Auto-Update: 2023-09-28T06:00:27.468845+00:00

CVE-2022/CVE-2022-360xx/CVE-2022-36087.json

@@ -2,7 +2,7 @@
   "id": "CVE-2022-36087",
   "sourceIdentifier": "security-advisories@github.com",
   "published": "2022-09-09T21:15:08.477",
-  "lastModified": "2023-09-28T03:15:09.057",
+  "lastModified": "2023-09-28T04:15:10.437",
   "vulnStatus": "Modified",
   "descriptions": [
     {
@@ -155,6 +155,10 @@
         "Third Party Advisory"
       ]
     },
+    {
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXOPIA6M57CFQPUT6HHSNXCTV6QA3UDI/",
+      "source": "security-advisories@github.com"
+    },
     {
       "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBCQJR3ZF7FVNTJYRVPVSQEQRAYZIUHU/",
       "source": "security-advisories@github.com"

CVE-2022/CVE-2022-483xx/CVE-2022-48337.json

@@ -2,7 +2,7 @@
   "id": "CVE-2022-48337",
   "sourceIdentifier": "cve@mitre.org",
   "published": "2023-02-20T23:15:12.243",
-  "lastModified": "2023-05-10T01:15:08.917",
+  "lastModified": "2023-09-28T04:15:11.550",
   "vulnStatus": "Modified",
   "descriptions": [
     {
@@ -41,7 +41,7 @@
       "description": [
         {
           "lang": "en",
-          "value": "CWE-77"
+          "value": "CWE-78"
         }
       ]
     }
@@ -91,6 +91,10 @@
       "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00008.html",
       "source": "cve@mitre.org"
     },
+    {
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK/",
+      "source": "cve@mitre.org"
+    },
     {
       "url": "https://www.debian.org/security/2023/dsa-5360",
       "source": "cve@mitre.org",

CVE-2022/CVE-2022-483xx/CVE-2022-48338.json

@@ -2,8 +2,8 @@
   "id": "CVE-2022-48338",
   "sourceIdentifier": "cve@mitre.org",
   "published": "2023-02-20T23:15:12.297",
-  "lastModified": "2023-03-03T18:26:12.317",
+  "lastModified": "2023-09-28T04:15:11.690",
-  "vulnStatus": "Analyzed",
+  "vulnStatus": "Modified",
   "descriptions": [
     {
       "lang": "en",
@@ -72,6 +72,10 @@
         "Patch"
       ]
     },
+    {
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK/",
+      "source": "cve@mitre.org"
+    },
     {
       "url": "https://www.debian.org/security/2023/dsa-5360",
       "source": "cve@mitre.org",

CVE-2022/CVE-2022-483xx/CVE-2022-48339.json

@@ -2,7 +2,7 @@
   "id": "CVE-2022-48339",
   "sourceIdentifier": "cve@mitre.org",
   "published": "2023-02-20T23:15:12.350",
-  "lastModified": "2023-05-10T01:15:09.007",
+  "lastModified": "2023-09-28T04:15:11.790",
   "vulnStatus": "Modified",
   "descriptions": [
     {
@@ -41,7 +41,7 @@
       "description": [
         {
           "lang": "en",
-          "value": "CWE-77"
+          "value": "CWE-116"
         }
       ]
     }
@@ -76,6 +76,10 @@
       "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00008.html",
       "source": "cve@mitre.org"
     },
+    {
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK/",
+      "source": "cve@mitre.org"
+    },
     {
       "url": "https://www.debian.org/security/2023/dsa-5360",
       "source": "cve@mitre.org",

CVE-2023/CVE-2023-261xx/CVE-2023-26145.json

@@ -0,0 +1,51 @@
+{
+  "id": "CVE-2023-26145",
+  "sourceIdentifier": "report@snyk.io",
+  "published": "2023-09-28T05:15:45.843",
+  "lastModified": "2023-09-28T05:15:45.843",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.\r\r**Note:**\r\rThe pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:\r\r1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)\r\r2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)\r\r\rThe pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "report@snyk.io",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "HIGH",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "HIGH",
+          "availabilityImpact": "NONE",
+          "baseScore": 7.4,
+          "baseSeverity": "HIGH"
+        },
+        "exploitabilityScore": 2.2,
+        "impactScore": 5.2
+      }
+    ]
+  },
+  "references": [
+    {
+      "url": "https://gist.github.com/CalumHutton/45d33e9ea55bf4953b3b31c84703dfca",
+      "source": "report@snyk.io"
+    },
+    {
+      "url": "https://github.com/dgilland/pydash/commit/6ff0831ad285fff937cafd2a853f20cc9ae92021",
+      "source": "report@snyk.io"
+    },
+    {
+      "url": "https://security.snyk.io/vuln/SNYK-PYTHON-PYDASH-5916518",
+      "source": "report@snyk.io"
+    }
+  ]
+}

