deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27487
Published: 2023-04-04
Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-path` should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header would then be used for trace logs and grpc logs, as well as used in the URL used for `jwt_authn` checks if the `jwt_authn` filter is used, and any other upstream use of the x-envoy-original-path header. Attackers may forge a trusted `x-envoy-original-path` header. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 have patches for this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-5375-pq35-hf2g; https://github.com/envoyproxy/envoy/security/advisories/GHSA-5375-pq35-hf2g
CVE: CVE-2023-28613
Published: 2023-04-04
Description: An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300. An integer overflow in IPv4 fragment handling can occur due to insufficient parameter validation when reassembling these fragments.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-190, CWE-190
References: http://packetstormsecurity.com/files/172177/Shannon-Baseband-Integer-Overflow.html; https://semiconductor.samsung.com/processor/mobile-processor/; https://semiconductor.samsung.com/processor/modem/
CVE: CVE-2023-1748
Published: 2023-04-04
Description: The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-798
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01
CVE: CVE-2023-1749
Published: 2023-04-04
Description: The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01
CVE: CVE-2023-1750
Published: 2023-04-04
Description: The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could retrieve device history, set device settings, and retrieve device information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-639
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01
CVE: CVE-2023-1751
Published: 2023-04-04
Description: The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which leak a deviceId.
CVSS Score: 7.5 (HIGH)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01
CVE: CVE-2023-1752
Published: 2023-04-04
Description: The listed versions of Nexx Smart Home devices could allow any user to register an already registered alarm or associated device with only the device’s MAC address.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01
CVE: CVE-2023-27089
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://gitee.com/ehuacui/ehuacui-bbs/issues/I6GDCB; https://github.com/ehuacui/ehuacui-bbs/issues/3; https://gitee.com/ehuacui/ehuacui-bbs/issues/I6GDCB
CVE: CVE-2023-27091
Published: 2023-04-04
Description: An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s).
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: https://gitee.com/xiaobingby/TeaCMS/issues/I6GDRU; https://gitee.com/xiaobingby/TeaCMS/issues/I6SXAF; https://gitee.com/xiaobingby/TeaCMS/issues/I6GDRU
CVE: CVE-2023-27488
Published: 2023-04-04
Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components that are used for logging and/or visibility, requests may not be logged by the receiving service.

When Envoy was configured to use ext_authz, ext_proc, tap, ratelimit filters, and grpc access log service and an http header with non-UTF-8 data was received, Envoy would generate an invalid protobuf message and send it to the configured service. The receiving service would typically generate an error when decoding the protobuf message. For ext_authz that was configured with ``failure_mode_allow: true``, the request would have been allowed in this case. For the other services, this could have resulted in other unforeseen errors such as a lack of visibility into requests. 

As of versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy by default sanitizes the values sent in gRPC service calls to be valid UTF-8, replacing data that is not valid UTF-8 with a `!` character. This behavioral change can be temporarily reverted by setting runtime guard `envoy.reloadable_features.service_sanitize_non_utf8_strings` to false. As a workaround, one may set `failure_mode_allow: false` for `ext_authz`.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph; https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph
CVE: CVE-2023-27491
Published: 2023-04-04
Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-444
References: https://datatracker.ietf.org/doc/html/rfc9113#section-8.3; https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1; https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp
CVE: CVE-2023-27492
Published: 2023-04-04
Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua filter is vulnerable to denial of service. Attackers can send large request bodies for routes that have Lua filter enabled and trigger crashes.

As of versions versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy no longer invokes the Lua coroutine if the filter has been reset. As a workaround for those whose Lua filter is buffering all requests/ responses, mitigate by using the buffer filter to avoid triggering the local reply in the Lua filter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-770
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-wpc2-2jp6-ppg2; https://github.com/envoyproxy/envoy/security/advisories/GHSA-wpc2-2jp6-ppg2
CVE: CVE-2023-1840
Published: 2023-04-04
Description: The Sp*tify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.07 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2893653%40spotify-play-button-for-wordpress%2Ftrunk&old=2870608%40spotify-play-button-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/308f6887-7c1c-4efd-85e2-b71bb6d26dab?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2893653%40spotify-play-button-for-wordpress%2Ftrunk&old=2870608%40spotify-play-button-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-27493
Published: 2023-04-04
Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-444
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5w5-487h-qv8q; https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5w5-487h-qv8q
CVE: CVE-2023-27496
Published: 2023-04-04
Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a `state` query param is present on any response that looks like an OAuth redirect response. Sending it a request with the URI path equivalent to the redirect path, without the `state` parameter, will lead to abnormal termination of Envoy process. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. The issue can also be mitigated by locking down OAuth traffic, disabling the filter, or by filtering traffic before it reaches the OAuth filter (e.g. via a lua script). 

