34:10.847Z
CVE-2023-3977 Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: inisev
product: Redirection
default_status: unaffected
vendor: inisev
product: Pop-up
default_status: unaffected
vendor: inisev
product: BackupBliss – Backup & Migration with Free Cloud Storage
default_status: unaffected
vendor: inisev
product: Duplicate Post
default_status: unaffected
vendor: cl272
product: Enhanced Text Widget
default_status: unaffected
vendor: cl272
product: Ultimate Posts Widget
default_status: unaffected
vendor: migrate
product: Clone
default_status: unaffected
vendor: inisev
product: Social Media Share Buttons & Social Sharing Icons
default_status: unaffected
vendor: steve85b
product: SSL Mixed Content Fix
default_status: unaffected
vendor: inisev
product: Social Share Icons & Social Share Buttons
default_status: unaffected
vendor: s-feeds
product: RSS Redirect & Feedburner Alternative
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Chloe Chamberland
Published: 2023-07-28T04:37:03.018Z
CVE-2023-3978 Improper rendering of text nodes in golang.org/x/net/html
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
Problem types: description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: golang.org/x/net
product: golang.org/x/net/html
default_status: unaffected
Published: 2023-08-02T19:48:56.676Z
CVE-2023-3979 Incorrect Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
Credits: lang: en
value: Thanks [theluci](https://hackerone.com/theluci) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-09-29T06:02:06.310Z
CVE-2023-3980 Cross-site Scripting (XSS) - Stored in omeka/omeka-s
Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: omeka
product: omeka/omeka-s
Published: 2023-07-27T18:26:20.420Z
CVE-2023-3981 Server-Side Request Forgery (SSRF) in omeka/omeka-s
Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: omeka
product: omeka/omeka-s
Published: 2023-07-27T18:28:11.153Z