deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-31033
Published: 2024-01-12
Description: NVIDIA DGX A100 BMC contains a vulnerability where a user may cause a missing authentication issue for a critical function by an adjacent network . A successful exploit of this vulnerability may lead to escalation of privileges, code execution, denial of service, information disclosure, and data tampering.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5510; https://nvidia.custhelp.com/app/answers/detail/a_id/5510
CVE: CVE-2023-31034
Published: 2024-01-12
Description: NVIDIA DGX A100 SBIOS contains a vulnerability where a local attacker can cause input validation checks to be bypassed by causing an integer overflow. A successful exploit of this vulnerability may lead to denial of service, information disclosure, and data tampering.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5510; https://nvidia.custhelp.com/app/answers/detail/a_id/5510
CVE: CVE-2023-31035
Published: 2024-01-12
Description: NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may cause an SMI callout vulnerability that could be used to execute arbitrary code at the SMM level. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5510; https://nvidia.custhelp.com/app/answers/detail/a_id/5510
CVE: CVE-2023-6683
Published: 2024-01-12
Description: A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/errata/RHSA-2024:2135; https://access.redhat.com/errata/RHSA-2024:2962; https://access.redhat.com/security/cve/CVE-2023-6683
CVE: CVE-2024-0464
Published: 2024-01-12
Description: A vulnerability classified as critical has been found in code-projects Online Faculty Clearance 1.0. This affects an unknown part of the file delete_faculty.php of the component HTTP GET Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250569 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/BxYQ/vul/blob/main/3ONLINE_FACULTY_CLEARANCE_SYSTEM%20has%20SQL4.pdf; https://vuldb.com/?ctiid.250569; https://vuldb.com/?id.250569
CVE: CVE-2024-0465
Published: 2024-01-12
Description: A vulnerability classified as problematic was found in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file download.php. The manipulation of the argument download_file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-250570 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-24
References: https://github.com/BxYQ/vul/blob/main/EMPLOYEE_PROFILE_MANAGEMENT_SYSTEM%20_FileRead.pdf; https://vuldb.com/?ctiid.250570; https://vuldb.com/?id.250570
CVE: CVE-2024-0466
Published: 2024-01-12
Description: A vulnerability, which was classified as critical, has been found in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file file_table.php. The manipulation of the argument per_id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250571.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/BxYQ/vul/blob/main/EMPLOYEE_PROFILE_MANAGEMENT_SYSTEM%20_SQL1.pdf; https://vuldb.com/?ctiid.250571; https://vuldb.com/?id.250571
CVE: CVE-2010-10011
Published: 2024-01-12
Description: A vulnerability, which was classified as problematic, was found in Acritum Femitter Server 1.04. Affected is an unknown function. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250446 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.250446; https://vuldb.com/?id.250446; https://www.exploit-db.com/exploits/15445
CVE: CVE-2024-0467
Published: 2024-01-12
Description: A vulnerability, which was classified as problematic, was found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file edit_position_query.php. The manipulation of the argument pos_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250572.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/BxYQ/vul/blob/main/EMPLOYEE_PROFILE_MANAGEMENT_SYSTEM_Xss.pdf; https://vuldb.com/?ctiid.250572; https://vuldb.com/?id.250572
CVE: CVE-2024-22206
Published: 2024-01-12
Description: Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.

CVSS Score: 9.0 (CRITICAL)
CWE: CWE-284, CWE-287, CWE-639
References: https://clerk.com/changelog/2024-01-12; https://github.com/clerk/javascript/releases/tag/%40clerk%2Fnextjs%404.29.3; https://github.com/clerk/javascript/security/advisories/GHSA-q6w5-jg5q-47vg
CVE: CVE-2023-42463
Published: 2024-01-12
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. This bug introduced a stack overflow hazard that could allow a local privilege escalation. This vulnerability was patched in version 4.5.3.
CVSS Score: 7.4 (HIGH)
CWE: CWE-121
References: https://github.com/wazuh/wazuh/security/advisories/GHSA-27p5-32pp-r58r; https://github.com/wazuh/wazuh/security/advisories/GHSA-27p5-32pp-r58r
CVE: CVE-2023-48297
Published: 2024-01-12
Description: Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.

CVSS Score: 8.6 (HIGH)
CWE: CWE-400
References: https://github.com/discourse/discourse/security/advisories/GHSA-hf2v-r5xm-8p37; https://github.com/discourse/discourse/security/advisories/GHSA-hf2v-r5xm-8p37
CVE: CVE-2023-49098
Published: 2024-01-12
Description: Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://github.com/discourse/discourse-reactions/commit/2c[PII_REDACTED]7730e492640d71aac68423be84fc; https://github.com/discourse/discourse-reactions/security/advisories/GHSA-mq82-7v5x-rhv8; https://github.com/discourse/discourse-reactions/commit/2c[PII_REDACTED]7730e492640d71aac68423be84fc
CVE: CVE-2023-49099
Published: 2024-01-12
Description: Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.
