rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-5882 WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Export any WordPress data to XML/CSV
default_status: unaffected
vendor: Unknown
product: WP All Export Pro
default_status: unaffected
Credits: lang: en
value: Francesco Marano (@mrnfrancesco)
lang: en
value: Donato Di Pasquale (@ddipa)
lang: en
value: WPScan
Published: 2023-12-18T20:08:04.861Z
CVE-2023-5884 Word Balloon < 4.20.3 - Avatar Removal via CSRF
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Word Balloon
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2023-12-04T21:29:32.963Z
CVE-2023-5885 Franklin Electric Fueling Systems Colibri Path Traversal
The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users.

Problem types: cwe_id: CWE-35
description: CWE-35 Path Traversal
Affected products: vendor: Franklin Electric Fueling Systems
product: Colibri
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Momen Eldawakhly Samurai Digital Security Ltd. reported this vulnerability to CISA.
Published: 2023-11-27T21:48:30.996Z
CVE-2023-5886 WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Export any WordPress data to XML/CSV
default_status: unaffected
vendor: Unknown
product: WP All Export Pro
default_status: unaffected
Credits: lang: en
value: WPScan
Published: 2023-12-18T20:07:57.546Z
CVE-2023-5889 Insufficient Session Expiration in pkp/pkp-lib
Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:18.857Z
CVE-2023-5890 Cross-site Scripting (XSS) - Stored in pkp/pkp-lib
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:18.404Z
CVE-2023-5891 Cross-site Scripting (XSS) - Reflected in pkp/pkp-lib
Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:18.684Z
CVE-2023-5892 Cross-site Scripting (XSS) - Stored in pkp/pkp-lib
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:18.543Z
CVE-2023-5893 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:18.533Z
CVE-2023-5894 Cross-site Scripting (XSS) - Stored in pkp/ojs
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pkp
product: pkp/ojs
Published: 2023-11-01T00:00:18.898Z
CVE-2023-5895 Cross-site Scripting (XSS) - DOM in pkp/pkp-lib
Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:19.147Z
CVE-2023-5896 Cross-site Scripting (XSS) - Stored in pkp/pkp-lib
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:41.580Z
CVE-2023-5897 Cross-Site Request Forgery (CSRF) in pkp/customLocale
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: pkp
product: pkp/customLocale
Published: 2023-11-01T00:00:41.904Z
CVE-2023-5898 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:41.808Z
CVE-2023-5899 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:41.225Z
CVE-2023-5900 Cross-Site Request Forgery in pkp/pkp-lib
Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.


Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: pkp
product: pkp/pkp-lib
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-11-01T00:00:42.738Z
CVE-2023-5901 Cross-site Scripting in pkp/pkp-lib
Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pkp
product: pkp/pkp-lib
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2023-11-01T00:00:42.521Z
CVE-2023-5902 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:41.753Z
CVE-2023-5903 Cross-site Scripting (XSS) - Stored in pkp/pkp-lib
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:00:42.777Z
CVE-2023-5904 Cross-site Scripting (XSS) - Stored in pkp/pkp-lib
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pkp
product: pkp/pkp-lib
Published: 2023-11-01T00:01:44.457Z
CVE-2023-5905 DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data export
The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts.
Problem types: description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: DeMomentSomTres WordPress Export Posts With Images
default_status: affected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2024-01-15T15:10:43.450Z
CVE-2023-5906 Job Manager & Career < 1.4.4 - Directory listing to Sensitive Data Exposure
The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users. This vulnerability poses a serious security threat because it allows an attacker to gain access to confidential data and files of other users without their permission.
Problem types: description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: Job Manager & Career
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2023-11-27T16:21:59.373Z
CVE-2023-5907 File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: File Manager
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2023-12-11T19:22:37.067Z
CVE-2023-5908 Heap Based Buffer Overflow in PTC KEPServerEx





KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.





Problem types: cwe_id: CWE-122
description: CWE-122 Heap-Based Buffer Overflow
Affected products: vendor: PTC
product: KEPServerEX
default_status: unaffected
vendor: PTC
product: ThingWorx Kepware Server
default_status: unaffected
vendor: PTC
product: ThingWorx Industrial Connectivity
default_status: unaffected
vendor: PTC
product: OPC-Aggregator
default_status: unaffected
vendor: PTC
product: ThingWorx Kepware Edge
default_status: unaffected
vendor: Rockwell Automation 
product: KEPServer Enterprise
default_status: unaffected
vendor: GE Gigital
product: Industrial Gateway Server
default_status: unaffected
vendor: Software Toolbox
product: TOP Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
version: 3.1
Credits: lang: en
value: Shawn Hoffman
Published: 2023-11-30T22:03:58.098Z
CVE-2023-5909 Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx









KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.








