deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4451
Published: 2023-08-20
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cockpit-hq/cockpit/commit/30609466c817e39f9de[PII_REDACTED]e93cd4d0d0c; https://huntr.dev/bounties/4e111c3e-6cf3-4b4c-b3c1-a540bf30f8fa; https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2023-4451.md
CVE: CVE-2022-24989
Published: 2023-08-20
Description: TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990; https://forum.terra-master.com/en/viewforum.php?f=28; https://github.com/0xf4n9x/CVE-2022-24990
CVE: CVE-2023-36674
Published: 2023-08-20
Description: An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWOLTBEYSESE5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O/
CVE: CVE-2023-4436
Published: 2023-08-20
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0. This issue affects some unknown processing of the file app/action/edit_update.php. The manipulation of the argument user_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237557 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/PUBLIC%20CVE%20HUB/Free%20and%20Open%20Source%20inventory%20management%20system%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.237557; https://vuldb.com/?id.237557
CVE: CVE-2023-4437
Published: 2023-08-20
Description: A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/search_sell_paymen_report.php. The manipulation of the argument customer leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-237558 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/PUBLIC%20CVE%20HUB/Free%20and%20Open%20Source%20inventory%20management%20system%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.237558; https://vuldb.com/?id.237558
CVE: CVE-2023-4438
Published: 2023-08-20
Description: A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file app/ajax/search_sales_report.php. The manipulation of the argument customer leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237559.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/PUBLIC%20CVE%20HUB/Free%20and%20Open%20Source%20inventory%20management%20system%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.237559; https://vuldb.com/?id.237559
CVE: CVE-2023-4439
Published: 2023-08-20
Description: A vulnerability was found in SourceCodester Card Holder Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Minus Value Handler. The manipulation leads to improper validation of specified quantity in input. The attack may be launched remotely. The identifier of this vulnerability is VDB-237560.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1284
References: https://vuldb.com/?ctiid.237560; https://vuldb.com/?id.237560; https://vuldb.com/?ctiid.237560
CVE: CVE-2023-4440
Published: 2023-08-20
Description: A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been classified as critical. This affects an unknown part of the file appointment.php. The manipulation of the argument sheduledate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237561 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/CookedMelon/cve/tree/master/hospital/patient; https://vuldb.com/?ctiid.237561; https://vuldb.com/?id.237561
CVE: CVE-2023-4441
Published: 2023-08-21
Description: A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /patient/appointment.php. The manipulation of the argument sheduledate leads to sql injection. The attack can be initiated remotely. VDB-237562 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.237562; https://vuldb.com/?id.237562; https://vuldb.com/?ctiid.237562
CVE: CVE-2023-4442
Published: 2023-08-21
Description: A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been rated as critical. This issue affects some unknown processing of the file \vm\patient\booking-complete.php. The manipulation of the argument userid/apponum/scheduleid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237563.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/CookedMelon/cve/tree/master/hospital/patient-book; https://vuldb.com/?ctiid.237563; https://vuldb.com/?id.237563
CVE: CVE-2023-39784
Published: 2023-08-21
Description: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the save_virtualser_data function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://tenda.com; https://github.com/Xunflash/IOT/tree/main/Tenda_AC8_V4; http://tenda.com
CVE: CVE-2023-39785
Published: 2023-08-21
Description: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the set_qosMib_list function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://tenda.com; https://github.com/Xunflash/IOT/tree/main/Tenda_AC8_V4/2; http://tenda.com
CVE: CVE-2023-39786
Published: 2023-08-21
Description: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sscanf function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://tenda.com; https://github.com/Xunflash/IOT/tree/main/Tenda_AC8_V4/3; http://tenda.com
CVE: CVE-2023-39807
Published: 2023-08-21
Description: N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-register.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://ibsg.com; http://nvkinter.com; http://ibsg.com
CVE: CVE-2023-39808
Published: 2023-08-21
Description: N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password which allows attackers to login with root privileges via the SSH service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://ibsg.com; http://nvkinter.com; http://ibsg.com
CVE: CVE-2023-39809
Published: 2023-08-21
Description: N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a command injection vulnerability via the system_hostname parameter at /manage/network-basic.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://ibsg.com; http://nvkinter.com; http://ibsg.com
CVE: CVE-2023-4443
Published: 2023-08-21
Description: A vulnerability classified as critical has been found in SourceCodester Free Hospital Management System for Small Practices 1.0/5.0.12. Affected is an unknown function of the file vm\doctor\edit-doc.php. The manipulation of the argument id00/nic/oldemail/email/spec/Tele leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237564.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/CookedMelon/cve/tree/master/hospital/doctor-edit; https://vuldb.com/?ctiid.237564; https://vuldb.com/?id.237564
CVE: CVE-2023-4444
Published: 2023-08-21