CVSS Score: 3.1 (LOW)
CWE: CWE-284
References: https://github.com/discourse/discourse/commit/1b288236387fc0a823e4f15f1aea8dde81b49d53; https://github.com/discourse/discourse/security/advisories/GHSA-j67x-x6mq-pwv4; https://github.com/discourse/discourse/commit/1b288236387fc0a823e4f15f1aea8dde81b49d53
CVE: CVE-2023-49801
Published: 2024-01-12
Description: Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-22, CWE-23, CWE-22
References: https://github.com/Lif-Platforms/Lif-Auth-Server/commit/c235bcc2ee65e4a0dfb10284cf2cbc750213efeb; https://github.com/Lif-Platforms/Lif-Auth-Server/security/advisories/GHSA-3v77-pvqq-qg3f; https://github.com/Lif-Platforms/Lif-Auth-Server/commit/c235bcc2ee65e4a0dfb10284cf2cbc750213efeb
CVE: CVE-2023-51698
Published: 2024-01-12
Description: Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a maliciously crafted CBT document which is a TAR archive. A patch is available at commit ce41df6.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/mate-desktop/atril/commit/ce41df6467521ff9fd4f16514ae7d6ebb62eb1ed; https://github.com/mate-desktop/atril/security/advisories/GHSA-34rr-j8v9-v4p2; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OT3UIQOSZ6UNH5QTFOOY2DJ4MITM2C2C/
CVE: CVE-2024-0468
Published: 2024-01-12
Description: A vulnerability has been found in code-projects Fighting Cock Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/action/new-father.php. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250573 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/BxYQ/vul/blob/main/FIGHTING_COCK_INFORMATION_SYSTEM_File9docx.pdf; https://vuldb.com/?ctiid.250573; https://vuldb.com/?id.250573
CVE: CVE-2024-0469
Published: 2024-01-12
Description: A vulnerability was found in code-projects Human Resource Integrated System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file update_personal_info.php. The manipulation of the argument sex leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250574 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yingqian1984/FirePunch/blob/main/11-Human%20Resource%20Integrated%20System%20has%20SQL%20injection%20vulnerabilities%20update_personal_info.php.pdf; https://vuldb.com/?ctiid.250574; https://vuldb.com/?id.250574
CVE: CVE-2024-0470
Published: 2024-01-12
Description: A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been classified as critical. This affects an unknown part of the file /admin_route/inc_service_credits.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250575.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yingqian1984/FirePunch/blob/main/11-Human%20Resource%20Integrated%20System%20has%20SQL%20injection%20vulnerabilities%20inc_service_credits.php.pdf; https://vuldb.com/?ctiid.250575; https://vuldb.com/?id.250575
CVE: CVE-2024-0471
Published: 2024-01-12
Description: A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin_route/dec_service_credits.php. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250576.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yingqian1984/FirePunch/blob/main/11-Human%20Resource%20Integrated%20System%20has%20SQL%20injection%20vulnerabilities%20dec_service_credits.php.pdf; https://vuldb.com/?ctiid.250576; https://vuldb.com/?id.250576
CVE: CVE-2024-21654
Published: 2024-01-12
Description: Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287, CWE-306
References: https://github.com/rubygems/rubygems.org/commit/0b3272ac17b45748ee0d1867c49867c7deb26565; https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4v23-vj8h-7jp2; https://github.com/rubygems/rubygems.org/commit/0b3272ac17b45748ee0d1867c49867c7deb26565
CVE: CVE-2024-21655
Published: 2024-01-12
Description: Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/discourse/discourse/security/advisories/GHSA-m5fc-94mm-38fx; https://github.com/discourse/discourse/security/advisories/GHSA-m5fc-94mm-38fx
CVE: CVE-2022-4962
Published: 2024-01-12
Description: A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assigned to this vulnerability. NOTE: The maintainer explains that user data information like user id, name, and email are not sensitive.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/apolloconfig/apollo/issues/4684; https://vuldb.com/?ctiid.250430; https://vuldb.com/?id.250430
CVE: CVE-2023-49647
Published: 2024-01-12
Description: Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://www.zoom.com/en/trust/security-bulletin/ZSB-24001/; https://www.zoom.com/en/trust/security-bulletin/ZSB-24001/
CVE: CVE-2024-0472
Published: 2024-01-12
Description: A vulnerability was found in code-projects Dormitory Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file modifyuser.php. The manipulation of the argument mname leads to information disclosure. The exploit has been disclosed to the public and may be used. The identifier VDB-250577 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-200, CWE-532
References: https://github.com/yingqian1984/FirePunch/blob/main/7-Dormitory%20Management%20System%20has%20Database%20information%20leakage%20modifyuser.php.pdf; https://vuldb.com/?ctiid.250577; https://vuldb.com/?id.250577
CVE: CVE-2024-0473
Published: 2024-01-12
Description: A vulnerability classified as critical has been found in code-projects Dormitory Management System 1.0. Affected is an unknown function of the file comment.php. The manipulation of the argument com leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250578 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yingqian1984/FirePunch/blob/main/7-Dormitory%20Management%20System%20has%20SQL%20injection%20vulnerabilities%20comment.php.pdf; https://vuldb.com/?ctiid.250578; https://vuldb.com/?id.250578
