deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-48538
Published: 2023-08-22
Description: In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://docs.cacti.net/Settings-Auth-LDAP.md; https://github.com/Cacti/cacti/issues/5189; https://docs.cacti.net/Settings-Auth-LDAP.md
CVE: CVE-2022-48541
Published: 2023-08-22
Description: A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command.
CVSS Score: 7.1 (HIGH)
CWE: CWE-401
References: https://github.com/ImageMagick/ImageMagick/issues/2889; https://lists.debian.org/debian-lts-announce/2024/03/msg00020.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LICYTADFJAFPZW3Y2MKNCJIUYODPAG4L/
CVE: CVE-2022-48545
Published: 2023-08-22
Description: An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42092; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42092
CVE: CVE-2022-48547
Published: 2023-08-22
Description: A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cacti/cacti/issues/1882; https://github.com/Cacti/cacti/issues/1882
CVE: CVE-2022-48554
Published: 2023-08-22
Description: File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2024/Mar/21; http://seclists.org/fulldisclosure/2024/Mar/24; http://seclists.org/fulldisclosure/2024/Mar/25
CVE: CVE-2022-48560
Published: 2023-08-22
Description: A use-after-free exists in Python through 3.9 via heappushpop in heapq.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://bugs.python.org/issue39421; https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html; https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
CVE: CVE-2022-48564
Published: 2023-08-22
Description: read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://bugs.python.org/issue42103; https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-48565
Published: 2023-08-22
Description: An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://bugs.python.org/issue42051; https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html; https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
CVE: CVE-2022-48566
Published: 2023-08-22
Description: An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://bugs.python.org/issue40791; https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html; https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
CVE: CVE-2022-48570
Published: 2023-08-22
Description: Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was not 16-byte aligned. NOTE: this issue exists because the CVE-2019-14318 fix was intentionally removed for functionality reasons.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/weidai11/cryptopp/issues/992; https://github.com/weidai11/cryptopp/releases/tag/CRYPTOPP_8_4_0; https://github.com/weidai11/cryptopp/issues/992
CVE: CVE-2022-48571
Published: 2023-08-22
Description: memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/memcached/memcached/commit/6b319c8c7a29e9c353dec83dc92f01905f6c8966; https://lists.debian.org/debian-lts-announce/2023/09/msg00004.html; https://github.com/memcached/memcached/commit/6b319c8c7a29e9c353dec83dc92f01905f6c8966
CVE: CVE-2023-23563
Published: 2023-08-22
Description: An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to obtain sensitive database content via SQL Injection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Orange-Cyberdefense/CVE-repository; https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/poc_geomatika_isigeoweb.md; https://www.geomatika.fr/isigeo-web/
CVE: CVE-2023-23564
Published: 2023-08-22
Description: An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to execute commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/Orange-Cyberdefense/CVE-repository; https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/poc_geomatika_isigeoweb.md; https://www.geomatika.fr/isigeo-web/
CVE: CVE-2023-23565
Published: 2023-08-22
Description: An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to retrieve PHP files from the server via Local File Inclusion.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-98
References: https://github.com/Orange-Cyberdefense/CVE-repository; https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/poc_geomatika_isigeoweb.md; https://www.geomatika.fr/isigeo-web/
CVE: CVE-2023-24514
Published: 2023-08-22
Description: Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-24515
Published: 2023-08-22
Description: Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the application allows other scheme such as file, which could allow a malicious user to fetch internal file content. This issue affects Pandora FMS v767 version and prior versions on all platforms.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://gist.github.com/damodarnaik/9cc76c6b320510c34a0a668bd7439f7b; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://gist.github.com/damodarnaik/9cc76c6b320510c34a0a668bd7439f7b
CVE: CVE-2023-24516
Published: 2023-08-22
Description: Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal  the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/Argonx21/5ef4d123c975285b3a42835c8e81603a; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://gist.github.com/Argonx21/5ef4d123c975285b3a42835c8e81603a
CVE: CVE-2023-24517
Published: 2023-08-22
Description: Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbitrary system commands. This issue affects Pandora FMS v767 version and prior versions on all platforms.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://gist.github.com/Argonx21/9ab62f6e5d8bc6d39b8a338426af121e; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://gist.github.com/Argonx21/9ab62f6e5d8bc6d39b8a338426af121e
CVE: CVE-2023-30078
Published: 2023-08-22
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-32181. Reason: This record is a duplicate of CVE-2023-32181. Notes: All CVE users should reference CVE-2023-32181 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2023-30079
Published: 2023-08-22
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-22652. Reason: This record is a duplicate of CVE-2023-22652. Notes: All CVE users should reference CVE-2023-22652 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2023-34853
Published: 2023-08-22
Description: Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of SmcSecurityEraseSetupVar variable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.supermicro.com/Bios/softfiles/17136/X12DPG-QR_1.4b_X1.02.61_SUM2.10.0.zip.; https://www.supermicro.com/en/support/security_BIOS_Aug_2023; https://www.supermicro.com/Bios/softfiles/17136/X12DPG-QR_1.4b_X1.02.61_SUM2.10.0.zip.
CVE: CVE-2023-36281
Published: 2023-08-22
Description: An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a template.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://aisec.today/LangChain-2e6244a313dd46139c5ef28cbcab9e55; https://github.com/hwchase17/langchain/issues/4394; https://github.com/langchain-ai/langchain/releases/tag/v0.0.312
CVE: CVE-2023-37421
Published: 2023-08-22
Description: Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37422
Published: 2023-08-22
Description: Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37423
Published: 2023-08-22
Description: Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37424
Published: 2023-08-22
Description: A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37425
Published: 2023-08-22
Description: A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37426
Published: 2023-08-22
Description: EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability could allow an attacker to spoof the SSH host signature and thereby masquerade as a legitimate Orchestrator
host.
CVSS Score: 7.4 (HIGH)
CWE: CWE-798
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37427
Published: 2023-08-22
Description: A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37428
Published: 2023-08-22
Description: A vulnerability in the EdgeConnect SD-WAN Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37429
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37430
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37431
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37432
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37433
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37434
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37435
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37436
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37437
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37438
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37439
Published: 2023-08-22
Description: Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to
    obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-922
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-37440
Published: 2023-08-22
Description: A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal
    structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CVE: CVE-2023-38665
Published: 2023-08-22
Description: Null pointer dereference in ieee_write_file in nasm 2.16rc0 allows attackers to cause a denial of service (crash).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392818; https://bugzilla.nasm.us/show_bug.cgi?id=3392818
CVE: CVE-2023-38666
Published: 2023-08-22
Description: Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/axiomatic-systems/Bento4/issues/784; https://github.com/axiomatic-systems/Bento4/issues/784