Description: A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is an unknown functionality of the file vm\patient\edit-user.php. The manipulation of the argument id00/nic/oldemail/email/spec/Tele leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237565 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/CookedMelon/cve/tree/master/hospital/patient-edit; https://vuldb.com/?ctiid.237565; https://vuldb.com/?id.237565
CVE: CVE-2023-4445
Published: 2023-08-21
Description: A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20230811. Affected by this issue is some unknown functionality of the file product/1/1?test=1&test2=2&. The manipulation of the argument orderBy leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-237566 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/FFR66/Mini-Tmall_SQL/blob/main/README.md; https://vuldb.com/?ctiid.237566; https://vuldb.com/?id.237566
CVE: CVE-2023-4446
Published: 2023-08-21
Description: A vulnerability, which was classified as critical, was found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file template/default/category.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237567.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/OpenRapid/rapidcms/issues/3; https://vuldb.com/?ctiid.237567; https://vuldb.com/?id.237567
CVE: CVE-2023-39617
Published: 2023-08-21
Description: TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://sedate-class-393.notion.site/TOTOlink-ee7eb0d4cd5d43e[PII_REDACTED]371eff1?pvs=4; https://sedate-class-393.notion.site/TOTOlink-ee7eb0d4cd5d43e[PII_REDACTED]371eff1?pvs=4
CVE: CVE-2023-39618
Published: 2023-08-21
Description: TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://sedate-class-393.notion.site/TOTOlink-3567fd9f93d84afab0d81cd8c063f9a1?pvs=4; https://sedate-class-393.notion.site/TOTOlink-3567fd9f93d84afab0d81cd8c063f9a1?pvs=4
CVE: CVE-2023-4447
Published: 2023-08-21
Description: A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. This vulnerability affects unknown code of the file admin/article-chat.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237568.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/OpenRapid/rapidcms/issues/4; https://vuldb.com/?ctiid.237568; https://vuldb.com/?id.237568
CVE: CVE-2023-4448
Published: 2023-08-21
Description: A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 4dff[PII_REDACTED]61c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier VDB-237569 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-640
References: https://github.com/OpenRapid/rapidcms/commit/4dff[PII_REDACTED]61c362d50105ff8da8ea40bcbe#diff-fc57d4c69cf5912c6edb5233c6df069a91106ebd481c115faf1ea124478b26d0; https://github.com/OpenRapid/rapidcms/issues/5; https://vuldb.com/?ctiid.237569
CVE: CVE-2023-4449
Published: 2023-08-21
Description: A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /index.php?page=member. The manipulation of the argument columns[0][data] leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-237570 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Jacky-Y/vuls/blob/main/README.md; https://vuldb.com/?ctiid.237570; https://vuldb.com/?id.237570
CVE: CVE-2023-39745
Published: 2023-08-21
Description: TP-Link TL-WR940N V2, TP-Link TL-WR941ND V5 and TP-Link TL-WR841N V8 were discovered to contain a buffer overflow via the component /userRpm/AccessCtrlAccessRulesRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/16/TP-Link%20WR940N%20WR941ND%20WR841N%20wireless%20router%20userRpmAccessCtrlAccessRulesRpm%20buffer%20read%20out-of-bounds%20vulnerability.md; https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/16/TP-Link%20WR940N%20WR941ND%20WR841N%20wireless%20router%20userRpmAccessCtrlAccessRulesRpm%20buffer%20read%20out-of-bounds%20vulnerability.md
CVE: CVE-2023-39747
Published: 2023-08-21
Description: TP-Link WR841N V8, TP-Link TL-WR940N V2, and TL-WR941ND V5 were discovered to contain a buffer overflow via the radiusSecret parameter at /userRpm/WlanSecurityRpm.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/17/TP-Link%20WR841N%20wireless%20router%20WlanSecurityRpm%20Stack%20Overflow%20vulnerability.md; https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/17/TP-Link%20WR841N%20wireless%20router%20WlanSecurityRpm%20Stack%20Overflow%20vulnerability.md
CVE: CVE-2023-39748
Published: 2023-08-21
Description: An issue in the component /userRpm/NetworkCfgRpm of TP-Link TL-WR1041N V2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/19/TL_WR1041N_NetworkCfgRpm_denial_of_service_vulnerability.md; https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/19/TL_WR1041N_NetworkCfgRpm_denial_of_service_vulnerability.md
CVE: CVE-2023-39749
Published: 2023-08-21
Description: D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the component /adv_resource. This vulnerability is exploited via a crafted GET request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/a101e-IoTvul/iotvul/blob/main/d-link/2/D-Link%20DAP-2660%20adv_resource.md; https://www.dlink.com/en/security-bulletin/; https://github.com/a101e-IoTvul/iotvul/blob/main/d-link/2/D-Link%20DAP-2660%20adv_resource.md
CVE: CVE-2023-39750
Published: 2023-08-21
Description: D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the f_ipv6_enable parameter at /bsc_ipv6. This vulnerability is exploited via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/a101e-IoTvul/iotvul/blob/main/d-link/1/D-Link%20DAP-2660%20bsc_ipv6.md; https://www.dlink.com/en/security-bulletin/; https://github.com/a101e-IoTvul/iotvul/blob/main/d-link/1/D-Link%20DAP-2660%20bsc_ipv6.md
CVE: CVE-2023-39751
Published: 2023-08-21
Description: TP-Link TL-WR941ND V6 were discovered to contain a buffer overflow via the pSize parameter at /userRpm/PingIframeRpm.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/20/WR941ND_userRpm_PingIframeRpm_buffer_write_out-of-bounds_vulnerability.md; https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/20/WR941ND_userRpm_PingIframeRpm_buffer_write_out-of-bounds_vulnerability.md
CVE: CVE-2023-4450
Published: 2023-08-21
Description: A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-237571.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://github.com/keecth/bug/blob/main/jimureport%20ssti(RCE).md; https://vuldb.com/?ctiid.237571; https://vuldb.com/?id.237571
CVE: CVE-2022-46751
Published: 2023-08-21
Description: Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2.