CVE: CVE-2024-21639
Published: 2024-01-12
Description: CEF (Chromium Embedded Framework ) is a simple framework for embedding Chromium-based browsers in other applications. `CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory` does not check the size of the shared memory, which leads to out-of-bounds read outside the sandbox. This vulnerability was patched in commit 1f55d2e.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://github.com/chromiumembedded/cef/commit/1f55d2e12f62cfdfbf9da6968fde2f928982670b; https://github.com/chromiumembedded/cef/security/advisories/GHSA-m375-jw5x-x8mg; https://github.com/chromiumembedded/cef/commit/1f55d2e12f62cfdfbf9da6968fde2f928982670b
CVE: CVE-2023-48166
Published: 2024-01-12
Description: A directory traversal vulnerability in the SOAP Server integrated in Atos Unify OpenScape Voice V10 before V10R3.26.1 allows a remote attacker to view the contents of arbitrary files in the local file system. An unauthenticated attacker might obtain sensitive files that allow for the compromise of the underlying system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://labs.integrity.pt/advisories/cve-2023-48166/; https://networks.unify.com/security/advisories/OBSO-2401-01.pdf; https://labs.integrity.pt/advisories/cve-2023-48166/
CVE: CVE-2024-0230
Published: 2024-01-12
Description: A session management issue was addressed with improved checks. This issue is fixed in Magic Keyboard Firmware Update 2.0.6. An attacker with physical access to the accessory may be able to extract its Bluetooth pairing key and monitor Bluetooth traffic.
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/en-us/120303; https://support.apple.com/en-us/HT214050; https://support.apple.com/kb/HT214050
CVE: CVE-2024-0474
Published: 2024-01-12
Description: A vulnerability classified as critical was found in code-projects Dormitory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250579.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/yingqian1984/FirePunch/blob/main/7-Dormitory%20Management%20System%20has%20SQL%20injection%20vulnerabilities%20login.php.pdf; https://vuldb.com/?ctiid.250579; https://vuldb.com/?id.250579
CVE: CVE-2024-23301
Published: 2024-01-12
Description: Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://github.com/rear/rear/issues/3122; https://github.com/rear/rear/pull/3123; https://lists.debian.org/debian-lts-announce/2024/02/msg00003.html
CVE: CVE-2024-0475
Published: 2024-01-13
Description: A vulnerability, which was classified as critical, has been found in code-projects Dormitory Management System 1.0. Affected by this issue is some unknown functionality of the file modifyuser.php. The manipulation of the argument user_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250580.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yingqian1984/FirePunch/blob/main/7-Dormitory%20Management%20System%20has%20SQL%20injection%20vulnerabilities%20modifyuser.php.pdf; https://vuldb.com/?ctiid.250580; https://vuldb.com/?id.250580
CVE: CVE-2024-22137
Published: 2024-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch Constant Contact Forms by MailMunch allows Stored XSS.This issue affects Constant Contact Forms by MailMunch: from n/a through 2.0.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/constant-contact-forms-by-mailmunch/wordpress-constant-contact-forms-by-mailmunch-plugin-2-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/constant-contact-forms-by-mailmunch/wordpress-constant-contact-forms-by-mailmunch-plugin-2-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-22142
Published: 2024-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Profile Builder Pro allows Reflected XSS.This issue affects Profile Builder Pro: from n/a through 3.10.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/profile-builder-pro/wordpress-profile-builder-pro-plugin-3-10-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profile-builder-pro/wordpress-profile-builder-pro-plugin-3-10-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50072
Published: 2024-01-13
Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ahrixia/CVE-2023-50072; https://github.com/ahrixia/CVE-2023-50072
CVE: CVE-2023-33472
Published: 2024-01-13
Description: An issue was discovered in Scada-LTS v2.7.5.2 build[PII_REDACTED] and before, allows remote attackers with low-level authentication to escalate privileges, execute arbitrary code, and obtain sensitive information via Event Handlers function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://hev0x.github.io/posts/scadalts-cve-2023-33472/; https://hev0x.github.io/posts/scadalts-cve-2023-33472/
CVE: CVE-2023-46942
Published: 2024-01-13
Description: Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://advisory.checkmarx.net/advisory/CVE-2023-46942; https://devhub.checkmarx.com/cve-details/CVE-2023-46942/; https://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5/
CVE: CVE-2023-46943
Published: 2024-01-13
Description: An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://advisory.checkmarx.net/advisory/CVE-2023-46943/; https://devhub.checkmarx.com/cve-details/CVE-2023-46943/; https://advisory.checkmarx.net/advisory/CVE-2023-46943/
CVE: CVE-2023-51804
Published: 2024-01-13
Description: An issue in rymcu forest v.0.02 allows a remote attacker to obtain sensitive information via manipulation of the HTTP body URL in the com.rymcu.forest.web.api.common.UploadController file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/rymcu/forest/issues/149; https://github.com/rymcu/forest/issues/149