deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39073
Published: 2023-09-12
Description: An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://gist.github.com/ph4nt0mbyt3/9456312e867c10de8f808250ec0b12d3; https://gist.github.com/ph4nt0mbyt3/9456312e867c10de8f808250ec0b12d3
CVE: CVE-2023-41423
Published: 2023-09-12
Description: Cross Site Scripting vulnerability in WP Githuber MD plugin v.1.16.2 allows a remote attacker to execute arbitrary code via a crafted payload to the new article function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/terrylinooo/githuber-md/issues/316; https://github.com/terrylinooo/githuber-md/issues/316
CVE: CVE-2023-4813
Published: 2023-09-12
Description: A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/errata/RHBA-2024:2413; https://access.redhat.com/errata/RHSA-2023:5453; https://access.redhat.com/errata/RHSA-2023:5455
CVE: CVE-2023-4928
Published: 2023-09-13
Description:  SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/instantsoft/icms2/commit/3a6b148fa2c943ee7647e0cd14bf68e026b15548; https://huntr.dev/bounties/cb72cc17-5a0d-4392-9a5f-a13aa773de9e; https://github.com/instantsoft/icms2/commit/3a6b148fa2c943ee7647e0cd14bf68e026b15548
CVE: CVE-2023-4153
Published: 2023-09-13
Description: The BAN Users plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.5.3 due to a missing capability check on the 'w3dev_save_ban_user_settings_callback' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify the plugin settings to access the ban and unban functionality and set the role of the unbanned user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://plugins.trac.wordpress.org/browser/ban-users/tags/1.5.3/include/ajax.php#L109; https://plugins.trac.wordpress.org/browser/ban-users/tags/1.5.3/include/ajax.php#L199; https://www.wordfence.com/threat-intel/vulnerabilities/id/af6bd2db-47a4-4381-a881-d5f97a159f8d?source=cve
CVE: CVE-2023-4213
Published: 2023-09-13
Description: The Simplr Registration Form Plus+ plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.4.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with subscriber-level permissions or above to change user passwords and potentially take over administrator accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://plugins.trac.wordpress.org/browser/simplr-registration-form/trunk/lib/profile.php#L148; https://www.wordfence.com/threat-intel/vulnerabilities/id/6ddf0452-3afe-4ada-bccc-30c818968a81?source=cve; https://plugins.trac.wordpress.org/browser/simplr-registration-form/trunk/lib/profile.php#L148
CVE: CVE-2023-4915
Published: 2023-09-13
Description: The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (in the WP User Control Widget). The function changes the user's password after providing the email. The new password is only sent to the user's email, so the attacker does not have access to the new password.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-620
References: https://plugins.trac.wordpress.org/browser/wp-user-control/tags/1.5.3/inc/WPUserControlWidget.php#L893; https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ca1736-7b99-49db-9367-586dbc14df41?source=cve; https://plugins.trac.wordpress.org/browser/wp-user-control/tags/1.5.3/inc/WPUserControlWidget.php#L893
CVE: CVE-2023-4916
Published: 2023-09-13
Description: The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthenticated attackers to change user password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php?rev=2965324#L2942; https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php?rev=2967707#L2948; https://www.wordfence.com/threat-intel/vulnerabilities/id/71083db7-377b-47a1-ac8b-83d8974a2654?source=cve
CVE: CVE-2023-4917
Published: 2023-09-13
Description: The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_get_env_and_options' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more keys and passwords.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/leyka/tags/3.30.3/inc/leyka-ajax.php#L393; https://plugins.trac.wordpress.org/changeset/2990146/leyka; https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd24b90-94ff-4625-8e3e-9c90e38683f9?source=cve
CVE: CVE-2023-4400
Published: 2023-09-13
Description: 
A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was possible due to SWG storing the password in plain text in some configuration files.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-256, CWE-312
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10406; https://github.com/advisories/GHSA-qggp-c2rq-6x65; https://kcm.trellix.com/corporate/index?page=content&id=SB10406
CVE: CVE-2023-26369
Published: 2023-09-13
Description: Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb23-34.html; https://helpx.adobe.com/security/products/acrobat/apsb23-34.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26369
CVE: CVE-2023-29305
Published: 2023-09-13
Description: Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/connect/apsb23-33.html; https://helpx.adobe.com/security/products/connect/apsb23-33.html
CVE: CVE-2023-29306
Published: 2023-09-13
Description: Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/connect/apsb23-33.html; https://helpx.adobe.com/security/products/connect/apsb23-33.html
CVE: CVE-2023-4039
Published: 2023-09-13
Description: **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains 
that target AArch64 allows an attacker to exploit an existing buffer 
overflow in dynamically-sized local variables in your application 
without this being detected. This stack-protector failure only applies 
to C99-style dynamically-sized local variables or those created using 
alloca(). The stack-protector operates as intended for statically-sized 
local variables.

The default behavior when the stack-protector 
detects an overflow is to terminate your application, resulting in 
controlled loss of availability. An attacker who can exploit a buffer 
overflow without triggering the stack-protector might be able to change 
program flow control to cause an uncontrolled loss of availability or to
 go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-693
References: https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64; https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf; https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64
CVE: CVE-2023-41081
Published: 2023-09-13
Description: Important: Authentication Bypass CVE-2023-41081

The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.

This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.

Users are recommended to upgrade to version 1.2.49, which fixes the issue.