CVE-2023/CVE-2023-261xx/CVE-2023-26149.json

@@ -0,0 +1,63 @@
+{
+  "id": "CVE-2023-26149",
+  "sourceIdentifier": "report@snyk.io",
+  "published": "2023-09-28T05:15:46.023",
+  "lastModified": "2023-09-28T05:15:46.023",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. \r\r**Note:**\r\rIf the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection attack when a Quill user hits @."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "report@snyk.io",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "REQUIRED",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE",
+          "baseScore": 6.1,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 2.8,
+        "impactScore": 2.7
+      }
+    ]
+  },
+  "references": [
+    {
+      "url": "https://codepen.io/ALiangLiang/pen/mdQMJXK",
+      "source": "report@snyk.io"
+    },
+    {
+      "url": "https://github.com/quill-mention/quill-mention/blob/0aa9847719257496b14ac5401872c4e2ffcbc3d1/src/quill.mention.js%23L391",
+      "source": "report@snyk.io"
+    },
+    {
+      "url": "https://github.com/quill-mention/quill-mention/commit/e85262ddced0a7f0b6fc8350d236a68bd1e28385",
+      "source": "report@snyk.io"
+    },
+    {
+      "url": "https://github.com/quill-mention/quill-mention/issues/255",
+      "source": "report@snyk.io"
+    },
+    {
+      "url": "https://github.com/quill-mention/quill-mention/pull/341",
+      "source": "report@snyk.io"
+    },
+    {
+      "url": "https://security.snyk.io/vuln/SNYK-JS-QUILLMENTION-5921549",
+      "source": "report@snyk.io"
+    }
+  ]
+}

CVE-2023/CVE-2023-33xx/CVE-2023-3341.json

@@ -2,7 +2,7 @@
   "id": "CVE-2023-3341",
   "sourceIdentifier": "security-officer@isc.org",
   "published": "2023-09-20T13:15:11.770",
-  "lastModified": "2023-09-23T04:15:11.157",
+  "lastModified": "2023-09-28T04:15:12.337",
   "vulnStatus": "Modified",
   "descriptions": [
     {
@@ -254,6 +254,10 @@
         "Vendor Advisory"
       ]
     },
+    {
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/",
+      "source": "security-officer@isc.org"
+    },
     {
       "url": "https://www.debian.org/security/2023/dsa-5504",
       "source": "security-officer@isc.org"

CVE-2023/CVE-2023-388xx/CVE-2023-38870.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-38870",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-28T04:15:11.893",
+  "lastModified": "2023-09-28T04:15:11.893",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38870",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/gugoan/economizzer",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.economizzer.org",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-388xx/CVE-2023-38871.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-38871",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-28T04:15:12.003",
+  "lastModified": "2023-09-28T04:15:12.003",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38871",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/gugoan/economizzer",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.economizzer.org",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-388xx/CVE-2023-38872.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-38872",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-28T04:15:12.067",
+  "lastModified": "2023-09-28T04:15:12.067",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38872",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/gugoan/economizzer",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.economizzer.org",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-388xx/CVE-2023-38873.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-38873",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-28T04:15:12.123",
+  "lastModified": "2023-09-28T04:15:12.123",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a \"UI redress attack\", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is \"hijacking\" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38873",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/gugoan/economizzer",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.economizzer.org",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-388xx/CVE-2023-38874.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-38874",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-28T04:15:12.223",
+  "lastModified": "2023-09-28T04:15:12.223",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38874",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/gugoan/economizzer",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.economizzer.org",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-388xx/CVE-2023-38877.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-38877",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-28T04:15:12.280",
+  "lastModified": "2023-09-28T04:15:12.280",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38877",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/gugoan/economizzer/",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.economizzer.org",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-390xx/CVE-2023-39007.json

@@ -2,12 +2,12 @@
   "id": "CVE-2023-39007",
   "sourceIdentifier": "cve@mitre.org",
   "published": "2023-08-09T19:15:15.207",
-  "lastModified": "2023-08-11T23:04:47.267",
+  "lastModified": "2023-09-28T05:15:46.107",
-  "vulnStatus": "Analyzed",
+  "vulnStatus": "Modified",
   "descriptions": [
     {
       "lang": "en",
-      "value": "/ui/cron/item/open in the Cron component of OPNsense before 23.7 allows XSS."
+      "value": "/ui/cron/item/open in the Cron component of OPNsense before 23.7 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php."
     }
   ],
   "metrics": {
@@ -72,6 +72,10 @@
         "Patch"
       ]
     },
+    {
+      "url": "https://github.com/opnsense/core/compare/23.1.11...23.7",
+      "source": "cve@mitre.org"
+    },
     {
       "url": "https://logicaltrust.net/blog/2023/08/opnsense.html",
       "source": "cve@mitre.org",