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-j79q-2g66-2xv5; https://github.com/envoyproxy/envoy/security/advisories/GHSA-j79q-2g66-2xv5
CVE: CVE-2023-0265
Published: 2023-04-04
Description: Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://fluidattacks.com/advisories/supply/; https://github.com/uvdesk/community-skeleton; https://fluidattacks.com/advisories/supply/
CVE: CVE-2023-0325
Published: 2023-04-04
Description: Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/labrinth/; https://github.com/uvdesk/community-skeleton/; https://fluidattacks.com/advisories/labrinth/
CVE: CVE-2023-1810
Published: 2023-04-04
Description: Heap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1414018; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1811
Published: 2023-04-04
Description: Use after free in Frames in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1420510; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1812
Published: 2023-04-04
Description: Out of bounds memory access in DOM Bindings in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1418224; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1813
Published: 2023-04-04
Description: Inappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1423258; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1814
Published: 2023-04-04
Description: Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass download checking via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1417325; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1815
Published: 2023-04-04
Description: Use after free in Networking APIs in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1278708; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1816
Published: 2023-04-04
Description: Incorrect security UI in Picture In Picture in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially perform navigation spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1413919; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1817
Published: 2023-04-04
Description: Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1418061; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1818
Published: 2023-04-04
Description: Use after free in Vulkan in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1223346; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1819
Published: 2023-04-04
Description: Out of bounds read in Accessibility in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1406588; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1820
Published: 2023-04-04
Description: Heap buffer overflow in Browser History in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1408120; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1821
Published: 2023-04-04
Description: Inappropriate implementation in WebShare in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1413618; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1822
Published: 2023-04-04
Description: Incorrect security UI in Navigation in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1066555; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1823
Published: 2023-04-04
Description: Inappropriate implementation in FedCM in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html; https://crbug.com/1406900; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-28853
Published: 2023-04-04
Description: Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform LDAP injection attack to leak arbitrary attributes from LDAP database. This issue is fixed in versions 3.5.8, 4.0.4, and 4.1.2.
CVSS Score: 7.7 (HIGH)
CWE: CWE-90, CWE-74
References: http://www.openwall.com/lists/oss-security/2023/07/06/6; https://github.com/mastodon/mastodon/blob/94cbd808b5b3e7999c7e77dc724b7e8c9dd2bdec/app/models/concerns/ldap_authenticable.rb#L7-L14; https://github.com/mastodon/mastodon/blob/94cbd808b5b3e7999c7e77dc724b7e8c9dd2bdec/config/initializers/devise.rb#L398-L414
CVE: CVE-2023-29003
Published: 2023-04-04
Description: SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods.

SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. While the implementation does a sufficient job in mitigating common CSRF attacks, prior to version 1.15.1, the protection can be bypassed by simply specifying a different `Content-Type` header value.

If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts.

SvelteKit 1.15.1 updates the `is_form_content_type` function call in the CSRF protection logic to include `text/plain`. As additional hardening of the CSRF protection mechanism against potential method overrides, SvelteKit 1.15.1 is now performing validation on `PUT`, `PATCH` and `DELETE` methods as well. This latter hardening is only needed to protect users who have put in some sort of `?_method= override` feature themselves in their `handle` hook, so that the request that resolve sees could be `PUT`/`PATCH`/`DELETE` when the browser issues a `POST` request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-184, CWE-352, CWE-352
References: https://github.com/sveltejs/kit/commit/bb2253d51d00aba2e4353952d4fb0dcde6c77123; https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%401.15.1; https://github.com/sveltejs/kit/security/advisories/GHSA-5p75-vc5g-8rv2
CVE: CVE-2023-0357
Published: 2023-04-04
Description: Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. This is possible because the application does not correctly validate the attachments sent by customers in the ticket.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/quayle/; https://github.com/helpyio/helpy/; https://fluidattacks.com/advisories/quayle/
CVE: CVE-2023-0480
Published: 2023-04-04
Description: VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account. This is possible because the application is vulnerable to CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://fluidattacks.com/advisories/sharp/; https://vitalpbx.com/; https://fluidattacks.com/advisories/sharp/
CVE: CVE-2023-0486
Published: 2023-04-04
Description: VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. This is possible because the application is vulnerable to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/smith/; https://vitalpbx.com/; https://fluidattacks.com/advisories/smith/
CVE: CVE-2023-0738
Published: 2023-04-04
Description: OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/eilish/; https://github.com/Orangescrum/orangescrum/; https://fluidattacks.com/advisories/eilish/