deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-7092
Published: 2023-12-24
Description: A vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /boaform/wlan_basic_set.cgi of the component Admin Web Interface. The manipulation of the argument wlanssid/password leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248939. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://drive.google.com/file/d/15Wr3EL4cpAS_H_Vp7TuIftssxAuzb4SL/view; https://vuldb.com/?ctiid.248939; https://vuldb.com/?id.248939
CVE: CVE-2023-7093
Published: 2023-12-25
Description: A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py of the component com.kylin.systemupgrade Service. The manipulation of the argument SetDownloadspeedMax leads to os command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248940. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://note.zhaoj.in/share/L1hGe9BDlbnt; https://vuldb.com/?ctiid.248940; https://vuldb.com/?id.248940
CVE: CVE-2023-7094
Published: 2023-12-25
Description: A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://vuldb.com/?ctiid.248941; https://vuldb.com/?id.248941; https://www.yuque.com/wangjie-0l1rh/prbq8b/iyxa0t8rntyve4s0?singleDoc#%20%E3%80%8AThe%20information%20disclosure%20vulnerability%20in%20the%20Netentsec%20NS-ASG%20Application%20Security%20Gateway%E3%80%8B
CVE: CVE-2023-7095
Published: 2023-12-25
Description: A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/unpWn4bL3/iot-security/blob/main/2.md; https://vuldb.com/?ctiid.248942; https://vuldb.com/?id.248942
CVE: CVE-2023-7096
Published: 2023-12-25
Description: A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipulation of the argument fieldname/tablename causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Glunko/vulnerability/blob/main/Faculty-Management-System_sql.md; https://vuldb.com/?ctiid.248948
CVE: CVE-2023-7097
Published: 2023-12-25
Description: A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248949 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Glunko/vulnerability/blob/main/Water-Billing-System_sql.md; https://vuldb.com/?ctiid.248949; https://vuldb.com/?id.248949
CVE: CVE-2023-7098
Published: 2023-12-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects unknown code of the file app/hide.php. The manipulation of the argument key leads to path traversal: '../filedir'. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-248950 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.1 (LOW)
CWE: CWE-24
References: https://note.zhaoj.in/share/MHnV2WLY9rxU; https://vuldb.com/?ctiid.248950; https://vuldb.com/?id.248950
CVE: CVE-2021-38927
Published: 2023-12-25
Description: IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  210322.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210322; https://www.ibm.com/support/pages/node/7101252; https://exchange.xforce.ibmcloud.com/vulnerabilities/210322
CVE: CVE-2023-43064
Published: 2023-12-25
Description: Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call.  A malicious actor could cause arbitrary code to run with the privilege of the user invoking the facsimile support.  IBM X-Force ID:  267689.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267689; https://www.ibm.com/support/pages/node/7101330; https://exchange.xforce.ibmcloud.com/vulnerabilities/267689
CVE: CVE-2023-49880
Published: 2023-12-25
Description: In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN messages are assumed to be immutable. However, an attacker might modify these elements of a business transaction.  IBM X-Force ID:  273183.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/273183; https://www.ibm.com/support/pages/node/7101167; https://exchange.xforce.ibmcloud.com/vulnerabilities/273183
CVE: CVE-2023-7099
Published: 2023-12-25
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file bwdates-report-result.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248951.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/laoquanshi/heishou/blob/main/niv%20-SQL; https://github.com/laoquanshi/heishou/blob/main/sqlmap.png; https://vuldb.com/?ctiid.248951
CVE: CVE-2023-7100
Published: 2023-12-25
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate/tdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://medium.com/@[PII_REDACTED]ljk/restaurant-table-booking-system-sql-injection-vulnerability-30708cfabe03; https://phpgurukul.com/; https://vuldb.com/?ctiid.248952
CVE: CVE-2023-30451
Published: 2023-12-25
Description: In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html; http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html
CVE: CVE-2023-51771
Published: 2023-12-25
Description: In MicroHttpServer (aka Micro HTTP Server) through a8ab029, _ParseHeader in lib/server.c allows a one-byte recv buffer overflow via a long URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/starnight/MicroHttpServer/issues/8; https://github.com/starnight/MicroHttpServer/tree/a8ab029c9a26a4c9f26b9d8a2757b8299aaff120; https://github.com/starnight/MicroHttpServer/issues/8
CVE: CVE-2022-39818
Published: 2023-12-25
Description: In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter. This allows authenticated users to execute commands, with root privileges, on the operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-39820
Published: 2023-12-25
Description: In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KECustom_199/OTNE_DRC/RestUploadManager.xml. A remote user, authenticated to the operating system, with access privileges to the directory /root or /DEPOT, is able to read cleartext credentials to access the web portal NFM-T and control all the PPS Network elements.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-39822
Published: 2023-12-25
Description: In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-41760
Published: 2023-12-25
Description: An issue was discovered in NOKIA NFM-T R19.9. Relative Path Traversal can occur under /oms1350/data/cpb/log of the Network Element Manager via the filename parameter, allowing a remote authenticated attacker to read arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-41761
Published: 2023-12-25
Description: An issue was discovered in NOKIA NFM-T R19.9. An Absolute Path Traversal vulnerability exists under /cgi-bin/R19.9/viewlog.pl of the VM Manager WebUI via the logfile parameter, allowing a remote authenticated attacker to read arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-41762
Published: 2023-12-25
Description: An issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the Network Element Manager via any parameter to log.pl, the bench or pid parameter to top.pl, or the id parameter to easy1350.pl.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-43675
Published: 2023-12-25
Description: An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename parameter, under /oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay via the id parameter, and under /oms1350/pages/otn/mainOtn via all parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.gruppotim.it/redteam; https://www.gruppotim.it/redteam
CVE: CVE-2023-31289
Published: 2023-12-25
Description: Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2023-31455
Published: 2023-12-25
Description: Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2023-37225
Published: 2023-12-25
Description: Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2023-40236
Published: 2023-12-25
Description: In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2023-48654
Published: 2023-12-25
Description: One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: go to the Google ReCAPTCHA section, click on the Privacy link, observe that there is a new browser window, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.
