deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-45875
Published: 2023-11-08
Description: An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2023-46362
Published: 2023-11-08
Description: jbig2enc v0.28 was discovered to contain a heap-use-after-free via jbig2enc_auto_threshold_using_hash in src/jbig2enc.cc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/agl/jbig2enc; https://github.com/agl/jbig2enc/issues/84; https://github.com/agl/jbig2enc
CVE: CVE-2023-46363
Published: 2023-11-08
Description: jbig2enc v0.28 was discovered to contain a SEGV via jbig2_add_page in src/jbig2enc.cc:512.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/agl/jbig2enc; https://github.com/agl/jbig2enc/issues/85; https://github.com/agl/jbig2enc
CVE: CVE-2023-36667
Published: 2023-11-08
Description: Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://www.couchbase.com/alerts/; https://docs.couchbase.com/server/current/release-notes/relnotes.html
CVE: CVE-2023-43567
Published: 2023-11-08
Description: A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43568
Published: 2023-11-08
Description: A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-126
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43569
Published: 2023-11-08
Description: A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43570
Published: 2023-11-08
Description: 
A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute arbitrary code. 


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-47109
Published: 2023-11-08
Description: PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285
References: https://github.com/PrestaShop/blockreassurance/commit/2d0e97bebf795690caffe33c1ab23a9bf43fcdfa; https://github.com/PrestaShop/blockreassurance/commit/eec00da564db4c1804b0a0d1e3d9f7ec4e27d823; https://github.com/PrestaShop/blockreassurance/releases/tag/v5.1.4
CVE: CVE-2023-47111
Published: 2023-11-08
Description: ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit, will lock the user and prevent further authentication. In the affected implementation it was possible for an attacker to start multiple parallel password checks, giving him the possibility to try out more combinations than configured in the `Lockout Policy`. This vulnerability has been patched in versions 2.40.5 and 2.38.3.

CVSS Score: 7.3 (HIGH)
CWE: CWE-362
References: https://github.com/zitadel/zitadel/commit/22e2d[PII_REDACTED]877e054ebe82fb834a5aa1077; https://github.com/zitadel/zitadel/releases/tag/v2.38.3; https://github.com/zitadel/zitadel/releases/tag/v2.40.5
CVE: CVE-2023-47113
Published: 2023-11-08
Description: BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By placing a DLL in the Folder c:\DLLs, an attacker can run arbitrary code on every execution of BleachBit for Windows. This issue has been patched in version 4.5.0.

CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://github.com/bleachbit/bleachbit/security/advisories/GHSA-j8jc-f6p7-55p8; https://github.com/bleachbit/bleachbit/security/advisories/GHSA-j8jc-f6p7-55p8
CVE: CVE-2023-47114
Published: 2023-11-08
Description: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine. It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the `file://` protocol. Exploitation is limited to rogue Admin UI users, malicious connected system / data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves. This vulnerability has been patched in version 2.23.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1; https://github.com/ethyca/fides/releases/tag/2.23.3; https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38
CVE: CVE-2023-4632
Published: 2023-11-08
Description: An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://support.lenovo.com/us/en/product_security/LEN-135367; https://support.lenovo.com/us/en/product_security/LEN-135367
CVE: CVE-2023-4706
Published: 2023-11-08
Description: 
A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrect default privileges.


CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-127385; https://support.lenovo.com/us/en/product_security/LEN-127385
CVE: CVE-2023-4891
Published: 2023-11-08
Description: 
A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service. 


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://support.lenovo.com/us/en/product_security/LEN-135344; https://support.lenovo.com/us/en/product_security/LEN-135344
CVE: CVE-2023-5075
Published: 2023-11-08
Description: A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-5078
Published: 2023-11-08
Description: A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware.
CVSS Score: 6.7 (MEDIUM)
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-5079
Published: 2023-11-08
Description: Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure.







CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://iknow.lenovo.com.cn/detail/418253?; https://iknow.lenovo.com.cn/detail/418253?
CVE: CVE-2023-39435
Published: 2023-11-08
Description: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 IP Cameras 

with firmware version M2.1.6.05 are 
vulnerable to stack-based overflows. During the process of updating 
certain settings sent from incoming network requests, the product does 
not sufficiently check or validate allocated buffer size. This may lead 
to remote code execution.


CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
CVE: CVE-2023-3959
Published: 2023-11-08
Description: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 

IP Cameras

with firmware version M2.1.6.05 are 
vulnerable to multiple instances of stack-based overflows. While 
processing XML elements from incoming network requests, the product does
 not sufficiently check or validate allocated buffer size. This may lead
 to remote code execution.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
CVE: CVE-2023-43571
Published: 2023-11-08
Description: A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43572
Published: 2023-11-08
Description: A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43573
Published: 2023-11-08
Description: A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43574
Published: 2023-11-08
Description: A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges

to disclose sensitive information.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43575
Published: 2023-11-08
Description: A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43576
Published: 2023-11-08
Description: A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43577
Published: 2023-11-08
Description: A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43578
Published: 2023-11-08
Description: A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43579
Published: 2023-11-08
Description: A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43580
Published: 2023-11-08
Description: A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43581
Published: 2023-11-08
Description: A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-43755
Published: 2023-11-08
Description: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 

IP Cameras 

with firmware version M2.1.6.05 are 
vulnerable to multiple instances of stack-based overflows. During the 
processing and parsing of certain fields in XML elements from incoming 
network requests, the product does not sufficiently check or validate 
allocated buffer size. This may lead to remote code execution.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
CVE: CVE-2023-45075
Published: 2023-11-08
Description: A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-45076
Published: 2023-11-08
Description: A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.

CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-45077
Published: 2023-11-08
Description: A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. 
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-45078
Published: 2023-11-08
Description: A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables. 
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-45079
Published: 2023-11-08
Description: A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables. 


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-141775; https://support.lenovo.com/us/en/product_security/LEN-141775
CVE: CVE-2023-45225
Published: 2023-11-08
Description: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 

IP Cameras  with firmware version M2.1.6.05 are 
vulnerable to multiple instances of stack-based overflows. While parsing
 certain XML elements from incoming network requests, the product does 
not sufficiently check or validate allocated buffer size. This may lead 
to remote code execution.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
CVE: CVE-2023-4249
Published: 2023-11-08
Description: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 

IP Cameras 

with firmware version M2.1.6.05 has a 
command injection vulnerability in their implementation of their 
binaries and handling of network requests.


CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
CVE: CVE-2021-43609
Published: 2023-11-09
Description: An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in app/models/reporting/database_query.rb allows an authenticated attacker to execute arbitrary SQL commands via the sort parameter. This can be leveraged to leak local files from the host system, leading to remote code execution (RCE) through deserialization of malicious data.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89
References: https://community.spiceworks.com/blogs/help-desk-server-release-notes/3610-1-3-2-1-3-3; https://github.com/d5sec/CVE-2021-43609-POC; https://www.linkedin.com/pulse/cve-2021-43609-write-up-division5-security-4lgwe
CVE: CVE-2023-37533
Published: 2023-11-09
Description: HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434
CVE: CVE-2023-37790
Published: 2023-11-09
Description: Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/173508/Clarity-PPM-14.3.0.298-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/173508/Clarity-PPM-14.3.0.298-Cross-Site-Scripting.html
CVE: CVE-2023-20902
Published: 2023-11-09
Description: A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below,  Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to 
create jobs/stop job tasks and retrieve job task information.



CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf; https://github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf
CVE: CVE-2023-47005
Published: 2023-11-09
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-47006
Published: 2023-11-09
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-47007
Published: 2023-11-09
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-47008
Published: 2023-11-09
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-26156
Published: 2023-11-09
Description: Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system.**Note:**An attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-78, CWE-78, CWE-78
References: https://gist.github.com/mcoimbra/47b1da554a80795c45126d51e41b2b18; https://github.com/giggio/node-chromedriver/commit/de961e34e023afcf4fa5c0faeeec69aaa6c3c815; https://security.snyk.io/vuln/SNYK-JS-CHROMEDRIVER-6049539
CVE: CVE-2023-46492
Published: 2023-11-09
Description: Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the public_html/doc/index.html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/cd80/a75b618419d5afb137cd5a29e8156420; https://gist.github.com/cd80/a75b618419d5afb137cd5a29e8156420
CVE: CVE-2023-47488
Published: 2023-11-09
Description: Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attrib_manager_id parameter in the General Information page and the id parameter in the contact page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugplorer.github.io/cve-xss-itop/; https://nitipoom-jar.github.io/CVE-2023-47488/; https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-47488