CVE-2023/CVE-2023-42xx/CVE-2023-4236.json

@@ -2,7 +2,7 @@
   "id": "CVE-2023-4236",
   "sourceIdentifier": "security-officer@isc.org",
   "published": "2023-09-20T13:15:12.313",
-  "lastModified": "2023-09-23T04:15:11.900",
+  "lastModified": "2023-09-28T04:15:12.560",
   "vulnStatus": "Modified",
   "descriptions": [
     {
@@ -95,6 +95,10 @@
         "Vendor Advisory"
       ]
     },
+    {
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/",
+      "source": "security-officer@isc.org"
+    },
     {
       "url": "https://www.debian.org/security/2023/dsa-5504",
       "source": "security-officer@isc.org"

CVE-2023/CVE-2023-442xx/CVE-2023-44273.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-44273",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-28T04:15:12.493",
+  "lastModified": "2023-09-28T04:15:12.493",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/Consensys/gnark-crypto/pull/449",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/Consensys/gnark-crypto/releases",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://verichains.io",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-442xx/CVE-2023-44275.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-44275",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-28T05:15:46.243",
+  "lastModified": "2023-09-28T05:15:46.243",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/opnsense/core/commit/484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/opnsense/core/compare/23.7.4...23.7.5",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.x41-dsec.de/lab/advisories/x41-2023-001-opnsense",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-442xx/CVE-2023-44276.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-44276",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-28T05:15:46.290",
+  "lastModified": "2023-09-28T05:15:46.290",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/opnsense/core/commit/484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/opnsense/core/compare/23.7.4...23.7.5",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.x41-dsec.de/lab/advisories/x41-2023-001-opnsense",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-52xx/CVE-2023-5230.json

@@ -0,0 +1,59 @@
+{
+  "id": "CVE-2023-5230",
+  "sourceIdentifier": "security@wordfence.com",
+  "published": "2023-09-28T05:15:46.337",
+  "lastModified": "2023-09-28T05:15:46.337",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcode in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security@wordfence.com",
+        "type": "Primary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "LOW",
+          "userInteraction": "NONE",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE",
+          "baseScore": 6.4,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 3.1,
+        "impactScore": 2.7
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "security@wordfence.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://plugins.trac.wordpress.org/browser/tm-woocommerce-compare-wishlist/tags/1.1.7/includes/wishlist/wishlist.php#L339",
+      "source": "security@wordfence.com"
+    },
+    {
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/771ecb8c-feb1-40ea-b47b-a2ae033b3c87?source=cve",
+      "source": "security@wordfence.com"
+    }
+  ]
+}

CVE-2023/CVE-2023-52xx/CVE-2023-5232.json

@@ -0,0 +1,59 @@
+{
+  "id": "CVE-2023-5232",
+  "sourceIdentifier": "security@wordfence.com",
+  "published": "2023-09-28T05:15:46.437",
+  "lastModified": "2023-09-28T05:15:46.437",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security@wordfence.com",
+        "type": "Primary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "LOW",
+          "userInteraction": "NONE",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE",
+          "baseScore": 6.4,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 3.1,
+        "impactScore": 2.7
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "security@wordfence.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://plugins.trac.wordpress.org/browser/font-awesome-more-icons/tags/3.5/plugin.php#L82",
+      "source": "security@wordfence.com"
+    },
+    {
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15947764-a070-4715-bd44-cb79b62ed59d?source=cve",
+      "source": "security@wordfence.com"
+    }
+  ]
+}

CVE-2023/CVE-2023-52xx/CVE-2023-5233.json

@@ -0,0 +1,59 @@
+{
+  "id": "CVE-2023-5233",
+  "sourceIdentifier": "security@wordfence.com",
+  "published": "2023-09-28T05:15:46.513",
+  "lastModified": "2023-09-28T05:15:46.513",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security@wordfence.com",
+        "type": "Primary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "LOW",
+          "userInteraction": "NONE",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE",
+          "baseScore": 6.4,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 3.1,
+        "impactScore": 2.7
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "security@wordfence.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://plugins.trac.wordpress.org/browser/font-awesome-integration/tags/5.0/font-awesome-integration.php#L48",
+      "source": "security@wordfence.com"
+    },
+    {
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a2791f48-895f-4099-87ec-41aaac2494a2?source=cve",
+      "source": "security@wordfence.com"
+    }
+  ]
+}

README.md

@@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
 ### Last Repository Update
 
 ```plain
-2023-09-28T04:00:24.373808+00:00
+2023-09-28T06:00:27.468845+00:00
 ```
 
 ### Most recent CVE Modification Timestamp synchronized with NVD
 
 ```plain
-2023-09-28T03:15:11.643000+00:00
+2023-09-28T05:15:46.513000+00:00
 ```
 
 ### Last Data Feed Release
@@ -29,26 +29,40 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
 ### Total Number of included CVEs
 
 ```plain
-226488
+226502
 ```
 
 ### CVEs added in the last Commit
 
-Recently added CVEs: `5`
+Recently added CVEs: `14`
 
-* [CVE-2023-41444](CVE-2023/CVE-2023-414xx/CVE-2023-41444.json) (`2023-09-28T03:15:11.193`)
+* [CVE-2023-38870](CVE-2023/CVE-2023-388xx/CVE-2023-38870.json) (`2023-09-28T04:15:11.893`)
-* [CVE-2023-41446](CVE-2023/CVE-2023-414xx/CVE-2023-41446.json) (`2023-09-28T03:15:11.387`)
+* [CVE-2023-38871](CVE-2023/CVE-2023-388xx/CVE-2023-38871.json) (`2023-09-28T04:15:12.003`)
-* [CVE-2023-41447](CVE-2023/CVE-2023-414xx/CVE-2023-41447.json) (`2023-09-28T03:15:11.480`)
+* [CVE-2023-38872](CVE-2023/CVE-2023-388xx/CVE-2023-38872.json) (`2023-09-28T04:15:12.067`)
-* [CVE-2023-41450](CVE-2023/CVE-2023-414xx/CVE-2023-41450.json) (`2023-09-28T03:15:11.563`)
+* [CVE-2023-38873](CVE-2023/CVE-2023-388xx/CVE-2023-38873.json) (`2023-09-28T04:15:12.123`)
-* [CVE-2023-42222](CVE-2023/CVE-2023-422xx/CVE-2023-42222.json) (`2023-09-28T03:15:11.643`)
+* [CVE-2023-38874](CVE-2023/CVE-2023-388xx/CVE-2023-38874.json) (`2023-09-28T04:15:12.223`)
+* [CVE-2023-38877](CVE-2023/CVE-2023-388xx/CVE-2023-38877.json) (`2023-09-28T04:15:12.280`)
+* [CVE-2023-44273](CVE-2023/CVE-2023-442xx/CVE-2023-44273.json) (`2023-09-28T04:15:12.493`)
+* [CVE-2023-26145](CVE-2023/CVE-2023-261xx/CVE-2023-26145.json) (`2023-09-28T05:15:45.843`)
+* [CVE-2023-26149](CVE-2023/CVE-2023-261xx/CVE-2023-26149.json) (`2023-09-28T05:15:46.023`)
+* [CVE-2023-44275](CVE-2023/CVE-2023-442xx/CVE-2023-44275.json) (`2023-09-28T05:15:46.243`)
+* [CVE-2023-44276](CVE-2023/CVE-2023-442xx/CVE-2023-44276.json) (`2023-09-28T05:15:46.290`)
+* [CVE-2023-5230](CVE-2023/CVE-2023-52xx/CVE-2023-5230.json) (`2023-09-28T05:15:46.337`)
+* [CVE-2023-5232](CVE-2023/CVE-2023-52xx/CVE-2023-5232.json) (`2023-09-28T05:15:46.437`)
+* [CVE-2023-5233](CVE-2023/CVE-2023-52xx/CVE-2023-5233.json) (`2023-09-28T05:15:46.513`)
 
 
 ### CVEs modified in the last Commit
 
-Recently modified CVEs: `2`
+Recently modified CVEs: `7`
 
-* [CVE-2022-36087](CVE-2022/CVE-2022-360xx/CVE-2022-36087.json) (`2023-09-28T03:15:09.057`)
+* [CVE-2022-36087](CVE-2022/CVE-2022-360xx/CVE-2022-36087.json) (`2023-09-28T04:15:10.437`)
-* [CVE-2023-41051](CVE-2023/CVE-2023-410xx/CVE-2023-41051.json) (`2023-09-28T03:15:10.457`)
+* [CVE-2022-48337](CVE-2022/CVE-2022-483xx/CVE-2022-48337.json) (`2023-09-28T04:15:11.550`)
+* [CVE-2022-48338](CVE-2022/CVE-2022-483xx/CVE-2022-48338.json) (`2023-09-28T04:15:11.690`)
+* [CVE-2022-48339](CVE-2022/CVE-2022-483xx/CVE-2022-48339.json) (`2023-09-28T04:15:11.790`)
+* [CVE-2023-3341](CVE-2023/CVE-2023-33xx/CVE-2023-3341.json) (`2023-09-28T04:15:12.337`)
+* [CVE-2023-4236](CVE-2023/CVE-2023-42xx/CVE-2023-4236.json) (`2023-09-28T04:15:12.560`)
+* [CVE-2023-39007](CVE-2023/CVE-2023-390xx/CVE-2023-39007.json) (`2023-09-28T05:15:46.107`)
 
 
 ## Download and Usage