alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2023-31132 (published 2023-09-05)
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP files in a web document directory. The user can then execute the PHP files under the security context of SYSTEM. This allows an attacker to escalate privilege from a normal user account to SYSTEM. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: cacti, microsoft
Affected products: cacti, windows
CVE-2023-31133 (published 2023-05-08)
Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.

Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: ghost
Affected products: ghost
CVE-2023-31134 (published 2023-05-09)
Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit
arbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: tauri
Affected products: tauri
CVE-2023-31135 (published 2023-05-17)
Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being encrypted. This is problematic because two log lines will often have the same length, so due to these collisions we are reusing the same nonce many times. All audit logs generated by versions of Dgraph <v23.0.0 are affected. Attackers must have access to the system the logs are stored on. Dgraph users should upgrade to v23.0.0. Users unable to upgrade should store existing audit logs in a secure location and for extra security, encrypt using an external tool like `gpg`.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-326
Affected vendors: dgraph
Affected products: dgraph
CVE-2023-31136 (published 2023-05-09)
PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: vapor
Affected products: postgresnio
CVE-2023-31137 (published 2023-05-09)
MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.

The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.

One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-191
Affected vendors: debian, fedoraproject, maradns
Affected products: debian_linux, fedora, maradns
CVE-2023-31138 (published 2023-05-09)
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an object may be able to modify related objects that they should not have access to. DHIS2 implementers should upgrade to a supported version of DHIS2 to receive a patch: 2.37.9.1, 2.38.3.1, or 2.39.1.2. It is possible to work around this issue by blocking all PATCH requests on a reverse proxy, but this may cause some issues with the functionality of built-in applications using legacy PATCH requests.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-284
Affected vendors: dhis2
Affected products: dhis_2
CVE-2023-31139 (published 2023-05-09)
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access restrictions (for example, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.37.9.1, 2.38.3.1, or 2.39.1.2. Implementers can work around this issue by adding extra access control validations on a reverse proxy.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-613
Affected vendors: dhis2
Affected products: dhis_2
CVE-2023-3114 (published 2023-06-22)
Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Weakness: CWE-266
Affected vendors: hashicorp
Affected products: terraform_enterprise
CVE-2023-31140 (published 2023-05-08)
OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device on behalf of a user, their existing sessions are not terminated. The issue has been resolved in OpenProject version 12.5.4 by actively terminating sessions of user accounts having registered and confirmed a 2FA device. As a workaround, users who register the first 2FA device on their account can manually log out to terminate all other active sessions. This is the default behavior of OpenProject but might be disabled through a configuration option. Double check that this option is not overridden if one plans to employ the workaround.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-613
Affected vendors: openproject
Affected products: openproject
CVE-2023-31141 (published 2023-05-08)
OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-863
Affected vendors: amazon
Affected products: opensearch, opensearch_security
CVE-2023-31142 (published 2023-06-13)
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, if a site has modified their general category permissions, they could be set back to the default. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. A workaround, only if you are modifying the general category permissions, is to use a new category for the same purpose.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-732
Affected vendors: discourse
Affected products: discourse
CVE-2023-31143 (published 2023-05-09)
mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: mage
Affected products: mage-ai
CVE-2023-31144 (published 2023-05-09)
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: craftcms
Affected products: craft_cms
CVE-2023-31145 (published 2023-05-15)
Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account takeover attack. The vulnerability allows attackers to inject malicious code into web pages, which can be executed in the context of the victim's browser session. This means that an attacker can steal sensitive data, such as login credentials or personal information, or perform unauthorized actions on behalf of the victim, such as modifying or deleting data. In this specific case, the vulnerability allows for a trivial account takeover attack. An attacker can exploit the vulnerability to inject code into the victim's browser session, allowing the attacker to take over the victim's account without their knowledge or consent. This can lead to unauthorized access to sensitive information and data, as well as the ability to perform actions on behalf of the victim. Furthermore, the fact that the vulnerability bypasses the Content Security Policy (CSP) makes it more dangerous, as CSP is an important security mechanism used to prevent cross-site scripting attacks. By bypassing CSP, attackers can circumvent the security measures put in place by the web application and execute their malicious code. This issue has been patched in versions 22.05.13, 21.11.9, and 6.4.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: collabora
Affected products: online
CVE-2023-31146 (published 2023-05-11)
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment. The issue can cause data corruption across call frames. The expected behavior is to revert due to out-of-bounds array access. Version 0.3.8 contains a patch for this issue.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-787
Affected vendors: vyperlang
Affected products: vyper
CVE-2023-31147 (published 2023-05-25)
c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-330
Affected vendors: c-ares_project, fedoraproject
Affected products: c-ares, fedora
CVE-2023-31148 (published 2023-05-10)
An Improper Input Validation vulnerability 

