deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-47641
Published: 2023-11-14
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-Length(CL) and Transfer-Encoding(TE) header values are present it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation. A possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. The impact of this vulnerability is that it is possible to bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is present an Open Redirect an attacker could combine it to redirect random users to another website and log the request. This vulnerability has been addressed in release 3.8.0 of aiohttp. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.4 (LOW)
CWE: CWE-444
References: https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371; https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j; https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371
CVE: CVE-2023-5528
Published: 2023-11-14
Description: A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://github.com/kubernetes/kubernetes/issues/121879; https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA; https://github.com/kubernetes/kubernetes/issues/121879
CVE: CVE-2022-45781
Published: 2023-11-14
Description: Buffer Overflow vulnerability in Tenda AX1803 v1.0.0.1_2994 and earlier allows attackers to run arbitrary code via /goform/SetOnlineDevName.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.cnblogs.com/FALL3N/p/16813932.html; https://www.cnblogs.com/FALL3N/p/16813932.html
CVE: CVE-2023-36038
Published: 2023-11-14
Description: ASP.NET Core Denial of Service Vulnerability
CVSS Score: 8.2 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36038; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36038
CVE: CVE-2023-36558
Published: 2023-11-14
Description: ASP.NET Core Security Feature Bypass Vulnerability
CVSS Score: 6.2 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36558; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36558
CVE: CVE-2023-39535
Published: 2023-11-14
Description: AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023008.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023008.pdf
CVE: CVE-2023-39536
Published: 2023-11-14
Description: AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023008.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023008.pdf
CVE: CVE-2023-39537
Published: 2023-11-14
Description: AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023008.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023008.pdf
CVE: CVE-2023-46022
Published: 2023-11-14
Description: SQL Injection vulnerability in delete.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via the 'bid' parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: https://github.com/ersinerenler/CVE-2023-46022-Code-Projects-Blood-Bank-1.0-OOB-SQL-Injection-Vulnerability; https://github.com/ersinerenler/CVE-2023-46022-Code-Projects-Blood-Bank-1.0-OOB-SQL-Injection-Vulnerability
CVE: CVE-2023-46023
Published: 2023-11-14
Description: SQL injection vulnerability in addTask.php in Code-Projects Simple Task List 1.0 allows attackers to obtain sensitive information via the 'status' parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ersinerenler/Code-Projects-Simple-Task-List-1.0/blob/main/CVE-2023-46023-Code-Projects-Simple-Task-List-1.0-SQL-Injection-Vulnerability.md; https://github.com/ersinerenler/Code-Projects-Simple-Task-List-1.0/blob/main/CVE-2023-46023-Code-Projects-Simple-Task-List-1.0-SQL-Injection-Vulnerability.md
CVE: CVE-2023-46024
Published: 2023-11-14
Description: SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQL commands and obtain sensitive information via the 'searchdata' parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/ersinerenler/phpgurukul-Teacher-Subject-Allocation-Management-System-1.0/blob/main/CVE-2023-46024-phpgurukul-Teacher-Subject-Allocation-Management-System-1.0-SQL-Injection-Vulnerability.md; https://github.com/ersinerenler/phpgurukul-Teacher-Subject-Allocation-Management-System-1.0/blob/main/CVE-2023-46024-phpgurukul-Teacher-Subject-Allocation-Management-System-1.0-SQL-Injection-Vulnerability.md
CVE: CVE-2023-46025
Published: 2023-11-14
Description: SQL Injection vulnerability in teacher-info.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to obtain sensitive information via the 'editid' parameter.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/ersinerenler/phpgurukul-Teacher-Subject-Allocation-Management-System-1.0/blob/main/CVE-2023-46025-phpgurukul-Teacher-Subject-Allocation-Management-System-1.0-SQL-Injection-Vulnerability.md; https://github.com/ersinerenler/phpgurukul-Teacher-Subject-Allocation-Management-System-1.0/blob/main/CVE-2023-46025-phpgurukul-Teacher-Subject-Allocation-Management-System-1.0-SQL-Injection-Vulnerability.md
CVE: CVE-2023-46026
Published: 2023-11-14
Description: Cross Site Scripting (XSS) vulnerability in profile.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary code via the 'adminname' and 'email' parameters.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/ersinerenler/phpgurukul-Teacher-Subject-Allocation-Management-System-1.0/blob/main/CVE-2023-46026-PHPGurukul-Teacher-Subject-Allocation-Management-System-1.0-Stored-Cross-Site-Scripting-Vulnerability.md; https://github.com/ersinerenler/phpgurukul-Teacher-Subject-Allocation-Management-System-1.0/blob/main/CVE-2023-46026-PHPGurukul-Teacher-Subject-Allocation-Management-System-1.0-Stored-Cross-Site-Scripting-Vulnerability.md
CVE: CVE-2023-46580
Published: 2023-11-14
Description: Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46580-Code-Projects-Inventory-Management-1.0-Stored-Cross-Site-Scripting-Vulnerability.md; https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46580-Code-Projects-Inventory-Management-1.0-Stored-Cross-Site-Scripting-Vulnerability.md
CVE: CVE-2023-46581
Published: 2023-11-14
Description: SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the registration.php component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46581-Code-Projects-Inventory-Management-1.0-SQL-Injection-Vulnerability.md; https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46581-Code-Projects-Inventory-Management-1.0-SQL-Injection-Vulnerability.md
CVE: CVE-2023-46582
