deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-46760
Published: 2023-11-08
Description: Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46761
Published: 2023-11-08
Description: Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46762
Published: 2023-11-08
Description: Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46763
Published: 2023-11-08
Description: Vulnerability of background app permission management in the framework module. Successful exploitation of this vulnerability may cause background apps to start maliciously.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46764
Published: 2023-11-08
Description: Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliciously.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-15
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46765
Published: 2023-11-08
Description: Vulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46766
Published: 2023-11-08
Description: Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46767
Published: 2023-11-08
Description: Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46772
Published: 2023-11-08
Description: Vulnerability of parameters being out of the value range in the QMI service module. Successful exploitation of this vulnerability may cause errors in reading file data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46774
Published: 2023-11-08
Description: Vulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46756
Published: 2023-11-08
Description: Permission control vulnerability in the window management module. Successful exploitation of this vulnerability may cause malicious pop-up windows.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46757
Published: 2023-11-08
Description: The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46758
Published: 2023-11-08
Description: Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269, CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46759
Published: 2023-11-08
Description: Permission control vulnerability in the call module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-6012
Published: 2023-11-08
Description: An improper input validation vulnerability has been found in Lanaccess ONSAFE MonitorHM affecting version 3.7.0. This vulnerability could lead a remote attacker to exploit the checkbox element and perform remote code execution, compromising the entire infrastructure.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20
References: https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-data-validation-lanaccess-onsafe-monitorhm-web-console; https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-data-validation-lanaccess-onsafe-monitorhm-web-console
CVE: CVE-2023-32298
Published: 2023-11-08
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kathy Darling Simple User Listing plugin <= 1.9.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-user-listing/wordpress-simple-user-listing-plugin-1-9-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-user-listing/wordpress-simple-user-listing-plugin-1-9-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-35767
Published: 2023-11-08
Description: In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified.  Reported by Jason Geffner.  

CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://perforce.com; https://perforce.com
CVE: CVE-2023-45140
Published: 2023-11-08
Description: The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-306
References: https://github.com/ovh/the-bastion/releases/tag/v3.14.15; https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x; https://github.com/ovh/the-bastion/releases/tag/v3.14.15
CVE: CVE-2023-45319
Published: 2023-11-08
Description: In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified.  Reported by Jason Geffner. 

CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://perforce.com; https://perforce.com
CVE: CVE-2023-45849
Published: 2023-11-08
Description: An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2.  Reported by Jason Geffner.

CVSS Score: 9.0 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://perforce.com; https://perforce.com
CVE: CVE-2023-46613
Published: 2023-11-08
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Jens Kuerschner Add to Calendar Button plugin <= 1.5.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/add-to-calendar-button/wordpress-add-to-calendar-button-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/add-to-calendar-button/wordpress-add-to-calendar-button-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46621
Published: 2023-11-08
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin <= 1.4.11 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/user-avatar/wordpress-user-avatar-plugin-1-4-11-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/user-avatar/wordpress-user-avatar-plugin-1-4-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46626
Published: 2023-11-08
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FLOWFACT WP Connector plugin <= 2.1.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/flowfact-wp-connector/wordpress-flowfact-wp-connector-plugin-2-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/flowfact-wp-connector/wordpress-flowfact-wp-connector-plugin-2-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46627
Published: 2023-11-08
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-simple-html-sitemap/wordpress-wordpress-simple-html-sitemap-plugin-2-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/wp-simple-html-sitemap/wordpress-wordpress-simple-html-sitemap-plugin-2-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-46640
Published: 2023-11-08
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in D. Relton Medialist plugin <= 1.3.9 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/media-list/wordpress-medialist-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/media-list/wordpress-medialist-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47107
Published: 2023-11-08
Description: PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to PILOS users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. This only affects local user accounts and requires the password reset option to be enabled. This issue has been patched in version 2.3.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-640, CWE-640
References: https://github.com/THM-Health/PILOS/security/advisories/GHSA-mc6f-fj9h-5735; https://github.com/THM-Health/PILOS/security/advisories/GHSA-mc6f-fj9h-5735
CVE: CVE-2023-47397
Published: 2023-11-08
Description: WeBid <=1.2.2 is vulnerable to code injection via admin/categoriestrans.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://liotree.github.io/2023/webid.html; https://liotree.github.io/2023/webid.html
CVE: CVE-2023-5136
Published: 2023-11-08
Description: An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure.  An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-732
References: https://www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html; https://www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html
CVE: CVE-2023-5759
Published: 2023-11-08
Description: In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified.  Reported by Jason Geffner.  

CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://perforce.com; https://perforce.com
CVE: CVE-2023-46642
Published: 2023-11-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin <= 1.2.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sahu-tiktok-pixel/wordpress-sahu-tiktok-pixel-for-e-commerce-plugin-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sahu-tiktok-pixel/wordpress-sahu-tiktok-pixel-for-e-commerce-plugin-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46643
Published: 2023-11-08
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GARY JEZORSKI CloudNet360 plugin <= 3.2.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cloudnet-sync/wordpress-cloudnet360-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cloudnet-sync/wordpress-cloudnet360-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47379
Published: 2023-11-08
Description: Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/blob/master/CHANGELOG.md; https://github.com/microweber/microweber/commit/c6e7ea9d0abd7564a3bb23c14ad172e4ccf27a7e#diff-fac4e7e9eca69c10d074bf8c5eac7f64b018c6b4d91dcad54b340a8560049e00; https://www.getastra.com/blog/security-audit/stored-xss-vulnerability/
CVE: CVE-2023-5760
Published: 2023-11-08
Description: A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability which can be further exploited, allowing an attacker to gain full local privilege escalation on the system.This issue affects Avast/Avg Antivirus: 23.8.


CVSS Score: 8.2 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.norton.com/sp/static/external/tools/security-advisories.html; https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE: CVE-2023-5913
Published: 2023-11-08
Description: Incorrect Privilege Assignment vulnerability in opentext Fortify ScanCentral DAST. The vulnerability could be exploited to gain elevated privileges.This issue affects Fortify ScanCentral DAST versions 21.1, 21.2, 21.2.1, 22.1, 22.1.1, 22.2, 23.1.


CVSS Score: 8.2 (HIGH)
CWE: CWE-266, CWE-266
References: https://portal.microfocus.com/s/article/KM000023500?language=en_US; https://portal.microfocus.com/s/article/KM000023500?language=en_US
CVE: CVE-2023-3282
Published: 2023-11-08
Description: A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local attacker to execute programs with elevated privileges if the attacker has shell access to the engine.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://security.paloaltonetworks.com/CVE-2023-3282; https://security.paloaltonetworks.com/CVE-2023-3282
CVE: CVE-2023-47181
Published: 2023-11-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson IdeaPush plugin <= 8.52 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ideapush/wordpress-ideapush-plugin-8-46-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ideapush/wordpress-ideapush-plugin-8-46-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47190
Published: 2023-11-08
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin <= 1.9.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/apollo13-framework-extensions/wordpress-apollo13-framework-extensions-plugin-1-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/apollo13-framework-extensions/wordpress-apollo13-framework-extensions-plugin-1-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47223
Published: 2023-11-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Map Plugins Basic Interactive World Map plugin <= 2.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/basic-interactive-world-map/wordpress-basic-interactive-world-map-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/basic-interactive-world-map/wordpress-basic-interactive-world-map-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47226
Published: 2023-11-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin <= 1.0.20 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/post-slider-carousel/wordpress-post-sliders-post-grids-plugin-1-0-20-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/post-slider-carousel/wordpress-post-sliders-post-grids-plugin-1-0-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47227
Published: 2023-11-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Social Feed | All social media in one place plugin <= 1.5.4.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/add-facebook/wordpress-social-feed-all-social-media-in-one-place-plugin-1-5-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/add-facebook/wordpress-social-feed-all-social-media-in-one-place-plugin-1-5-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47228
Published: 2023-11-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/slider-slideshow/wordpress-layer-slider-plugin-1-1-9-7-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/slider-slideshow/wordpress-layer-slider-plugin-1-1-9-7-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-47229
Published: 2023-11-08
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vyas Dipen Top 25 Social Icons plugin <= 3.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/top-25-social-icons/wordpress-top-25-social-icons-plugin-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/top-25-social-icons/wordpress-top-25-social-icons-plugin-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47231
Published: 2023-11-08
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bainternet ShortCodes UI plugin <= 1.9.8 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/shortcodes-ui/wordpress-shortcodes-ui-plugin-1-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shortcodes-ui/wordpress-shortcodes-ui-plugin-1-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26221
Published: 2023-11-08
Description: The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2023-5996
Published: 2023-11-08
Description: Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop.html; https://crbug.com/1497859; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MHLJRFWZNY6BFOW25Q4FEESVWZKS4C2/
CVE: CVE-2023-0392
Published: 2023-11-08
Description: The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428, CWE-428, CWE-428
References: https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392; https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392
CVE: CVE-2023-29974
Published: 2023-11-08
Description: An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://www.esecforte.com/cve-2023-29974-weak-password-policy/; https://www.esecforte.com/cve-2023-29974-weak-password-policy/
CVE: CVE-2023-45857
Published: 2023-11-08
Description: An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/axios/axios/issues/6006; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/axios/axios/issues/6006