deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-37605
Published: 2023-10-02
Description: Weak Exception Handling vulnerability in baramundi software GmbH EMM Agent 23.1.50 and before allows an attacker to cause a denial of service via a crafted request to the password parameter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://medium.com/%40david_42/complex-password-vs-buffer-overflow-and-the-winner-is-decbc56db5e3; https://medium.com/%40david_42/complex-password-vs-buffer-overflow-and-the-winner-is-decbc56db5e3
CVE: CVE-2023-3592
Published: 2023-10-02
Description: In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://mosquitto.org/blog/2023/08/version-2-0-16-released/; https://security.gentoo.org/glsa/202401-09; https://mosquitto.org/blog/2023/08/version-2-0-16-released/
CVE: CVE-2023-43835
Published: 2023-10-02
Description: Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite config.inc.php content.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-74
References: https://packetstormsecurity.com/files/174756/Super-Store-Finder-3.7-Remote-Command-Execution.html; https://packetstormsecurity.com/files/174756/Super-Store-Finder-3.7-Remote-Command-Execution.html
CVE: CVE-2023-43890
Published: 2023-10-02
Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. This vulnerability is exploited via a crafted HTTP request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/command%20injection%20bypass%20filter.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/command%20injection%20bypass%20filter.md
CVE: CVE-2023-44463
Published: 2023-10-02
Description: An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://github.com/pretix/pretix/commit/ccdce2ccb8207b82501af3c03f50abc0f819b469; https://github.com/pretix/pretix/compare/v2023.7.0...v2023.7.1; https://github.com/pretix/pretix/tags
CVE: CVE-2023-5344
Published: 2023-10-02
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/10; http://seclists.org/fulldisclosure/2023/Dec/11; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-43267
Published: 2023-10-02
Description: A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Fliggyaaa/b61c24e828cbcfac42406be408665280; https://github.com/Fliggyaaa/xss/; https://gist.github.com/Fliggyaaa/b61c24e828cbcfac42406be408665280
CVE: CVE-2023-43268
Published: 2023-10-02
Description: Deyue Remote Vehicle Management System v1.1 was discovered to contain a deserialization vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://gist.github.com/Fliggyaaa/5517fdd59853cd81724b19d2f29c6760; https://github.com/Fliggyaaa/DeYue-remote-vehicle-management-system; https://hzya.anlu169.com/ms/login
CVE: CVE-2023-43297
Published: 2023-10-02
Description: An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-924
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-43297.md; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-43297.md
CVE: CVE-2023-43361
Published: 2023-10-02
Description: Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/xiph/vorbis; https://github.com/xiph/vorbis-tools; https://github.com/xiph/vorbis-tools/issues/41
CVE: CVE-2023-43836
Published: 2023-10-02
Description: There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/Fliggyaaa/417f8335ce0f0546e95dda91d4b54604; https://github.com/Fliggyaaa/jizhicmssql/; https://gist.github.com/Fliggyaaa/417f8335ce0f0546e95dda91d4b54604
CVE: CVE-2023-44008
Published: 2023-10-02
Description: File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/tree/main/2023/CVE-2023-44008; https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/tree/main/2023/CVE-2023-44008
CVE: CVE-2023-44009
Published: 2023-10-02
Description: File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/tree/main/2023/CVE-2023-44009; https://www.mojoportal.com/; https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/tree/main/2023/CVE-2023-44009
CVE: CVE-2023-43891
Published: 2023-10-02
Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploited via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/command%20injection%20in%20changing%20password%20feature.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/command%20injection%20in%20changing%20password%20feature.md
CVE: CVE-2023-43892
Published: 2023-10-02
Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is exploited via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20hostname%20parameter%20in%20wan%20settings.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20hostname%20parameter%20in%20wan%20settings.md
CVE: CVE-2023-43893
Published: 2023-10-02
Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnerability is exploited via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20wake%20on%20lan%20functionality%20in%20wakeup_mac%20parameter.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20wake%20on%20lan%20functionality%20in%20wakeup_mac%20parameter.md
CVE: CVE-2023-44011
Published: 2023-10-02
Description: An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at the Skin management component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/tree/main/2023/CVE-2023-44011; https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/tree/main/2023/CVE-2023-44011
CVE: CVE-2023-44012
Published: 2023-10-02
Description: Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/tree/main/2023/CVE-2023-44012; https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/tree/main/2023/CVE-2023-44012
CVE: CVE-2023-28372
Published: 2023-10-02
Description: A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can  affect the availability of the object lock.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://support.purestorage.com/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/Security_Bulletin_for_FlashBlade_Object_Store_Privileged_Access_Vulnerability_CVE-2023-28372; https://support.purestorage.com/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/Security_Bulletin_for_FlashBlade_Object_Store_Privileged_Access_Vulnerability_CVE-2023-28372
CVE: CVE-2023-31042
Published: 2023-10-02
Description: A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols. 


