rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-37937 
An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via the FortiSwitch CLI.
Problem types: cwe_id: CWE-78
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiSwitch
cpes: cpe:2.3:a:fortinet:fortiswitch:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.13:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
Published: 2025-01-14T14:09:30.314Z
CVE-2023-37939 
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions and Mac 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions, 6.2 all versions, may allow a local authenticated attacker with no Administrative privileges to retrieve the list of files or folders excluded from malware scanning.
Problem types: cwe_id: CWE-200
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiClientMac
default_status: unaffected
vendor: Fortinet
product: FortiClientWindows
default_status: unaffected
vendor: Fortinet
product: FortiClientLinux
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:R
Published: 2023-10-10T16:50:04.463Z
CVE-2023-37940 
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Liferay
product: Portal
default_status: unaffected
vendor: Liferay
product: DXP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: milCERT AT
lang: en
value: Abderrahmane BOUNHIDJA
Published: 2024-12-17T21:30:39.730Z
CVE-2023-37941 Apache Superset: Metadata db write access can lead to remote code execution
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend.

The Superset metadata db is an 'internal' component that is typically 
only accessible directly by the system administrator and the superset 
process itself. Gaining access to that database should
 be difficult and require significant privileges.

This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Superset
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Dinis Cruz, cruzdinis@ua.pt
lang: en
value: Naveen Sunkavally (Horizon3.ai)
Published: 2023-09-06T13:06:20.879Z
CVE-2023-37942 
Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins External Monitor Job Type Plugin
default_status: unaffected
Published: 2023-07-12T15:52:46.177Z
CVE-2023-37943 
Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.
Affected products: vendor: Jenkins Project
product: Jenkins Active Directory Plugin
default_status: unaffected
Published: 2023-07-12T15:52:46.885Z
CVE-2023-37944 
A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins Datadog Plugin
default_status: unaffected
Published: 2023-07-12T15:52:47.615Z
CVE-2023-37945 
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows attackers with Overall/Read permission to download a string representation of the current security realm.
Affected products: vendor: Jenkins Project
product: Jenkins SAML Single Sign On(SSO) Plugin
default_status: unaffected
Published: 2023-07-12T15:52:48.355Z
CVE-2023-37946 
Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.
Affected products: vendor: Jenkins Project
product: Jenkins OpenShift Login Plugin
default_status: unaffected
Published: 2023-07-12T15:52:49.082Z
CVE-2023-37947 
Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
Affected products: vendor: Jenkins Project
product: Jenkins OpenShift Login Plugin
default_status: unaffected
Published: 2023-07-12T15:52:49.789Z
CVE-2023-37948 
Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling man-in-the-middle attacks.
Affected products: vendor: Jenkins Project
product: Jenkins Oracle Cloud Infrastructure Compute Plugin
default_status: unaffected
Published: 2023-07-12T15:52:50.520Z
CVE-2023-37949 
A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins Orka by MacStadium Plugin
default_status: unaffected
Published: 2023-07-12T15:52:51.254Z
CVE-2023-37950 
A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins mabl Plugin
default_status: unaffected
Published: 2023-07-12T15:52:51.990Z
CVE-2023-37951 
Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.
Affected products: vendor: Jenkins Project
product: Jenkins mabl Plugin
default_status: unaffected
Published: 2023-07-12T15:52:52.705Z
CVE-2023-37952 
A cross-site request forgery (CSRF) vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins mabl Plugin
default_status: unaffected
Published: 2023-07-12T15:52:53.441Z
CVE-2023-37953 
A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins mabl Plugin
default_status: unaffected
Published: 2023-07-12T15:52:54.198Z
CVE-2023-37954 
A cross-site request forgery (CSRF) vulnerability in Jenkins Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier allows attackers to rebuild a previous build.
Affected products: vendor: Jenkins Project
product: Jenkins Rebuilder Plugin
default_status: unknown
Published: 2023-07-12T15:52:54.913Z
CVE-2023-37955 
A cross-site request forgery (CSRF) vulnerability in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
Affected products: vendor: Jenkins Project
product: Jenkins Test Results Aggregator Plugin
default_status: unknown
Published: 2023-07-12T15:52:55.621Z
CVE-2023-37956 
A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Affected products: vendor: Jenkins Project
product: Jenkins Test Results Aggregator Plugin
default_status: unknown
Published: 2023-07-12T15:52:56.356Z
CVE-2023-37957 
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an attacker-specified URL, capturing a newly generated JCLI token.
