deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22786
Published: 2023-05-08
Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt
CVE: CVE-2023-22787
Published: 2023-05-08
Description: An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.
CVSS Score: 7.5 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt
CVE: CVE-2023-22788
Published: 2023-05-08
Description: Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt
CVE: CVE-2023-22789
Published: 2023-05-08
Description: Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt
CVE: CVE-2023-22790
Published: 2023-05-08
Description: Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt
CVE: CVE-2023-22791
Published: 2023-05-08
Description: A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker already possessing valid user credentials on that WLAN can lead to sensitive information being disclosed via the WLAN. The scenarios in which this disclosure of potentially sensitive information can occur are complex and depend on factors that are beyond the control of the attacker.
CVSS Score: 5.4 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt
CVE: CVE-2023-24408
Published: 2023-05-08
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.4 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ecwid-shopping-cart/wordpress-ecwid-ecommerce-shopping-cart-plugin-6-11-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ecwid-shopping-cart/wordpress-ecwid-ecommerce-shopping-cart-plugin-6-11-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28493
Published: 2023-05-08
Description: Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/newsmag/wordpress-newsmag-theme-2-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/newsmag/wordpress-newsmag-theme-2-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29693
Published: 2023-05-08
Description: H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function set_tftp_upgrad.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Stevenbaga/fengsha/blob/main/H3C/GR-1200W/SetTftpUpgrad.md; https://github.com/Stevenbaga/fengsha/blob/main/H3C/GR-1200W/SetTftpUpgrad.md
CVE: CVE-2023-29696
Published: 2023-05-08
Description: H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function version_set.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Stevenbaga/fengsha/blob/main/H3C/GR-1200W/aVersionSet.md; https://github.com/Stevenbaga/fengsha/blob/main/H3C/GR-1200W/aVersionSet.md
CVE: CVE-2023-30019
Published: 2023-05-08
Description: imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://breakandpray.com/cve-2023-30019-ssrf-in-imgproxy/; https://github.com/imgproxy/imgproxy; https://breakandpray.com/cve-2023-30019-ssrf-in-imgproxy/
CVE: CVE-2023-30092
Published: 2023-05-08
Description: SourceCodester Online Pizza Ordering System v1.0 is vulnerable to SQL Injection via the QTY parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/nawed20002/CVE-2023-30092; https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html; https://github.com/nawed20002/CVE-2023-30092
CVE: CVE-2023-30551
Published: 2023-05-08
Description: Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48; https://github.com/sigstore/rekor/releases/tag/v1.1.1; https://github.com/sigstore/rekor/security/advisories/GHSA-2h5h-59f5-c5x9
CVE: CVE-2023-1979
Published: 2023-05-08
Description: The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly protected content. We recommend upgrading to version 1.32 or beyond commit  ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 

CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68; https://github.com/GoogleForCreators/web-stories-wp/releases/tag/v1.32.0; https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68
CVE: CVE-2023-2583
Published: 2023-05-08
Description: Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://github.com/jsreport/jsreport/commit/afaff3804b34b38e959f5ae65f9e672088de13d7; https://huntr.dev/bounties/397ea68d-1e28-44ff-b830-c8883d067d96; https://github.com/jsreport/jsreport/commit/afaff3804b34b38e959f5ae65f9e672088de13d7
CVE: CVE-2023-30837
Published: 2023-05-08
Description: Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.

CVSS Score: 7.5 (HIGH)
CWE: CWE-789
References: https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb; https://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6; https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb
CVE: CVE-2023-30840
Published: 2023-05-08
Description: Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in version 0.7.0 and prior to version 0.8.6, if a malicious user gains control of a Kubernetes node running fluid csi pod (controlled by the `csi-nodeplugin-fluid` node-daemonset), they can leverage the fluid-csi service account to modify specs of all the nodes in the cluster. However, since this service account lacks `list node` permissions, the attacker may need to use other techniques to identify vulnerable nodes.

Once the attacker identifies and modifies the node specs, they can manipulate system-level-privileged components to access all secrets in the cluster or execute pods on other nodes. This allows them to elevate privileges beyond the compromised node and potentially gain full privileged access to the whole cluster.

To exploit this vulnerability, the attacker can make all other nodes unschedulable (for example, patch node with taints) and wait for system-critical components with high privilege to appear on the compromised node. However, this attack requires two prerequisites: a compromised node and identifying all vulnerable nodes through other means.

Version 0.8.6 contains a patch for this issue. As a workaround, delete the `csi-nodeplugin-fluid` daemonset in `fluid-system` namespace and avoid using CSI mode to mount FUSE file systems. Alternatively, using sidecar mode to mount FUSE file systems is recommended.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-863
References: https://github.com/fluid-cloudnative/fluid/commit/77c8110a3d1ec077ae2bce6bd88d296505db1550; https://github.com/fluid-cloudnative/fluid/commit/91c05c32db131997b5ca065e869c9918a125c149; https://github.com/fluid-cloudnative/fluid/releases/tag/v0.8.6
CVE: CVE-2023-30844
Published: 2023-05-08
Description: Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints.  This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk.
CVSS Score: 3.0 (LOW)
CWE: CWE-150, CWE-116
References: https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6; https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1; https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2
CVE: CVE-2023-30855
Published: 2023-05-08
Description: Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this path traversal and arbitrary extension is limited to creation of arbitrary files and appending data to existing files. When combined with the SQL Injection, the exported data `RESTRICTED DIFFUSION 9 / 9` can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver. Users may upgrade to version 10.5.18 to receive a patch or, as a workaround, apply the patch manually.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e.patch; https://github.com/pimcore/pimcore/pull/14498; https://github.com/pimcore/pimcore/security/advisories/GHSA-g2mc-fqqc-hxg3
CVE: CVE-2023-30860
Published: 2023-05-08
Description: WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert malicious scripts. Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts. Version 12.4 contains a patch for this issue.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/WWBN/AVideo/security/advisories/GHSA-xr9h-p2rc-rpqm; https://youtu.be/Nke0Bmv5F-o; https://github.com/WWBN/AVideo/security/advisories/GHSA-xr9h-p2rc-rpqm
CVE: CVE-2022-22645
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-22649
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-26689
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-26692
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-26705
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-26729
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-26732
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-26733
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-26734
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-26735
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32779
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32791
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32804
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32806
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32808
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32809
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32822
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32850
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32856
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32873
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32874
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32878
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32884
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32885
Published: 2023-05-08
Description: A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213341; https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213346
CVE: CVE-2022-32901
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32921
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-32930
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-42794
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-42802
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-42804
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-42822
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-42835
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-42857
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-46707
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-46708
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-46719
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-46720
Published: 2023-05-08
Description: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to break out of its sandbox
CVSS Score: 8.6 (HIGH)
CWE: CWE-190, CWE-190
References: https://support.apple.com/en-us/HT213530; https://support.apple.com/en-us/HT213532; https://support.apple.com/en-us/HT213530
CVE: CVE-2022-46727
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-46728
Published: 2023-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2023-1031
Published: 2023-05-08
Description: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `settings` endpoint and first_name parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://fluidattacks.com/advisories/napoli; https://www.monicahq.com/; https://fluidattacks.com/advisories/napoli
CVE: CVE-2023-1094
Published: 2023-05-08
Description: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://fluidattacks.com/advisories/napoli; https://www.monicahq.com/; https://fluidattacks.com/advisories/napoli