CVSS Score: 7.7 (HIGH)
References: https://support.purestorage.com/Employee_Handbooks/Technical_Services/PSIRT/Security_Bulletin_for_FlashBlade_Object_Store_Protocol_CVE-2023-31042; https://support.purestorage.com/Employee_Handbooks/Technical_Services/PSIRT/Security_Bulletin_for_FlashBlade_Object_Store_Protocol_CVE-2023-31042
CVE: CVE-2023-36627
Published: 2023-10-02
Description: A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot schedules can configure a timezone to prevent the schedule from functioning properly. 

CVSS Score: 7.7 (HIGH)
References: https://support.purestorage.com/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/Security_Bulletin_for_FlashBlade_Snapshot_Scheduler_CVE-2023-36627; https://support.purestorage.com/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/Security_Bulletin_for_FlashBlade_Snapshot_Scheduler_CVE-2023-36627
CVE: CVE-2023-43980
Published: 2023-10-02
Description: Presto Changeo testsitecreator up to v1.1.1 was discovered to contain a SQL injection vulnerability via the component disable_json.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/09/28/testsitecreator-89.html; https://www.presto-changeo.com/prestashop/home/158-test-site-creator.html; https://security.friendsofpresta.org/modules/2023/09/28/testsitecreator-89.html
CVE: CVE-2023-28373
Published: 2023-10-03
Description: A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode. 

CVSS Score: 4.4 (MEDIUM)
References: https://support.purestorage.com/Employee_Handbooks/Technical_Services/PSIRT/Security_Bulletin_for_FlashArray_SafeMode_Immutable_Vulnerability_CVE-2023-28373; https://support.purestorage.com/Employee_Handbooks/Technical_Services/PSIRT/Security_Bulletin_for_FlashArray_SafeMode_Immutable_Vulnerability_CVE-2023-28373
CVE: CVE-2023-32572
Published: 2023-10-03
Description: A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.  

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://https://support.purestorage.com/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/Security_Bulletin_-_FlashArray_pgroup_Retention_Lock_SafeMode_Protection_CVE-2023-32572; https://https://support.purestorage.com/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/Security_Bulletin_-_FlashArray_pgroup_Retention_Lock_SafeMode_Protection_CVE-2023-32572
CVE: CVE-2023-36628
Published: 2023-10-03
Description: A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.

CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://support.purestorage.com/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/Security_Bulletin_for_Privilege_Escalation_in_VASA_CVE-2023-36628; https://support.purestorage.com/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/Security_Bulletin_for_Privilege_Escalation_in_VASA_CVE-2023-36628
CVE: CVE-2023-39222
Published: 2023-10-03
Description: OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU94497038/; https://www.furunosystems.co.jp/news/info/vulner20231002.html; https://jvn.jp/en/vu/JVNVU94497038/
CVE: CVE-2023-39429
Published: 2023-10-03
Description: Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/vu/JVNVU94497038/; https://www.furunosystems.co.jp/news/info/vulner20231002.html; https://jvn.jp/en/vu/JVNVU94497038/
CVE: CVE-2023-41086
Published: 2023-10-03
Description: Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, unintended operations may be performed. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/vu/JVNVU94497038/; https://www.furunosystems.co.jp/news/info/vulner20231002.html; https://jvn.jp/en/vu/JVNVU94497038/
CVE: CVE-2023-42771
Published: 2023-10-03
Description: Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-288
References: https://jvn.jp/en/vu/JVNVU94497038/; https://www.furunosystems.co.jp/news/info/vulner20231002.html; https://jvn.jp/en/vu/JVNVU94497038/
CVE: CVE-2023-43627
Published: 2023-10-03
Description: Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/vu/JVNVU94497038/; https://www.furunosystems.co.jp/news/info/vulner20231002.html; https://jvn.jp/en/vu/JVNVU94497038/
CVE: CVE-2023-3335
Published: 2023-10-03
Description: Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator on Linux allows local users  to gain sensitive information.This issue affects Hitachi Ops Center Administrator: before 10.9.3-00.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-140/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-140/index.html
CVE: CVE-2023-3440
Published: 2023-10-03
Description: Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Management - Manager: from 09-00 before 12-50-07; JP1/Performance Management - Base: from 09-00 through 10-50-*; JP1/Performance Management - Agent Option for Application Server: from 11-00 before 11-50-16; JP1/Performance Management - Agent Option for Enterprise Applications: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for HiRDB: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for IBM Lotus Domino: from 10-00 before 11-50-16; JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server: from 09-00 before  12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Oracle: from 09-00 before  12-10-08; JP1/Performance Management - Agent Option for Platform: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Service Response: from 09-00 before 11-50-16; JP1/Performance Management - Agent Option for Transaction System: from 11-00 before 12-00-14; JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Remote Monitor for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Platform: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Virtual Machine: from 10-00 before 12-50-07; JP1/Performance Management - Agent Option for Domino: from 09-00 through 09-00-*; JP1/Performance Management - Agent Option for IBM WebSphere Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for IBM WebSphere MQ: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for JP1/AJS3: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for OpenTP1: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Oracle WebLogic Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for uCosminexus Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Virtual Machine: from 09-00 through 09-01-*.


CVSS Score: 8.4 (HIGH)
CWE: CWE-276, CWE-276
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html
CVE: CVE-2023-3967
Published: 2023-10-03
Description: Allocation of Resources Without Limits or Throttling vulnerability in Hitachi Ops Center Common Services on Linux allows DoS.This issue affects Hitachi Ops Center Common Services: before 10.9.3-00.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-142/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-142/index.html
CVE: CVE-2023-5334
Published: 2023-10-03
Description: The WP Responsive header image slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sp_responsiveslider' shortcode in versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/responsive-header-image-slider/trunk/responsive_headerimageslider.php#L343; https://www.wordfence.com/threat-intel/vulnerabilities/id/6953dea2-ca2d-4283-97c2-45c3420d9390?source=cve; https://plugins.trac.wordpress.org/browser/responsive-header-image-slider/trunk/responsive_headerimageslider.php#L343
CVE: CVE-2023-5345
Published: 2023-10-03
Description: A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation.

In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free.

We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6e43b8aa7cd3c3af686caf0c2e11819a886d705; https://kernel.dance/e6e43b8aa7cd3c3af686caf0c2e11819a886d705
CVE: CVE-2023-26150
Published: 2023-10-03
Description: Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication.**Note:**This issue is a result of missing checks for services that require an active session.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://gist.github.com/artfire52/84f7279a4119d6f90381ac49d7121121; https://github.com/FreeOpcUa/opcua-asyncio/commit/2be7ce80df05de8d6c6ae1ebce6fa2bb7147844a; https://github.com/FreeOpcUa/opcua-asyncio/commit/b4106dfd5037423c9d1810b48a97296b59cde513
CVE: CVE-2023-26151
Published: 2023-10-03
Description: Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-835
References: https://gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8; https://github.com/FreeOpcUa/opcua-asyncio/commit/f6603daa34a93a658f0e176cb0b9ee5a6643b262; https://github.com/FreeOpcUa/opcua-asyncio/issues/1013
CVE: CVE-2023-26152
Published: 2023-10-03
Description: All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://gist.github.com/lirantal/1f7021703a2065ecaf9ec9e06a3a346d; https://github.com/nbluis/static-server/blob/master/server.js%23L218-L223; https://security.snyk.io/vuln/SNYK-JS-STATICSERVER-5722341