in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to execute arbitrary code.
See SEL Service Bulletin dated 2022-11-15 for more details.



Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31149 (published 2023-05-10)

An Improper Input Validation vulnerability 

in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to execute arbitrary code.
See SEL Service Bulletin dated 2022-11-15 for more details.





Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-3115 (published 2023-09-29)
An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-286
Affected vendors: gitlab
Affected products: gitlab
CVE-2023-31150 (published 2023-05-10)

A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database system could allow an authenticated attacker to retrieve passwords.
See SEL Service Bulletin dated 2022-11-15 for more details.



Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-257
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31151 (published 2023-05-10)
An Improper Certificate Validation vulnerability 

in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface

could allow a remote unauthenticated attacker to conduct a man-in-the-middle (MitM) attack.
See SEL Service Bulletin dated 2022-11-15 for more details.





Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-295
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31152 (published 2023-05-10)
An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication Bypass. 
See SEL Service Bulletin dated 2022-11-15 for more details.




Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-288
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31153 (published 2023-05-10)
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.See SEL Service Bulletin dated 2022-11-15 for more details.




Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31154 (published 2023-05-10)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31155 (published 2023-05-10)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31156 (published 2023-05-10)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31157 (published 2023-05-10)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31158 (published 2023-05-10)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31159 (published 2023-05-10)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-3116 (published 2023-11-20)
in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through  incorrect default permissions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-276
Affected vendors: openatom
Affected products: openharmony
CVE-2023-31160 (published 2023-05-10)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31161 (published 2023-05-10)
An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow an authenticated remote attacker to use internal resources, allowing a variety of potential effects.

See SEL Service Bulletin dated 2022-11-15 for more details.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: selinc
Affected products: sel-3350, sel-3350_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31162 (published 2023-05-10)
An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to arbitrarily alter the content of a configuration file.

See SEL Service Bulletin dated 2022-11-15 for more details.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31163 (published 2023-05-10)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.


See SEL Service Bulletin dated 2022-11-15 for more details.






Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31164 (published 2023-05-10)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.


See SEL Service Bulletin dated 2022-11-15 for more details.






Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31165 (published 2023-05-10)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.


See SEL Service Bulletin dated 2022-11-15 for more details.






Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31166 (published 2023-05-10)
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to create folders in arbitrary paths of the file system.

See SEL Service Bulletin dated 2022-11-15 for more details.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-22
Affected vendors: selinc
Affected products: sel-2241_rtac_module, sel-2241_rtac_module_firmware, sel-3350, sel-3350_firmware, sel-3505, sel-3505-3, sel-3505-3_firmware, sel-3505_firmware, sel-3530, sel-3530-4, sel-3530-4_firmware, sel-3530_firmware, sel-3532, sel-3532_firmware, sel-3555, sel-3555_firmware, sel-3560e, sel-3560e_firmware, sel-3560s, sel-3560s_firmware
CVE-2023-31167 (published 2023-08-31)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Screen Builder Software on Windows allows Relative Path Traversal.



SEL acSELerator Bay Screen Builder software is distributed by SEL-5033 SEL acSELerator RTAC, SEL-5030 Quickset, and SEL Compass. CVE-2023-31167 and was patched in the acSELerator Bay Screen Builder release available on 20230602. Please contact SEL for additional details.