History
2023-09-13 Original advisory

2023-09-28 Updated summary


CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2023/09/28/7; https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b; https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html
CVE: CVE-2021-44172
Published: 2023-09-13
Description: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management interface may allow an unauthenticated attacker to gain information on environment variables such as the EMS installation path.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://fortiguard.com/psirt/FG-IR-21-244; https://fortiguard.com/psirt/FG-IR-21-244
CVE: CVE-2022-35849
Published: 2023-09-13
Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and  6.1.0 all versions may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-310; https://fortiguard.com/psirt/FG-IR-22-310
CVE: CVE-2023-25608
Published: 2023-09-13
Description: An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through 7.0.1, 6.4 all versions, 6.2 all versions, 6.0 all versions; FortiAP-C 5.4.0 through 5.4.4, 5.2 all versions; FortiAP 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions, 6.0 all versions; FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to read arbitrary files via specially crafted command arguments.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-792
References: https://fortiguard.com/psirt/FG-IR-22-120; https://fortiguard.com/psirt/FG-IR-22-120
CVE: CVE-2023-27998
Published: 2023-09-13
Description: A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow an unauthenticated attacker with the ability to navigate to the login GUI to gain sensitive information via navigating to specific HTTP(s) paths.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-756, CWE-755
References: https://fortiguard.com/psirt/FG-IR-22-288; https://fortiguard.com/psirt/FG-IR-22-288
CVE: CVE-2023-29183
Published: 2023-09-13
Description: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-23-106; https://fortiguard.com/psirt/FG-IR-23-106
CVE: CVE-2023-34984
Published: 2023-09-13
Description: A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-693
References: https://fortiguard.com/psirt/FG-IR-23-068; https://fortiguard.com/psirt/FG-IR-23-068
CVE: CVE-2023-36551
Published: 2023-09-13
Description: A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to information disclosure via a crafted http request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://fortiguard.com/psirt/FG-IR-23-126; https://fortiguard.com/psirt/FG-IR-23-126
CVE: CVE-2023-36634
Published: 2023-09-13
Description: An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to list and delete arbitrary files and directory via specially crafted command arguments.
CVSS Score: 7.1 (HIGH)
CWE: CWE-73
References: https://fortiguard.com/psirt/FG-IR-23-123; https://fortiguard.com/psirt/FG-IR-23-123
CVE: CVE-2023-36638
Published: 2023-09-13
Description: An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions API may allow a remote and authenticated API admin user to access some system settings such as the mail server settings through the API via a stolen GUI session ID.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://fortiguard.com/psirt/FG-IR-22-522; https://fortiguard.com/psirt/FG-IR-22-522
CVE: CVE-2023-36642
Published: 2023-09-13
Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-501; https://fortiguard.com/psirt/FG-IR-22-501
CVE: CVE-2023-40715
Published: 2023-09-13
Description: A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to the DB contents to retrieve the plaintext password of external servers configured in the device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://fortiguard.com/psirt/FG-IR-22-465; https://fortiguard.com/psirt/FG-IR-22-465
CVE: CVE-2023-40717
Published: 2023-09-13
Description: A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to access the database via shell commands.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://fortiguard.com/psirt/FG-IR-22-245; https://fortiguard.com/psirt/FG-IR-22-245
CVE: CVE-2023-38214
Published: 2023-09-13
Description: Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html
CVE: CVE-2023-38215
Published: 2023-09-13
Description: Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html
CVE: CVE-2023-3935
Published: 2023-09-13
Description: A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf; https://cert.vde.com/en/advisories/VDE-2023-030/; https://cert.vde.com/en/advisories/VDE-2023-031/
CVE: CVE-2023-4701
Published: 2023-09-13
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the vendor eventually states that this issue is identical to CVE-2023-3935
CVE: CVE-2023-39914
Published: 2023-09-13
Description: NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-232, CWE-240
References: https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txt; https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txt
CVE: CVE-2023-39915
Published: 2023-09-13
Description: NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.
CVSS Score: 7.5 (HIGH)
CWE: CWE-232, CWE-240
References: https://nlnetlabs.nl/downloads/routinator/CVE-2023-39915.txt; https://nlnetlabs.nl/downloads/routinator/CVE-2023-39915.txt
CVE: CVE-2023-39916
Published: 2023-09-13
Description: NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for an attacker to craft a URL that results in the response being stored outside of the directory specified for it.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-35, CWE-22
References: https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt; https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt
CVE: CVE-2023-4801
Published: 2023-09-13
Description: An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-006; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0006; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-006
CVE: CVE-2023-4802
Published: 2023-09-13
Description: A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0007; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007
CVE: CVE-2023-4803
Published: 2023-09-13
Description: A reflected cross-site scripting vulnerability in the WriteWindowTitle endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0007; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007
CVE: CVE-2023-4828
Published: 2023-09-13
Description: An improper check for an exceptional condition in the Insider Threat Management (ITM) Server could be used by an attacker to change the server's configuration of any already-registered agent so that the agent sends all future communications to an attacker-chosen URL. This could result in disclosure of sensitive data events from the agent about the personally identifiable information (PII) and intellectual property it monitors, and all such data could be altered or deleted before reaching the ITM Server. An attacker must first successfully obtain valid agent credentials and agent hostname. All versions prior to 7.14.3.69 are affected.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-008; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0008; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-008