deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-43633
Published: 2023-09-21
Description: 
On boot, the Pillar eve container checks for the existence and content of
“/config/GlobalConfig/global.json”.

If the file exists, it overrides the existing configuration on the device on boot.

This allows an attacker to change the system’s configuration, which also includes some
debug functions.

This could be used to unlock the ssh with custom “authorized_keys” via the
“debug.enable.ssh” key, similar to the “authorized_keys” finding that was noted before.

Other usages include unlocking the usb to enable the keyboard via the “debug.enable.usb”
key, allowing VNC access via the “app.allow.vnc” key, and more.

An attacker could easily enable these debug functionalities without triggering the “measured
boot” mechanism implemented by EVE OS, and without marking the device as “UUD”
(“Unknown Update Detected”).
This is because the “/config” partition is not protected by “measured boot”, it is mutable and it
is not encrypted in any way.





An attacker can gain full control over the device without changing the PCR values, thereby not
triggering the “measured boot” mechanism, and having full access to the vault.




Note:

This issue was partially fixed in these commits (after disclosure to Zededa), where the config
partition measurement was added to PCR13:

• aa3501d6c57206ced222c33aea15a9169d629141

• 5fef4d92e75838cc78010edaed5247dfbdae1889.

This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522, CWE-922, CWE-522
References: https://asrg.io/security-advisories/cve-2023-43633/; https://asrg.io/security-advisories/cve-2023-43633/
CVE: CVE-2023-43634
Published: 2023-09-21
Description: 
When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs
are used.

In a previous project, CYMOTIVE found that the configuration is not protected by the secure
boot, and in response Zededa implemented measurements on the config partition that was
mapped to PCR 13.

In that process, PCR 13 was added to the list of PCRs that seal/unseal the key.

In commit “56e589749c6ff58ded862d39535d43253b249acf”, the config partition
measurement moved from PCR 13 to PCR 14, but PCR 14 was not added to the list of
PCRs that seal/unseal the key.

This change makes the measurement of PCR 14 effectively redundant as it would not affect
the sealing/unsealing of the key.



An attacker could modify the config partition without triggering the measured boot, this could
result in the attacker gaining full control over the device with full access to the contents of the
encrypted “vault”





CVSS Score: 8.8 (HIGH)
CWE: CWE-522, CWE-922, CWE-522
References: https://asrg.io/security-advisories/cve-2023-43634/; https://asrg.io/security-advisories/cve-2023-43634/
CVE: CVE-2023-43637
Published: 2023-09-21
Description: 
Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key
would always have the last 16 bytes predetermined to be "arfoobarfoobarfo".

This issue happens because "deriveVaultKey" calls "retrieveCloudKey" (which will always
return "foobarfoobarfoobarfoobarfoobarfo" as the key), and then merges the 32byte
randomly generated key with this key (by takeing 16bytes from each, see "mergeKeys").

This makes the key a lot weaker.

This issue does not persist in devices that were initialized on/after version 7.10, but devices
that were initialized before that and updated to a newer version still have this issue.



Roll an update that enforces the full 32bytes key usage.







CVSS Score: 7.8 (HIGH)
CWE: CWE-321, CWE-798
References: https://asrg.io/security-advisories/cve-2023-43637/; https://asrg.io/security-advisories/cve-2023-43637/
CVE: CVE-2023-40183
Published: 2023-09-21
Description: DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the `ImageIO.read()` method to determine whether the file is an image file or not. There is no whitelisting restriction on file suffixes. This allows the attacker to synthesize the attack code into an image for uploading and change the file extension to html. The attacker may steal user cookies by accessing links. The vulnerability has been fixed in v1.18.11. There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://github.com/dataease/dataease/commit/[PII_REDACTED]46721a2b3e09a9c9d3ea41f8f10569; https://github.com/dataease/dataease/releases/tag/v1.18.11; https://github.com/dataease/dataease/security/advisories/GHSA-w2r4-2r4w-fjxv
CVE: CVE-2023-41048
Published: 2023-09-21
Description: plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in versions 5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone 6.0.7). There are no known workarounds.
CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-80, CWE-79
References: http://www.openwall.com/lists/oss-security/2023/09/22/2; https://github.com/plone/Products.PloneHotfix20210518; https://github.com/plone/plone.namedfile/commit/188f66a4577021cf8f2bf7c0f5150f9b9573f167
CVE: CVE-2023-42457
Published: 2023-09-21
Description: plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770, CWE-770
References: http://www.openwall.com/lists/oss-security/2023/09/22/2; https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7; https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302
CVE: CVE-2023-42456
Published: 2023-09-21
Description: Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to re-authenticate themselves. Supporting this functionality is a set of session files (timestamps) for each user, stored in `/var/run/sudo-rs/ts`. These files are named according to the username from which the sudo attempt is made (the origin user).

An issue was discovered in versions prior to 0.2.1 where usernames containing the `.` and `/` characters could result in the corruption of specific files on the filesystem. As usernames are generally not limited by the characters they can contain, a username appearing to be a relative path can be constructed. For example we could add a user to the system containing the username `../../../../bin/cp`. When logged in as a user with that name, that user could run `sudo -K` to clear their session record file. The session code then constructs the path to the session file by concatenating the username to the session file storage directory, resulting in a resolved path of `/bin/cp`. The code then clears that file, resulting in the `cp` binary effectively being removed from the system.

An attacker needs to be able to login as a user with a constructed username. Given that such a username is unlikely to exist on an existing system, they will also need to be able to create the users with the constructed usernames.

The issue is patched in version 0.2.1 of sudo-rs. Sudo-rs now uses the uid for the user instead of their username for determining the filename. Note that an upgrade to this version will result in existing session files being ignored and users will be forced to re-authenticate. It also fully eliminates any possibility of path traversal, given that uids are always integer values.

The `sudo -K` and `sudo -k` commands can run, even if a user has no sudo access. As a workaround, make sure that one's system does not contain any users with a specially crafted username. While this is the case and while untrusted users do not have the ability to create arbitrary users on the system, one should not be able to exploit this issue.
CVSS Score: 3.1 (LOW)
CWE: CWE-22, CWE-23, CWE-22
References: http://www.openwall.com/lists/oss-security/2023/11/02/1; https://ferrous-systems.com/blog/sudo-rs-audit/; https://github.com/memorysafety/sudo-rs/commit/bfdbda22968e3de43fa8246cab1681cfd5d5493d
CVE: CVE-2023-34577
Published: 2023-09-21
Description: SQL injection vulnerability in Prestashop opartplannedpopup 1.4.11 and earlier allows remote attackers to run arbitrary SQL commands via OpartPlannedPopupModuleFrontController::prepareHook() method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/09/19/opartplannedpopup.html; https://security.friendsofpresta.org/modules/2023/09/19/opartplannedpopup.html
CVE: CVE-2023-42458
Published: 2023-09-21
Description: Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in Zope 4.8.10 and 5.8.5. As a workaround, make sure the "Add Documents, Images, and Files" permission is only assigned to trusted roles. By default, only the Manager has this permission.
CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-80
References: http://www.openwall.com/lists/oss-security/2023/09/22/2; https://github.com/zopefoundation/Zope/commit/26a55dbc301db417f47cafda6fe0f983b5690088; https://github.com/zopefoundation/Zope/commit/603b0a12881c90a072a7a65e32d47ed898ce37cb
CVE: CVE-2023-42805
Published: 2023-09-21
Description: quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/quinn-rs/quinn/pull/1667; https://github.com/quinn-rs/quinn/pull/1668; https://github.com/quinn-rs/quinn/pull/1669
CVE: CVE-2023-42806
Published: 2023-09-21
Description: Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying `$\mathsf{cid}$` allows an attacker (which must be a participant of this head) to use a snapshot from an old head instance with the same participants to close the head or contest the state with it. This can lead to an incorrect distribution of value (= value extraction attack; hard, but possible) or prevent the head to finalize because the value available is not consistent with the closed utxo state (= denial of service; easy). A patch is planned for version 0.13.0. As a workaround, rotate keys between heads so not to re-use keys and not result in the same multi-signature participants.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347
References: https://github.com/input-output-hk/hydra/blob/ec6c7a2ab[PII_REDACTED]75d0b34264e9a182c22bb/hydra-node/src/Hydra/HeadLogic.hs#L357; https://github.com/input-output-hk/hydra/blob/ec6c7a2ab[PII_REDACTED]75d0b34264e9a182c22bb/hydra-node/src/Hydra/Snapshot.hs#L50-L54; https://github.com/input-output-hk/hydra/blob/ec6c7a2ab[PII_REDACTED]75d0b34264e9a182c22bb/hydra-plutus/src/Hydra/Contract/Head.hs#L583-L599
CVE: CVE-2023-42807
Published: 2023-09-21
Description: Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63; https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63
CVE: CVE-2023-42279
Published: 2023-09-21
Description: Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/zaizainani/-Vulnerability-recurrence-sorting/blob/main/sqlattack-en.pdf; https://www.redpacketsecurity.com/dreamer-cms-sql-injection-cve-2023-42279/; https://github.com/zaizainani/-Vulnerability-recurrence-sorting/blob/main/sqlattack-en.pdf
CVE: CVE-2023-42810
Published: 2023-09-21
Description: systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/sebhildebrandt/systeminformation/commit/[PII_REDACTED]ccb2a610a22911c54c3446f4171392; https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-gx6r-qc2v-3p3v; https://systeminformation.io/security.html
CVE: CVE-2023-41991
Published: 2023-09-21
Description: A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://support.apple.com/en-us/HT213927; https://support.apple.com/en-us/HT213931; https://support.apple.com/en-us/HT213927
CVE: CVE-2023-41992
Published: 2023-09-21
Description: The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
CVSS Score: 7.8 (HIGH)
CWE: CWE-754, CWE-754
References: https://support.apple.com/en-us/HT213927; https://support.apple.com/en-us/HT213931; https://support.apple.com/en-us/HT213932
CVE: CVE-2023-41993
Published: 2023-09-21
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-754, CWE-754
References: https://security.gentoo.org/glsa/202401-33; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.apple.com/en-us/HT213940
CVE: CVE-2023-42280
Published: 2023-09-21
Description: mee-admin 1.5 is vulnerable to Directory Traversal. The download method in the CommonFileController.java file does not verify the incoming data, resulting in arbitrary file reading.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/zaizainani/-Vulnerability-recurrence-sorting/blob/main/anyfiledown-en.pdf; https://github.com/zaizainani/-Vulnerability-recurrence-sorting/blob/main/anyfiledown-en.pdf
CVE: CVE-2023-34576
Published: 2023-09-21
Description: SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitrary SQL commands via unspedified vector.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/09/19/opartfaq.html; https://security.friendsofpresta.org/modules/2023/09/19/opartfaq.html
CVE: CVE-2023-42482
Published: 2023-09-21
Description: Samsung Mobile Processor Exynos 2200 allows a GPU Use After Free.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-38343
Published: 2023-09-21
Description: An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928; https://www.ivanti.com/releases; https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928
CVE: CVE-2023-38344
Published: 2023-09-21
Description: An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an authenticated attacker to read arbitrary files from a remote system, including the private key used to authenticate to agents for remote access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://gist.github.com/bhyahoo/76533e91840200a1d9f3fb1eb87eb0f1; https://www.ivanti.com/releases; https://gist.github.com/bhyahoo/76533e91840200a1d9f3fb1eb87eb0f1
CVE: CVE-2023-42261
Published: 2023-09-21
Description: Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is that authentication is intentionally not implemented because the product is not intended for an untrusted network environment. Use cases requiring authentication could, for example, use a reverse proxy server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/abb47659a19ac772765934f184c65fe16cb3bee7/docker-compose.yml#L30-L31; https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/1211; https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/748
CVE: CVE-2023-41614
Published: 2023-09-21
Description: A stored cross-site scripting (XSS) vulnerability in the Add Animal Details function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description of Animal parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40guravtushar231/stored-xss-in-admin-panel-a38d1feb9ec4; https://medium.com/%40guravtushar231/stored-xss-in-admin-panel-a38d1feb9ec4
CVE: CVE-2023-41616
Published: 2023-09-21
Description: A reflected cross-site scripting (XSS) vulnerability in the Search Student function of Student Management System v1.2.3 and before allows attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40guravtushar231/reflected-xss-in-admin-panel-7a459dcb9476; https://medium.com/%40guravtushar231/reflected-xss-in-admin-panel-7a459dcb9476
CVE: CVE-2023-43128
Published: 2023-09-21
Description: D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-806; https://github.com/mmmmmx1/dlink/blob/main/DIR-806/1/readme.md; http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-806
CVE: CVE-2023-4504
Published: 2023-09-21
Description: Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.
CVSS Score: 7.0 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/OpenPrinting/cups/releases/tag/v2.4.7; https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h; https://github.com/OpenPrinting/libppd/security/advisories/GHSA-4f65-6ph5-qwh6
CVE: CVE-2023-5068
Published: 2023-09-21
Description: Delta Electronics DIAScreen may write past the end of an allocated 
buffer while parsing a specially crafted input file. This could allow an
 attacker to execute code in the context of the current process.


CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://diastudio.deltaww.com/home/downloads?sec=download#catalog; https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-03; https://diastudio.deltaww.com/home/downloads?sec=download#catalog
CVE: CVE-2023-31716
Published: 2023-09-22
Description: FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://github.com/MateusTesser/CVE-2023-31716; https://github.com/frangoteam/FUXA; https://github.com/MateusTesser/CVE-2023-31716
CVE: CVE-2023-31717
Published: 2023-09-22
Description: A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/MateusTesser/CVE-2023-31717; https://github.com/frangoteam/FUXA; https://youtu.be/IBMXTEI_5wY
CVE: CVE-2023-31718
Published: 2023-09-22
Description: FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://github.com/MateusTesser/CVE-2023-31718; https://github.com/frangoteam/FUXA; https://youtu.be/VCQkEGntN04
CVE: CVE-2023-31719
Published: 2023-09-22
Description: FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/MateusTesser/CVE-2023-31719; https://github.com/frangoteam/FUXA; https://youtu.be/cjb2KYpV6dY
CVE: CVE-2023-23362
Published: 2023-09-22
Description: An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2376 build 20230421 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2376 build 20230421 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later


CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-23-18; https://www.qnap.com/en/security-advisory/qsa-23-18
CVE: CVE-2023-23363
Published: 2023-09-22
Description: A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.

We have already fixed the vulnerability in the following versions:
QTS 4.3.6.2441 build 20230621 and later
QTS 4.3.3.2420 build 20230621 and later
QTS 4.2.6 build 20230621 and later
QTS 4.3.4.2451 build 20230621 and later

CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.qnap.com/en/security-advisory/qsa-23-25; https://www.qnap.com/en/security-advisory/qsa-23-25