Problem types: cwe_id: CWE-297
description: CWE-297 Improper Validation of Certificate with Host Mismatch
Affected products: vendor: PTC
product: KEPServerEX
default_status: unaffected
vendor: PTC
product: ThingWorx Kepware Server
default_status: unaffected
vendor: PTC
product: ThingWorx Industrial Connectivity
default_status: unaffected
vendor: PTC
product: OPC-Aggregator
default_status: unaffected
vendor: PTC
product: ThingWorx Kepware Edge
default_status: unaffected
vendor: Rockwell Automation 
product: KEPServer Enterprise
default_status: unaffected
vendor: GE Gigital
product: Industrial Gateway Server
default_status: unaffected
vendor: Software Toolbox
product: TOP Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Shawn Hoffman
Published: 2023-11-30T22:05:59.595Z
CVE-2023-5910 PopojiCMS Web Config install.php cross site scripting
A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component Web Config. The manipulation of the argument Site Title with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-244229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: PopojiCMS
CVSS v3.1: version: 3.1
baseScore: 2.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: huazai (VulDB User)
Published: 2023-11-01T23:31:05.269Z
CVE-2023-5911 WP Custom Cursors <= 3.2 - Admin+ Stored XSS
The WP Custom Cursors | WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Custom Cursors | WordPress Cursor Plugin
default_status: affected
Credits: lang: en
value: David Suho Lee
lang: en
value: WPScan
Published: 2024-01-08T19:00:37.176Z
CVE-2023-5912 

A potential memory leakage vulnerability was reported in some Lenovo Notebook products that may allow a local attacker with elevated privileges to write to NVRAM variables. 


Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Lenovo
product: Notebook BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks the BINARLY efiXplorer team for reporting this issue. 
Published: 2024-04-05T20:45:00.681Z
CVE-2023-5913 A potential Privilege Escalation vulnerability in opentext Fortify ScanCentral DAST API.
Incorrect Privilege Assignment vulnerability in opentext Fortify ScanCentral DAST. The vulnerability could be exploited to gain elevated privileges.This issue affects Fortify ScanCentral DAST versions 21.1, 21.2, 21.2.1, 22.1, 22.1.1, 22.2, 23.1.


Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: opentext
product: Fortify ScanCentral DAST
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2023-11-08T16:42:31.074Z
CVE-2023-5914 
  Cross-site scripting (XSS)
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Cloud Software Group
product: Citrix StoreFront
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-01-17T20:19:49.869Z
CVE-2023-5915 
A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerability may allow to a remote attacker to cause a denial-of-service condition to the FCN/FCJ controller by sending a crafted packet. While sending the packet, the maintenance homepage of the controller could not be accessed. Therefore, functions of the maintenance homepage, changing configuration, viewing logs, etc. are not available. But the controller’s operation is not stopped by the condition.

The affected products and versions are as follows: STARDOM FCN/FCJ R1.01 to R4.31.

Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Yokogawa Electric Corporation
product: STARDOM
default_status: unaffected
Published: 2023-12-01T06:12:03.581Z
CVE-2023-5916 Lissy93 Dashy Configuration save access control
A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-244305 was assigned to this vulnerability.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Controls
Affected products: vendor: Lissy93
product: Dashy
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: zgbsm (VulDB User)
Published: 2023-11-02T10:31:06.228Z
CVE-2023-5917 phpBB Smiley Pack acp_icons.php main cross site scripting
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: phpBB
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: shin24 (VulDB User)
Published: 2023-11-02T10:31:07.376Z
CVE-2023-5918 SourceCodester Visitor Management System manage_user.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-244308.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Visitor Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: yuhangliu (VulDB User)
Published: 2023-11-02T11:00:11.083Z
CVE-2023-5919 SourceCodester Company Website CMS Create Blog Page createblog unrestricted upload
A vulnerability was found in SourceCodester Company Website CMS 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /dashboard/createblog of the component Create Blog Page. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-244310 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: SourceCodester
product: Company Website CMS
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pursuithappiness (VulDB User)
Published: 2023-11-02T13:31:06.780Z
CVE-2023-5920 Lack Of Secure Keyboard Entry Protection in MacOS Desktop
Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input.


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Mattermost
product: Mattermost Desktop
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: DoyenSec
Published: 2023-11-02T08:34:30.659Z
CVE-2023-5921 Function Bypass in Geodi
Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass.

This issue affects Geodi: before 8.0.0.27396.
Problem types: cwe_id: CWE-841
description: CWE-841 Improper Enforcement of Behavioral Workflow
Affected products: vendor: DECE Software
product: Geodi
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Credits: lang: en
value: Serhat YAPICI
Published: 2023-11-22T09:03:14.924Z
CVE-2023-5922 Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read
The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protected posts/pages content
Problem types: description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: Royal Elementor Addons and Templates
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając (CERT PL)
lang: en
value: WPScan
Published: 2024-01-16T15:57:21.145Z