CVSS Score: 9.8 (CRITICAL)
References: https://sec-consult.com/vulnerability-lab/advisory/kiosk-escape-privilege-escalation-one-identity-password-manager-secure-password-extension/; https://www.oneidentity.com/products/password-manager/; http://seclists.org/fulldisclosure/2023/Dec/17
CVE: CVE-2023-49328
Published: 2023-12-25
Description: On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2023-51772
Published: 2023-12-25
Description: One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: wait for a session timeout, click on the Help icon, observe that there is a browser window for the One Identity website, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613, CWE-613
References: https://sec-consult.com/vulnerability-lab/advisory/kiosk-escape-privilege-escalation-one-identity-password-manager-secure-password-extension/; https://www.oneidentity.com/products/password-manager/; https://sec-consult.com/vulnerability-lab/advisory/kiosk-escape-privilege-escalation-one-identity-password-manager-secure-password-extension/
CVE: CVE-2023-28872
Published: 2023-12-25
Description: Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%\Temp\NcpSupport* location.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://herolab.usd.de/en/security-advisories/usd-2022-0006/; https://herolab.usd.de/en/security-advisories/usd-2022-0006/
CVE: CVE-2023-31297
Published: 2023-12-25
Description: An issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718. There is XSS via the Name field when modifying a client.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://herolab.usd.de/en/security-advisories/usd-2022-0058/; https://herolab.usd.de/security-advisories/; https://herolab.usd.de/en/security-advisories/usd-2022-0058/
CVE: CVE-2023-37185
Published: 2023-12-25
Description: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5; https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3; https://github.com/Blosc/c-blosc2/issues/519
CVE: CVE-2023-37186
Published: 2023-12-25
Description: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/Blosc/c-blosc2/commit/d55bfcd6804699e1435dc3e233fd76c8a5d3f9e3; https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3; https://github.com/Blosc/c-blosc2/issues/522
CVE: CVE-2023-37187
Published: 2023-12-25
Description: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5; https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3; https://github.com/Blosc/c-blosc2/issues/520
CVE: CVE-2023-37188
Published: 2023-12-25
Description: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5; https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3; https://github.com/Blosc/c-blosc2/issues/521
CVE: CVE-2023-47091
Published: 2023-12-25
Description: An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2023-024/; https://advisories.stormshield.eu
CVE: CVE-2023-47247
Published: 2023-12-25
Description: In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102.
CVSS Score: 4.3 (MEDIUM)
References: https://documentation.sysaid.com/docs/23334; https://documentation.sysaid.com/docs/23334
CVE: CVE-2022-34267
Published: 2023-12-25
Description: An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.rws.com/localization/products/trados-enterprise/worldserver/; https://www.triskelelabs.com/vulnerabilities-in-rws-worldserver; https://www.rws.com/localization/products/trados-enterprise/worldserver/
CVE: CVE-2022-34268
Published: 2023-12-25
Description: An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.rws.com/localization/products/trados-enterprise/worldserver/; https://www.triskelelabs.com/vulnerabilities-in-rws-worldserver; https://www.rws.com/localization/products/trados-enterprise/worldserver/
CVE: CVE-2023-31224
Published: 2023-12-25
Description: There is broken access control during authentication in Jamf Pro Server before 10.46.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://learn.jamf.com/bundle/jamf-pro-release-notes-10.47.0/page/Resolved_Issues.html; https://learn.jamf.com/bundle/jamf-pro-release-notes-10.47.0/page/Resolved_Issues.html
CVE: CVE-2023-36485
Published: 2023-12-25
Description: The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file.
CVSS Score: 7.2 (HIGH)
References: https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=xd:kx:54&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=3439&prvm=fsc&bmn=2023-12&blpg=786; https://github.com/ILIAS-eLearning/ILIAS/pull/5987; https://github.com/ILIAS-eLearning/ILIAS/pull/5988
CVE: CVE-2023-36486
Published: 2023-12-25
Description: The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.
CVSS Score: 7.2 (HIGH)
References: https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=xd:kx:54&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=3439&prvm=fsc&bmn=2023-12&blpg=786; https://github.com/ILIAS-eLearning/ILIAS/pull/5987; https://github.com/ILIAS-eLearning/ILIAS/pull/5988
CVE: CVE-2023-38826
Published: 2023-12-25
Description: A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Oracle-Security/CVEs/tree/main/Follett%20Learning%20Solutions/Destiny/CVE-2023-38826; https://www.follettlearning.com/; https://github.com/Oracle-Security/CVEs/tree/main/Follett%20Learning%20Solutions/Destiny/CVE-2023-38826
CVE: CVE-2023-48652
Published: 2023-12-25
Description: Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes; https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates; https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes
CVE: CVE-2023-49226
Published: 2023-12-25
Description: An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4; https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf; https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4
CVE: CVE-2023-49944
Published: 2023-12-25
Description: The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature.
CVSS Score: 6.7 (MEDIUM)
References: https://www.beyondtrust.com/security; https://www.beyondtrust.com/trust-center/security-advisories/bt23-08; https://www.beyondtrust.com/security