deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-0356
Published: 2024-01-10
Description: A vulnerability has been found in Mandelo ssm_shiro_blog 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file updateRoles of the component Backend. The manipulation leads to improper access controls. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250123.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://medium.com/@heishou/ssm-has-a-vertical-override-vulnerability-8728da71842e; https://vuldb.com/?ctiid.250123; https://vuldb.com/?id.250123
CVE: CVE-2024-0357
Published: 2024-01-10
Description: A vulnerability was found in coderd-repos Eva 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /system/traceLog/page of the component HTTP POST Request Handler. The manipulation of the argument property leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250124.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/laoquanshi/heishou/blob/main/eva%20sql.md; https://vuldb.com/?ctiid.250124; https://vuldb.com/?id.250124
CVE: CVE-2024-0358
Published: 2024-01-10
Description: A vulnerability was found in DeShang DSO2O up to 4.1.0. It has been classified as critical. This affects an unknown part of the file /install/install.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250125 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://note.zhaoj.in/share/Po2N8SpTuzrV; https://vuldb.com/?ctiid.250125; https://vuldb.com/?id.250125
CVE: CVE-2024-0359
Published: 2024-01-10
Description: A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250126 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ZJQcicadawings/VulSql/blob/main/Simple%20Online%20Hotel%20Reservation%20System%20login.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.250126; https://vuldb.com/?id.250126
CVE: CVE-2024-0360
Published: 2024-01-10
Description: A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/edit-doctor-specialization.php. The manipulation of the argument doctorspecilization leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250127.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/laoquanshi/PHPGurukul-Hospital-Management-System/blob/main/PHPGurukul%20Hospital%20Management%20System%20SQL4.docx; https://vuldb.com/?ctiid.250127; https://vuldb.com/?id.250127
CVE: CVE-2023-31446
Published: 2024-01-10
Description: In Cassia Gateway firmware XC1000_2.1.[PII_REDACTED] and XC2000_2.1.[PII_REDACTED], the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://blog.kscsc.online/cves/202331446/md.html; https://github.com/Dodge-MPTC/CVE-2023-31446-Remote-Code-Execution; https://www.cassianetworks.com
CVE: CVE-2024-0361
Published: 2024-01-10
Description: A vulnerability classified as critical has been found in PHPGurukul Hospital Management System 1.0. Affected is an unknown function of the file admin/contact.php. The manipulation of the argument mobnum leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250128.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/laoquanshi/PHPGurukul-Hospital-Management-System/blob/main/PHPGurukul%20Hospital%20Management%20System%20SQL7.docx; https://vuldb.com/?ctiid.250128; https://vuldb.com/?id.250128
CVE: CVE-2024-0362
Published: 2024-01-10
Description: A vulnerability classified as critical was found in PHPGurukul Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/change-password.php. The manipulation of the argument cpass leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-250129 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/laoquanshi/PHPGurukul-Hospital-Management-System/blob/main/PHPGurukul%20Hospital%20Management%20System%20SQL8.docx; https://vuldb.com/?ctiid.250129; https://vuldb.com/?id.250129
CVE: CVE-2024-0363
Published: 2024-01-10
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file admin/patient-search.php. The manipulation of the argument searchdata leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250130 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/laoquanshi/PHPGurukul-Hospital-Management-System/blob/main/PHPGurukul%20Hospital%20Management%20System%20SQL10.docx; https://vuldb.com/?ctiid.250130; https://vuldb.com/?id.250130
CVE: CVE-2024-0364
Published: 2024-01-10
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file admin/query-details.php. The manipulation of the argument adminremark leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250131.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/laoquanshi/PHPGurukul-Hospital-Management-System/blob/main/PHPGurukul%20Hospital%20Management%20System%20SQL11.docx; https://vuldb.com/?ctiid.250131; https://vuldb.com/?id.250131
CVE: CVE-2024-21643
Published: 2024-01-10
Description: IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94
References: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0; https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2; https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-rv9j-c866-gp5h
CVE: CVE-2023-41781
Published: 2024-01-10
Description: 
There is a Cross-site scripting (XSS)  vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be triggered.


CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034684; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034684
CVE: CVE-2022-46025
Published: 2024-01-10
Description: Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://pastebin.com/aan5jT40; https://pastebin.com/aan5jT40
CVE: CVE-2023-41603
Published: 2024-01-10
Description: D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers to arbitrarily access any services running on the device that may be inadvertently listening via IPv6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10347; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10347
CVE: CVE-2023-48864
Published: 2024-01-10
Description: SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://gitee.com/NoBlake/cve-2023-48864; https://gitee.com/NoBlake/cve-2023-48864
CVE: CVE-2020-26627
Published: 2024-01-10
Description: A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a crafted payload entered into the 'Admin Remark' parameter under the 'Contact Us Queries -> Unread Query' tab.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://packetstormsecurity.com/files/176302/Hospital-Management-System-4.0-XSS-Shell-Upload-SQL-Injection.html; https://packetstormsecurity.com/files/176302/Hospital-Management-System-4.0-XSS-Shell-Upload-SQL-Injection.html
CVE: CVE-2020-26628
Published: 2024-01-10
Description: A Cross-Site Scripting (XSS) vulnerability was discovered in Hospital Management System V4.0 which allows an attacker to execute arbitrary web scripts or HTML code via a malicious payload appended to a username on the 'Edit Profile" page and triggered by another user visiting the profile.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/176302/Hospital-Management-System-4.0-XSS-Shell-Upload-SQL-Injection.html; https://packetstormsecurity.com/files/176302/Hospital-Management-System-4.0-XSS-Shell-Upload-SQL-Injection.html
CVE: CVE-2020-26629
Published: 2024-01-10
Description: A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload any file to the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://packetstormsecurity.com/files/176302/Hospital-Management-System-4.0-XSS-Shell-Upload-SQL-Injection.html; https://packetstormsecurity.com/files/176302/Hospital-Management-System-4.0-XSS-Shell-Upload-SQL-Injection.html
CVE: CVE-2020-26630
Published: 2024-01-10
Description: A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a special payload in the 'Doctor Specialization' field under the 'Go to Doctors' tab after logging in as an admin.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://packetstormsecurity.com/files/176302/Hospital-Management-System-4.0-XSS-Shell-Upload-SQL-Injection.html; https://packetstormsecurity.com/files/176302/Hospital-Management-System-4.0-XSS-Shell-Upload-SQL-Injection.html
CVE: CVE-2023-49394
Published: 2024-01-10
Description: Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://gist.github.com/xue-yao-go/87d088fa3f423bba8098ef22988e4626; https://narrow-payment-2cd.notion.site/zentao-4-1-3-is-vulnerable-URL-redirect-b03f8f9f5b4e4cbea819c2961c097d92?pvs=4; https://gist.github.com/xue-yao-go/87d088fa3f423bba8098ef22988e4626
CVE: CVE-2023-49427
Published: 2024-01-10
Description: Buffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of service (DoS) via list parameter in SetNetControlList function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetNetControlList.md; https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetNetControlList.md
CVE: CVE-2023-49471
Published: 2024-01-10
Description: Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make(), which could allow authenticated remote attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/zunak/CVE-2023-49471; https://github.com/zunak/CVE-2023-49471
CVE: CVE-2023-49619
Published: 2024-01-10
Description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.2.0.

Under normal circumstances, a user can only bookmark a question once, and will only increase the number of questions bookmarked once. However, repeat submissions through the script can increase the number of collection of the question many times.

Users are recommended to upgrade to version [1.2.1], which fixes the issue.
CVSS Score: 3.1 (LOW)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2024/01/10/1; https://lists.apache.org/thread/nscrl3c7pn68q4j73y3ottql6n5x3hd4; http://www.openwall.com/lists/oss-security/2024/01/10/1
CVE: CVE-2023-50120
Published: 2024-01-10
Description: MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_parsers.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://github.com/gpac/gpac/issues/2698; https://github.com/gpac/gpac/issues/2698
CVE: CVE-2023-51252
Published: 2024-01-10
Description: PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sanluan/PublicCMS/issues/79; https://github.com/sanluan/PublicCMS/issues/79
CVE: CVE-2023-48242
Published: 2024-01-10
Description: The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48243
Published: 2024-01-10
Description: The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48244
Published: 2024-01-10
Description: The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48245
Published: 2024-01-10
Description: The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48246
Published: 2024-01-10
Description: The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48247
Published: 2024-01-10
Description: The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48248
Published: 2024-01-10
Description: The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48249
Published: 2024-01-10
Description: The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.

By abusing this vulnerability, it is possible to steal session cookies of other active users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48250
Published: 2024-01-10
Description: The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798, CWE-798
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2024-0310
Published: 2024-01-10
Description: 
A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy configuration. 


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10417; https://kcm.trellix.com/corporate/index?page=content&id=SB10417
CVE: CVE-2023-48251
Published: 2024-01-10
Description: The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798, CWE-798
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48252
Published: 2024-01-10
Description: The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48253
Published: 2024-01-10
Description: The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request.
By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with arbitrary values and access their accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48254
Published: 2024-01-10
Description: The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48255
Published: 2024-01-10
Description: The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48256
Published: 2024-01-10
Description: The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-113, CWE-436
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48257
Published: 2024-01-10
Description: The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticated users, by accessing already-exported backup packages, or crafting an import package and inducing an authenticated victim into sending the HTTP upload request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1391, CWE-287
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48258
Published: 2024-01-10
Description: The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP
request through a victim’s session.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48259
Published: 2024-01-10
Description: The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48260
Published: 2024-01-10
Description: The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
CVE: CVE-2023-48261
Published: 2024-01-10
Description: The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89, CWE-89, CWE-89
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html