When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used.

This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways.

Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed.

Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle's "Java API for XML Processing (JAXP) Security Guide".
CVSS Score: 8.2 (HIGH)
CWE: CWE-91, CWE-611
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-94ABC0EE-9DC8-44F0-84AD-47ADD5340477; https://gitbox.apache.org/repos/asf?p=ant-ivy.git;a=commit;h=2be17bc18b0e1d4123007d579e43ba1a4b6fab3d
CVE: CVE-2023-39543
Published: 2023-08-21
Description: Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN04876736/; https://www.luxsoft.eu/; https://www.luxsoft.eu/?download
CVE: CVE-2023-39939
Published: 2023-08-21
Description: SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute arbitrary queries against the database and obtain or alter the information in it.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://jvn.jp/en/jp/JVN04876736/; https://www.luxsoft.eu/; https://www.luxsoft.eu/?download
CVE: CVE-2023-40068
Published: 2023-08-21
Description: Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN98946408/; https://wordpress.org/plugins/advanced-custom-fields/; https://www.advancedcustomfields.com/
CVE: CVE-2023-4453
Published: 2023-08-21
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e; https://huntr.dev/bounties/245a8785-0fc0-4561-b181-fa20f869d993; https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e
CVE: CVE-2023-4454
Published: 2023-08-21
Description: Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: https://github.com/wallabag/wallabag/commit/78b0b55c40511e1f22d5bbb4897aa10fca68441c; https://huntr.dev/bounties/4ee0ef74-e4d4-46e7-a05c-076bce522299; https://github.com/wallabag/wallabag/commit/78b0b55c40511e1f22d5bbb4897aa10fca68441c
CVE: CVE-2023-4455
Published: 2023-08-21
Description: Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/wallabag/wallabag/commit/ffcc5c9062fcc8cd922d7d6d65edbe5efae96806; https://huntr.dev/bounties/5ab1b206-5fe8-4737-b275-d705e76f193a; https://github.com/wallabag/wallabag/commit/ffcc5c9062fcc8cd922d7d6d65edbe5efae96806
CVE: CVE-2023-3481
Published: 2023-08-21
Description: Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension. 
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-80, CWE-116, CWE-79
References: https://github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597; https://github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597
CVE: CVE-2020-28715
Published: 2023-08-21
Description: An issue was discovered in kdmserver service in LeEco LeTV X43 version V2401RCN02C080080B04121S, allows attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS).
CVSS Score: 9.8 (CRITICAL)
References: http://leeco.com; https://www.cnvd.org.cn/flaw/show/2602948; http://leeco.com
CVE: CVE-2023-38899
Published: 2023-08-21
Description: SQL injection vulnerability in berkaygediz O_Blog v.1.0 allows a local attacker to escalate privileges via the secure_file_priv component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: http://o.com; https://github.com/berkaygediz/O_Blog; https://github.com/berkaygediz/O_Blog/issues
CVE: CVE-2023-40735
Published: 2023-08-21
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (Architecture flaw) allows loss of plausible deniability and confidentiality.This issue affects BUTTERFLY BUTTON: As of 2023-08-21.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://butterfly-button.web.app/; https://github.com/TheButterflyButton; https://github.com/TheButterflySDK
CVE: CVE-2022-4367
Published: 2023-08-21
Description: Rejected reason: Duplicate, use CVE-2023-4279 instead.