Affected products: vendor: Jenkins Project
product: Jenkins Pipeline restFul API Plugin
default_status: unknown
Published: 2023-07-12T15:52:57.101Z
CVE-2023-37958 
A cross-site request forgery (CSRF) vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an attacker-specified URL.
Affected products: vendor: Jenkins Project
product: Jenkins Sumologic Publisher Plugin
default_status: unknown
Published: 2023-07-12T15:52:57.821Z
CVE-2023-37959 
A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Affected products: vendor: Jenkins Project
product: Jenkins Sumologic Publisher Plugin
default_status: unknown
Published: 2023-07-12T15:52:58.559Z
CVE-2023-37960 
Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file systems.
Affected products: vendor: Jenkins Project
product: Jenkins MathWorks Polyspace Plugin
default_status: unknown
Published: 2023-07-12T15:52:59.290Z
CVE-2023-37961 
A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into logging in to the attacker's account.
Affected products: vendor: Jenkins Project
product: Jenkins Assembla Auth Plugin
default_status: unknown
Published: 2023-07-12T15:52:59.990Z
CVE-2023-37962 
A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Benchmark Evaluator Plugin
default_status: unknown
Published: 2023-07-12T15:53:00.734Z
CVE-2023-37963 
A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Benchmark Evaluator Plugin
default_status: unknown
Published: 2023-07-12T15:53:01.486Z
CVE-2023-37964 
A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins ElasticBox CI Plugin
default_status: unknown
Published: 2023-07-12T15:53:02.291Z
CVE-2023-37965 
A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins ElasticBox CI Plugin
default_status: unknown
Published: 2023-07-12T15:53:03.069Z
CVE-2023-37966 WordPress User Activity Log Plugin <= 1.6.2 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log user-activity-log allows SQL Injection.This issue affects User Activity Log: from n/a through 1.6.2.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Solwin Infotech
product: User Activity Log
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: LEE SE HYOUNG (Patchstack Alliance)
Published: 2023-10-31T14:57:14.203Z
CVE-2023-37967 WordPress DirectoryPress plugin <= 3.6.2 - Unauthenticated Broken Access Control Vulnerability
Missing Authorization vulnerability in Designinvento DirectoryPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through 3.6.2.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Designinvento
product: DirectoryPress
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Abdi Pranata (Patchstack Alliance)
Published: 2024-12-13T14:23:50.154Z
CVE-2023-37968 WordPress Falang multilanguage Plugin <= 1.3.39 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Faboba Falang multilanguage for WordPress plugin <= 1.3.39 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Faboba
product: Falang multilanguage for WordPress
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Skalucy (Patchstack Alliance)
Published: 2023-07-17T14:56:54.274Z
CVE-2023-37969 WordPress Checkout with Zelle on Woocommerce plugin <= 3.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in The African Boss Checkout with Zelle on Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout with Zelle on Woocommerce: from n/a through 3.1.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: The African Boss
product: Checkout with Zelle on Woocommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2024-12-13T14:23:50.866Z
CVE-2023-37970 WordPress MF Gig Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Matthew Fries MF Gig Calendar plugin <= 1.2 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Matthew Fries
product: MF Gig Calendar
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abdi Pranata (Patchstack Alliance)
Published: 2023-07-27T14:30:03.127Z
CVE-2023-37971 WordPress WooCommerce Product Stock Alert plugin <= 2.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Stock Alert: from n/a through 2.0.1.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: MultiVendorX
product: WooCommerce Product Stock Alert
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2024-12-13T14:23:51.433Z
CVE-2023-37972 WordPress WooCommerce Product Stock Alert Plugin <= 2.0.1 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MultiVendorX Product Stock Manager & Notifier for WooCommerce.This issue affects Product Stock Manager & Notifier for WooCommerce: from n/a through 2.0.1.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: MultiVendorX
product: Product Stock Manager & Notifier for WooCommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2023-11-30T15:07:38.542Z
CVE-2023-37973 WordPress Replace Word Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in David Pokorny Replace Word plugin <= 2.1 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: David Pokorny
product: Replace Word
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Yuki Haruma (Patchstack Alliance)
Published: 2023-07-18T12:27:46.160Z
CVE-2023-37974 WordPress WP-FB-AutoConnect Plugin <= 4.6.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Justin Klein WP Social AutoConnect plugin <= 4.6.1 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Justin Klein
product: WP Social AutoConnect
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien (Patchstack Alliance)
Published: 2023-07-17T15:00:51.913Z