Published: 2023-11-14
Description: SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.php component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46582-Code-Projects-Inventory-Management-1.0-SQL-Injection-Vulnerability.md; https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46582-Code-Projects-Inventory-Management-1.0-SQL-Injection-Vulnerability.md
CVE: CVE-2023-47520
Published: 2023-11-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Uno (miunosoft) Responsive Column Widgets plugin <= 1.2.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/responsive-column-widgets/wordpress-responsive-column-widgets-plugin-1-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/responsive-column-widgets/wordpress-responsive-column-widgets-plugin-1-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47522
Published: 2023-11-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Feed plugin <= 2.2.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/photo-feed/wordpress-photo-feed-plugin-2-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/photo-feed/wordpress-photo-feed-plugin-2-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47524
Published: 2023-11-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability (requires PHP 8.x) in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/patron-button-and-widgets-by-codebard/wordpress-codebard-s-patron-button-and-widgets-for-patreon-plugin-2-1-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/patron-button-and-widgets-by-codebard/wordpress-codebard-s-patron-button-and-widgets-for-patreon-plugin-2-1-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47528
Published: 2023-11-14
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sajjad Hossain Sagor WP Edit Username plugin <= 1.0.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-edit-username/wordpress-wp-edit-username-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-edit-username/wordpress-wp-edit-username-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47532
Published: 2023-11-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themeum WP Crowdfunding plugin <= 2.1.6 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-crowdfunding/wordpress-wp-crowdfunding-plugin-2-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-crowdfunding/wordpress-wp-crowdfunding-plugin-2-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48217
Published: 2023-11-14
Description: Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-434
References: https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411; https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86; https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411
CVE: CVE-2023-39199
Published: 2023-11-14
Description: Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-325
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39202
Published: 2023-11-14
Description: Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access.
CVSS Score: 3.1 (LOW)
CWE: CWE-426, CWE-426
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39203
Published: 2023-11-14
Description: Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disclosure of information via network access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-789
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39204
Published: 2023-11-14
Description: Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39205
Published: 2023-11-14
Description: Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39206
Published: 2023-11-14
Description: Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.
CVSS Score: 3.7 (LOW)
CWE: CWE-120, CWE-120
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-41570
Published: 2023-11-14
Description: MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://www.enricobassetti.it/2023/11/cve-2023-41570-access-control-vulnerability-in-mikrotik-rest-api/; https://www.enricobassetti.it/2023/11/cve-2023-41570-access-control-vulnerability-in-mikrotik-rest-api/
CVE: CVE-2023-45614
Published: 2023-11-14
Description: There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45615
Published: 2023-11-14
Description: There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45616
Published: 2023-11-14
Description: There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45617
Published: 2023-11-14
Description: There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.


CVSS Score: 8.2 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45618
Published: 2023-11-14
Description: There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.


CVSS Score: 8.2 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45619
Published: 2023-11-14
Description: There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.


CVSS Score: 8.2 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45620
Published: 2023-11-14
Description: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.


CVSS Score: 7.5 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45621
Published: 2023-11-14
Description: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45622
Published: 2023-11-14
Description: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45623
Published: 2023-11-14
Description: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.


CVSS Score: 7.5 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45624
Published: 2023-11-14
Description: An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.


CVSS Score: 7.5 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45625
Published: 2023-11-14
Description: Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45626
Published: 2023-11-14
Description: An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-45627
Published: 2023-11-14
Description: An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal

operation of the affected access point.


CVSS Score: 4.3 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE: CVE-2023-47517
Published: 2023-11-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.23.11.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/sendpress/wordpress-sendpress-newsletters-plugin-1-22-3-31-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sendpress/wordpress-sendpress-newsletters-plugin-1-22-3-31-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve