deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-24539
Published: 2023-05-11
Description: Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-94
References: https://go.dev/cl/491615; https://go.dev/issue/59720; https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
CVE: CVE-2023-24540
Published: 2023-05-11
Description: Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://go.dev/cl/491616; https://go.dev/issue/59721; https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
CVE: CVE-2023-29400
Published: 2023-05-11
Description: Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-94
References: https://go.dev/cl/491617; https://go.dev/issue/59722; https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
CVE: CVE-2023-32075
Published: 2023-05-11
Description: The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch; https://github.com/pimcore/customer-data-framework/releases/tag/v3.3.9; https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-x99j-r8vv-gwwj
CVE: CVE-2023-25309
Published: 2023-05-11
Description: Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://fetlife.com; http://rollout-ui.com; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2023-29022
Published: 2023-05-11
Description: 
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product 

that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page.




CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE: CVE-2023-29023
Published: 2023-05-11
Description: 
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability.


CVSS Score: 7.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE: CVE-2023-29024
Published: 2023-05-11
Description: 
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product 

A cross site scripting vulnerability was discovered that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability.




CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE: CVE-2023-29025
Published: 2023-05-11
Description: 
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product 

that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page.




CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE: CVE-2023-29026
Published: 2023-05-11
Description: 
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product 

that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page.




CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20, CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE: CVE-2023-29027
Published: 2023-05-11
Description: 
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product 

that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page.




CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE: CVE-2023-29028
Published: 2023-05-11
Description: 
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product 

that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page.




CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE: CVE-2023-29029
Published: 2023-05-11
Description: 
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product 

that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page.




CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE: CVE-2023-29030
Published: 2023-05-11
Description: 
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability.


CVSS Score: 7.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE: CVE-2023-29031
Published: 2023-05-11
Description: 
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability.


CVSS Score: 7.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE: CVE-2023-1834
Published: 2023-05-11
Description: 
Rockwell Automation was made aware that Kinetix 5500 drives, manufactured between May 2022 and January 2023, and are running v7.13 may have the telnet and FTP ports open by default.  This could potentially allow attackers unauthorized access to the device through the open ports.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-284
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139441; https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-09; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139441
CVE: CVE-2023-2443
Published: 2023-05-11
Description: 
Rockwell Automation ThinManager product allows the use of medium strength ciphers.  If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.


CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139442; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139442
CVE: CVE-2023-2444
Published: 2023-05-11
Description: 
A cross site request forgery vulnerability exists in Rockwell Automation's FactoryTalk Vantagepoint. This vulnerability can be exploited in two ways. If an attacker sends a malicious link to a computer that is on the same domain as the FactoryTalk Vantagepoint server and a user clicks the link, the attacker could impersonate the legitimate user and send requests to the affected product.  Additionally, if an attacker sends an untrusted link to a computer that is not on the same domain as the server and a user opens the FactoryTalk Vantagepoint website, enters credentials for the FactoryTalk Vantagepoint server, and clicks on the malicious link a cross site request forgery attack would be successful as well.


CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139443; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139443
CVE: CVE-2023-30394
Published: 2023-05-11
Description: The MoveIt framework 1.1.11 for ROS allows cross-site scripting (XSS) via the API authentication function. NOTE: this issue is disputed by the original reporter because it has "no impact."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-30394; https://github.com/ros-planning/moveit; https://i.ibb.co/R2JSPV5/2022-10-02-12-39-57-Window.png
CVE: CVE-2023-27554
Published: 2023-05-11
Description: 
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249185; https://www.ibm.com/support/pages/node/6989451; https://exchange.xforce.ibmcloud.com/vulnerabilities/249185
CVE: CVE-2023-27870
Published: 2023-05-11
Description: 
IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249518; https://www.ibm.com/support/pages/node/6985697; https://exchange.xforce.ibmcloud.com/vulnerabilities/249518
CVE: CVE-2023-29195
Published: 2023-05-11
Description: Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-20, CWE-703
References: https://github.com/vitessio/vitess/commit/9dcbd7de3180f47e94f54989fb5c66daea00c920; https://github.com/vitessio/vitess/issues/12842; https://github.com/vitessio/vitess/pull/12843
CVE: CVE-2023-32082
Published: 2023-05-11
Description: etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.md; https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md; https://github.com/etcd-io/etcd/pull/15656
CVE: CVE-2023-29791
Published: 2023-05-11
Description: kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.mo60.cn/index.php/archives/kodbox-xss.html; https://blog.mo60.cn/index.php/archives/kodbox-xss.html
CVE: CVE-2023-2662
Published: 2023-05-11
Description: In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero.



