rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-40272 Apache Airflow Spark Provider Arbitrary File Read via JDBC
Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server.
It is recommended to upgrade to a version that is not affected.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Airflow Spark Provider
default_status: unaffected
Credits: lang: en
value: sw0rd1ight
Published: 2023-08-17T13:52:30.647Z
CVE-2023-40273 Session fixation in Apache Airflow web interface
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).

With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour.

Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.

Problem types: cwe_id: CWE-384
description: CWE-384 Session Fixation
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
default_status: unaffected
Credits: lang: en
value: Yusuf AYDIN (@h1_yusuf)
lang: en
value: L3yx of Syclover Security Team.
lang: en
value: Son Tran of VNPT-VCI
lang: en
value: Thuong Nguyen (@nthuong95)
Published: 2023-08-23T15:37:49.378Z
CVE-2023-40274 
An issue was discovered in zola 0.13.0 through 0.17.2. The custom implementation of a web server, available via the "zola serve" command, allows directory traversal. The handle_request function, used by the server to process HTTP requests, does not account for sequences of special path control characters (../) in the URL when serving a file, which allows one to escape the webroot of the server and read arbitrary files from the filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-14T00:00:00.000Z
CVE-2023-40275 
An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to _common/search/searchByAjax/patientslistShow.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2023-40276 
An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFile.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2023-40277 
An issue was discovered in OpenClinic GA 5.247.01. A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in the login.jsp message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2023-40278 
An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2023-40279 
An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2023-40280 
An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to popup.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2023-40281 
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page.
If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: EC-CUBE CO.,LTD.
product: EC-CUBE 2 series
Published: 2023-08-17T06:37:01.773Z
CVE-2023-40282 
Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's Management Screen. As a result, sensitive information may be obtained and/or the settings may be changed.
Problem types: description: Improper authentication
Affected products: vendor: Rakuten Mobile, Inc.
product: Rakuten WiFi Pocket
Published: 2023-08-23T03:16:56.417Z
CVE-2023-40283 
An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-14T00:00:00.000Z
CVE-2023-40284 
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2023-40285 
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2023-40286 
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2023-40287 
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2023-40288 
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2023-40289 
A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2023-40290 
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Internet Explorer 11 on Windows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2023-40291 
Harman Infotainment 20190525031613 allows root access via SSH over a USB-to-Ethernet dongle with a password that is an internal project name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-14T00:00:00.000Z
CVE-2023-40292 
Harman Infotainment 20190525031613 and later discloses the IP address via CarPlay CTRL packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-14T00:00:00.000Z
CVE-2023-40293 
Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-14T00:00:00.000Z
CVE-2023-40294 
libboron in Boron 2.0.8 has a heap-based buffer overflow in ur_parseBlockI at i_parse_blk.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-14T00:00:00.000Z
CVE-2023-40295 
libboron in Boron 2.0.8 has a heap-based buffer overflow in ur_strInitUtf8 at string.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-14T00:00:00.000Z
CVE-2023-40296 
async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in ReceiveFrom and Receive in udpsocket.hpp when processing malformed UDP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-14T00:00:00.000Z
CVE-2023-40297 
Stakater Forecastle 1.0.139 and before allows %5C../ directory traversal in the website component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-15T19:57:07.010Z
CVE-2023-40299 
Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using the DYLD_INSERT_LIBRARIES environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-04T00:00:00.000Z
CVE-2023-40300 
NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-40301 
NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-40302 
NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-40303 
GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop privileges before letting an ordinary user control the activities of the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-14T00:00:00.000Z
CVE-2023-40305 
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-14T00:00:00.000Z
CVE-2023-40306 URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)
SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: SAP SE
product: SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-09-08T21:05:24.877Z
CVE-2023-40307 Privileges Memory Corruption (Out-of-bound write)
An attacker with standard privileges on macOS when requesting administrator privileges from the application can submit input which causes a buffer overflow resulting in a crash of the application. This could make the application unavailable and allow reading or modification of data.


Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: SAP SE
product: SAP Privileges
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2023-09-28T13:55:49.371Z
CVE-2023-40308 Memory Corruption vulnerability in SAP CommonCryptoLib
SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: SAP_SE
product: SAP CommonCryptoLib
default_status: unaffected
vendor: SAP_SE
product: SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise
default_status: unaffected
vendor: SAP_SE
product: SAP Web Dispatcher
default_status: unaffected
vendor: SAP_SE
product: SAP Content Server
default_status: unaffected
vendor: SAP_SE
product: SAP HANA Database
default_status: unaffected
vendor: SAP_SE
product: SAP Host Agent
default_status: unaffected
vendor: SAP_SE
product: SAP Extended Application Services and Runtime (XSA)
default_status: unaffected
vendor: SAP_SE
product: SAPSSOEXT
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-09-12T01:21:15.083Z
CVE-2023-40309 Missing Authorization check in SAP CommonCryptoLib
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: SAP_SE
product: SAP CommonCryptoLib
default_status: unaffected
vendor: SAP_SE
product: SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise
default_status: unaffected
vendor: SAP_SE
product: SAP Web Dispatcher
default_status: unaffected
vendor: SAP_SE
product: SAP Content Server
default_status: unaffected
vendor: SAP_SE
product: SAP HANA Database
default_status: unaffected
vendor: SAP_SE
product: SAP Host Agent
default_status: unaffected
vendor: SAP_SE
product: SAP Extended Application Services and Runtime (XSA)
default_status: unaffected
vendor: SAP_SE
product: SAPSSOEXT
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-09-12T02:21:19.058Z
CVE-2023-40310 Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import
SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could impact availability of SAP PowerDesigner Client.


Problem types: cwe_id: CWE-112
description: CWE-112: Missing XML Validation
Affected products: vendor: SAP_SE
product: SAP PowerDesigner Client
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-10-10T01:35:28.068Z
CVE-2023-40311 Stored XSS in multiple JSP files in opennms/opennms
Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that allow an attacker to store on database and then load on JSPs or Angular templates. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.

Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: The OpenNMS Group
product: Horizon
default_status: unaffected
vendor: The OpenNMS Group
product: Meridian
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Jordi Miralles Comins
Published: 2023-08-14T17:31:29.877Z
CVE-2023-40312 Reflected XSS in multiple JSP files in opennms/opennms
Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.

Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: The OpenNMS Group
product: Horizon
default_status: unaffected
vendor: The OpenNMS Group
product: Meridian
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Jordi Miralles Comins
Published: 2023-08-14T17:35:26.710Z
CVE-2023-40313 Disable BeanShell Interpreter Remote Server Mode
A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Affected products: vendor: The OpenNMS Group
product: Horizon
default_status: unaffected
vendor: The OpenNMS Group
product: Meridian
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2023-08-17T18:24:08.866Z
CVE-2023-40314 Cross-site scripting in bootstrap.jsp



Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer










Meridian
and Horizon installation instructions state that they are intended for
installation within an organization's private networks and should not be
directly accessible from the Internet. 

OpenNMS thanks 

Moshe Apelbaum

 for reporting this issue.








Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor:  The OpenNMS Group
product: Horizon
default_status: unknown
vendor: The OpenNMS Group 
product: Meridian
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Moshe Apelbaum
Published: 2023-11-16T21:14:07.488Z
CVE-2023-40315 ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate their privileges to ROLE_ADMIN or any other role. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
Affected products: vendor: The OpenNMS Group
product: Horizon
default_status: unaffected
vendor: The OpenNMS Group
product: Meridian
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Credits: lang: en
value: Erik Wynter
Published: 2023-08-17T19:04:01.437Z
CVE-2023-40327 WordPress Putler Connector for WooCommerce plugin <= 2.12.0 - Unauthenticated Broken Access Control vulnerability
Missing Authorization vulnerability in Putler / Storeapps Putler Connector for WooCommerce.This issue affects Putler Connector for WooCommerce: from n/a through 2.12.0.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Putler / Storeapps
product: Putler Connector for WooCommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: David Anderson (Patchstack Alliance)
Published: 2025-01-02T14:59:13.527Z