This issue affects SEL-5036 acSELerator Bay Screen Builder Software: before 1.0.49152.778.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-22
Affected vendors: microsoft, selinc
Affected products: sel-5036_acselerator_bay_screen_builder, windows
CVE-2023-31168 (published 2023-08-31)

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.



See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.






This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-829
Affected vendors: selinc
Affected products: sel-5030_acselerator_quickset
CVE-2023-31169 (published 2023-08-31)

An Improper Handling of Unicode Encoding vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.
This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-176
Affected vendors: selinc
Affected products: sel-5030_acselerator_quickset
CVE-2023-31170 (published 2023-08-31)

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.



See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.




This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-829
Affected vendors: selinc
Affected products: sel-5030_acselerator_quickset
CVE-2023-31171 (published 2023-08-31)

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-89
Affected vendors: selinc
Affected products: sel-5030_acselerator_quickset
CVE-2023-31172 (published 2023-08-31)

An Incomplete Filtering of Special Elements vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)
Weakness: CWE-791
Affected vendors: selinc
Affected products: sel-5030_acselerator_quickset
CVE-2023-31173 (published 2023-08-31)
Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass.



See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: microsoft, selinc
Affected products: sel-5037_sel_grid_configurator, windows
CVE-2023-31174 (published 2023-08-31)

A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: selinc
Affected products: sel-5037_sel_grid_configurator
CVE-2023-31175 (published 2023-08-31)

An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.


Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-250
Affected vendors: selinc
Affected products: sel-5037_sel_grid_configurator
CVE-2023-31176 (published 2023-11-30)
An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication. 


See product Instruction Manual Appendix A dated 20230830 for more details.




Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-331
Affected vendors: selinc
Affected products: sel-451, sel-451_firmware
CVE-2023-31177 (published 2023-11-30)
An Improper Neutralization of Input During Web Page Generation  ('Cross-site Scripting') in the Schweitzer Engineering Laboratories SEL-451 could allow an attacker to craft a link that could execute arbitrary code on a victim's system.



See product Instruction Manual Appendix A dated 20230830 for more details.



Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: selinc
Affected products: sel-451, sel-451_firmware
CVE-2023-31178 (published 2023-05-08)
AgilePoint NX v8.0 SU2.2 & SU2.3 – Arbitrary File Delete Vulnerability allows arbitrary file deletion, by an unspecified request.


Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Affected vendors: agilepoint
Affected products: agilepoint_nx
CVE-2023-31179 (published 2023-05-08)
AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversal - Vulnerability allows path traversal and downloading files from the server, by an unspecified request.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: agilepoint
Affected products: agilepoint_nx
CVE-2023-3118 (published 2023-07-10)
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: atlasgondal
Affected products: export_all_urls
CVE-2023-31180 (published 2023-05-08)

WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS) through an unspecified request.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wjjsoft
Affected products: innokb
CVE-2023-31181 (published 2023-05-08)

WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - CWE-22: Path Traversal



Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: wjjsoft
Affected products: innokb
CVE-2023-31182 (published 2023-05-08)

 EasyTor Applications – Authorization Bypass - EasyTor Applications may allow authorization bypass via unspecified method.





Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-639
Affected vendors: easytor
Affected products: easytor
CVE-2023-31183 (published 2023-05-08)

 Cybonet PineApp Mail Secure A reflected cross-site scripting (XSS) vulnerability was identified in the product, using an unspecified endpoint.







Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cybonet
Affected products: pineapp_mail_secure
CVE-2023-31184 (published 2023-05-30)
ROZCOM client CWE-798: Use of Hard-coded Credentials
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: rozcom
Affected products: rozcom_client
CVE-2023-31185 (published 2023-05-30)
ROZCOM server framework - Misconfiguration may allow information disclosure via an unspecified request.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: rozcom
Affected products: rozcom_client
CVE-2023-31186 (published 2023-05-30)
Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-204
Affected vendors: avaya
Affected products: ix_workforce_engagement
CVE-2023-31187 (published 2023-05-30)
Avaya IX Workforce Engagement v15.2.7.1195 - CWE-522: Insufficiently Protected Credentials
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: avaya
Affected products: ix_workforce_engagement
CVE-2023-31188 (published 2023-09-06)
Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505', Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506', and Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616'.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: tp-link
Affected products: archer_c50_v3, archer_c50_v3_firmware, archer_c55, archer_c55_firmware
CVE-2023-31189 (published 2024-02-14)
Improper authentication in some Intel(R) Server Product OpenBMC firmware before version egs-1.09 may allow an authenticated user to enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: openbmc, xeon_bronze_3408u, xeon_gold_5403n, xeon_gold_5411n, xeon_gold_5412u, xeon_gold_5415\+, xeon_gold_5416s, xeon_gold_5418n, xeon_gold_5418y, xeon_gold_5420\+, xeon_gold_5423n, xeon_gold_5433n, xeon_gold_6403n, xeon_gold_6414u, xeon_gold_6416h, xeon_gold_6418h, xeon_gold_6421n, xeon_gold_6423n, xeon_gold_6426y, xeon_gold_6428n, xeon_gold_6430, xeon_gold_6433n, xeon_gold_6433ne, xeon_gold_6434, xeon_gold_6434h
CVE-2023-3119 (published 2023-06-06)
A vulnerability, which was classified as critical, has been found in SourceCodester Service Provider Management System 1.0. Affected by this issue is some unknown functionality of the file view.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230798 is the identifier assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: oretnom23
Affected products: service_provider_management_system
CVE-2023-31190 (published 2023-07-11)
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication vulnerability during the firmware update procedure.

Specifically, the firmware update procedure ignores and does not check the validity of the TLS certificate of the HTTPS endpoint from which the firmware update package (.tar.bz2 file) is downloaded.
An attacker with the ability to put himself in a Man-in-the-Middle situation (e.g., DNS poisoning, ARP poisoning, control of a node on the route to the endpoint, etc.) can trick the DroneScout ds230 to install a crafted malicious firmware update containing arbitrary files (e.g., executable and configuration) and gain administrative (root) privileges on the underlying Linux operating system.
This issue affects DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-295
Affected vendors: bluemark
Affected products: dronescout_ds230, dronescout_ds230_firmware
CVE-2023-31191 (published 2023-07-11)
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection.

An attacker can exploit this vulnerability by injecting, on carefully selected channels, high power spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information.

This issue affects the adjacent channel suppression algorithm present in DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-223
Affected vendors: bluemark
Affected products: dronescout_ds230, dronescout_ds230_firmware
CVE-2023-31192 (published 2023-10-12)
An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-457
Affected vendors: softether
Affected products: vpn
CVE-2023-31193 (published 2023-05-22)













Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation.
















Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-319
Affected vendors: snapone
Affected products: orvc
CVE-2023-31194 (published 2023-07-05)
An improper array index validation vulnerability exists in the GraphPlanar::Write functionality of Diagon v1.0.139. A specially crafted markdown file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: diagon_project
Affected products: diagon
CVE-2023-31195 (published 2023-06-13)
ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is in a position to be able to mount a man-in-the-middle attack, and a user is tricked to log into the affected device through an unencrypted ('http') connection, the user's session may be hijacked.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-319
Affected vendors: asus
Affected products: rt-ax3000, rt-ax3000_firmware
CVE-2023-31196 (published 2023-06-13)
Missing authentication for critical function in Wi-Fi AP UNIT allows a remote unauthenticated attacker to obtain sensitive information of the affected products. Affected products and versions are as follows: AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPUM-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B07 and earlier
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-306
Affected vendors: inaba
Affected products: ac-pd-wapu, ac-pd-wapu-p, ac-pd-wapu-p_firmware, ac-pd-wapu_firmware, ac-pd-wapum, ac-pd-wapum-p, ac-pd-wapum-p_firmware, ac-pd-wapum_firmware, ac-wapu-300, ac-wapu-300-p, ac-wapu-300-p_firmware, ac-wapu-300_firmware, ac-wapum-300, ac-wapum-300-p, ac-wapum-300-p_firmware, ac-wapum-300_firmware
CVE-2023-31197 (published 2023-05-12)
Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: intel
Affected products: trace_analyzer_and_collector