CVSS Score: 2.9 (LOW)
CWE: CWE-369, CWE-369, CWE-369
References: https://forum.xpdfreader.com/viewtopic.php?t=42505; https://forum.xpdfreader.com/viewtopic.php?t=42505
CVE: CVE-2023-2663
Published: 2023-05-11
Description:  In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a stack overflow.



CVSS Score: 2.9 (LOW)
CWE: CWE-674, CWE-674, CWE-674
References: https://forum.xpdfreader.com/viewtopic.php?t=42421; https://forum.xpdfreader.com/viewtopic.php?t=42421
CVE: CVE-2023-2664
Published: 2023-05-11
Description:  In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow.



CVSS Score: 2.9 (LOW)
CWE: CWE-674, CWE-674
References: https://forum.xpdfreader.com/viewtopic.php?t=42422; https://forum.xpdfreader.com/viewtopic.php?t=42422
CVE: CVE-2023-31146
Published: 2023-05-11
Description: Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment. The issue can cause data corruption across call frames. The expected behavior is to revert due to out-of-bounds array access. Version 0.3.8 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/vyperlang/vyper/commit/4f8289a81206f767df1900ac48f485d90fc87edb; https://github.com/vyperlang/vyper/security/advisories/GHSA-3p37-3636-q8wv; https://github.com/vyperlang/vyper/commit/4f8289a81206f767df1900ac48f485d90fc87edb
CVE: CVE-2023-31497
Published: 2023-05-11
Description: Incorrect access control in Quick Heal Technologies Limited Seqrite Endpoint Security (EPS) all versions prior to v8.0 allows attackers to escalate privileges to root via supplying a crafted binary to the target system.
CVSS Score: 7.8 (HIGH)
References: https://github.com/0xInfection/EPScalate; https://github.com/0xInfection/EPScalate
CVE: CVE-2023-32058
Published: 2023-05-11
Description: Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868; https://github.com/vyperlang/vyper/security/advisories/GHSA-6r8q-pfpv-7cgj; https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868
CVE: CVE-2023-28325
Published: 2023-05-11
Description: An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285, CWE-287, CWE-863
References: https://hackerone.com/reports/1406479; https://hackerone.com/reports/1406479
CVE: CVE-2023-28356
Published: 2023-05-11
Description: A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one of the processes, consuming ~120% CPU and rendering the service unresponsive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400, CWE-770
References: https://hackerone.com/reports/1461340; https://hackerone.com/reports/1461340
CVE: CVE-2023-28357
Published: 2023-05-11
Description: A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a member of a channel that they do not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200, CWE-863
References: https://hackerone.com/reports/1445810; https://hackerone.com/reports/1445810
CVE: CVE-2023-28358
Published: 2023-05-11
Description: A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://hackerone.com/reports/1781131; https://hackerone.com/reports/1781131
CVE: CVE-2023-28359
Published: 2023-05-11
Description: A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the potential for limited impact.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89, CWE-89, CWE-89
References: https://hackerone.com/reports/1757676; https://hackerone.com/reports/1757676
CVE: CVE-2023-28360
Published: 2023-05-11
Description: An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no download safety check dialog presented to the user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-223
References: https://hackerone.com/reports/1848062; https://hackerone.com/reports/1848062
CVE: CVE-2023-28361
Published: 2023-05-11
Description: A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM ProfessionalUDM SEUDRMitigation:Update affected products to UniFi OS 3.0.13 or later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352, CWE-352
References: https://community.ui.com/releases/Security-Advisory-Bulletin-030-030/f9de9e65-585f-4c66-81e9-5d8f54ba66dd; https://community.ui.com/releases/Security-Advisory-Bulletin-030-030/f9de9e65-585f-4c66-81e9-5d8f54ba66dd
CVE: CVE-2023-29273
Published: 2023-05-11
Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html; https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html
CVE: CVE-2023-29274
Published: 2023-05-11
Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html; https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html
CVE: CVE-2023-29275
Published: 2023-05-11
Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html; https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html
CVE: CVE-2023-29276
Published: 2023-05-11
Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html; https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html
CVE: CVE-2023-29277
Published: 2023-05-11
Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html; https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html