deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28180
Published: 2023-05-08
Description: A denial-of-service issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. A user in a privileged network position may be able to cause a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213670; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1678
CVE: CVE-2023-28181
Published: 2023-05-08
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Monterey 12.6.4, macOS Big Sur 11.7.7, tvOS 16.4, watchOS 9.4. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213674; https://support.apple.com/en-us/HT213676
CVE: CVE-2023-28182
Published: 2023-05-08
Description: The issue was addressed with improved authentication. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A user in a privileged network position may be able to spoof a VPN server that is configured with EAP-only authentication on a device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213673; https://support.apple.com/en-us/HT213675
CVE: CVE-2023-28189
Published: 2023-05-08
Description: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to view sensitive information.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213675; https://support.apple.com/en-us/HT213677
CVE: CVE-2023-28190
Published: 2023-05-08
Description: A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in macOS Ventura 13.3. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-28192
Published: 2023-05-08
Description: A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213675; https://support.apple.com/en-us/HT213677
CVE: CVE-2023-28194
Published: 2023-05-08
Description: The issue was addressed with improved checks. This issue is fixed in iOS 16.4 and iPadOS 16.4. An app may be able to unexpectedly create a bookmark on the Home Screen.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/en-us/HT213676; https://support.apple.com/en-us/HT213676
CVE: CVE-2023-28200
Published: 2023-05-08
Description: A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to disclose kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-203
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213673; https://support.apple.com/en-us/HT213675
CVE: CVE-2023-28201
Published: 2023-05-08
Description: This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4. A remote user may be able to cause unexpected app termination or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-362
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213671; https://support.apple.com/en-us/HT213673
CVE: CVE-2023-30787
Published: 2023-05-08
Description: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/introductions` endpoint and first_met_additional_info parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/napoli; https://www.monicahq.com/; https://fluidattacks.com/advisories/napoli
CVE: CVE-2023-30788
Published: 2023-05-08
Description: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people/add` endpoint and nickName, description, lastName, middleName and firstName parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/napoli; https://www.monicahq.com/; https://fluidattacks.com/advisories/napoli
CVE: CVE-2023-30789
Published: 2023-05-08
Description: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/work` endpoint and job and company parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/napoli; https://www.monicahq.com/; https://fluidattacks.com/advisories/napoli
CVE: CVE-2023-30790
Published: 2023-05-08
Description: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/relationships` endpoint and first_name and last_name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/napoli; https://www.monicahq.com/; https://fluidattacks.com/advisories/napoli
CVE: CVE-2023-32233
Published: 2023-05-08
Description: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html; http://www.openwall.com/lists/oss-security/2023/05/15/5; https://bugzilla.redhat.com/show_bug.cgi?id=2196105
CVE: CVE-2023-21404
Published: 2023-05-08
Description: AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used in any other secure communication nor can it be used to compromise the device or any customer data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-321, CWE-311
References: https://www.axis.com/dam/public/07/0a/20/cve-2023-21404-en-US-398426.pdf; https://www.axis.com/dam/public/07/0a/20/cve-2023-21404-en-US-398426.pdf
CVE: CVE-2023-24505
Published: 2023-05-08
Description: 
Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request. 


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-24506
Published: 2023-05-08
Description: 


Milesight NCR/camera version 71.8.0.6-r5 exposes credentials through an unspecified request. 

 


CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522, CWE-522
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-24507
Published: 2023-05-08
Description: 


AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload - Vulnerability allows insecure file upload, by an unspecified request.


CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-2478
Published: 2023-05-08
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-732, CWE-732
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2478.json; https://gitlab.com/gitlab-org/gitlab/-/issues/409470; https://hackerone.com/reports/1969599
CVE: CVE-2023-2513
Published: 2023-05-08
Description: A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2193097; https://github.com/torvalds/linux/commit/67d7d8ad99be; https://lore.kernel.org/all/[PII_REDACTED][PII_REDACTED]-1-libaokun1%40huawei.com/
CVE: CVE-2023-2582
Published: 2023-05-08
Description: A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built with Strikingly. The vulnerability exists because of Strikingly JavaScript library parsing the URL fragment allows access to the __proto__ or constructor properties and the Object prototype. By leveraging an embedded gadget like jQuery, an attacker who convinces a victim to visit a specially crafted link could achieve arbitrary javascript execution in the context of the user's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1321, CWE-1321
References: https://www.tenable.com/security/research/tra-2023-18; https://www.tenable.com/security/research/tra-2023-18
CVE: CVE-2023-30334
Published: 2023-05-08
Description: AsmBB v2.9.1 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the MiniMag.asm and bbcode.asm libraries.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://asm32.info/fossil/asmbb/info/7dfa4f56b473f76c; https://board.asm32.info/thanks-to-the-hxp-ctf-challenge-several-serious-vulnerabilities-has-been-fixed.394/; https://ctf.zeyu2001.com/2023/hxp-ctf/true_web_assembly
CVE: CVE-2023-31123
Published: 2023-05-08
Description: `effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b, any user with an account on an instance of `effectindex/tripreporter`, e.g. `subjective.report`, may be affected by an improper password verification vulnerability. The vulnerability allows any user with a password matching the password requirements to log in as any user. This allows access to accounts / data loss of the user. This issue is patched in commit bd80ba833b9023d39ca22e29874296c8729dd53b. No action necessary for users of `subjective.report`, and anyone running their own instance should update to this commit or newer as soon as possible. As a workaround, someone running their own instance may apply the patch manually.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/effectindex/tripreporter/commit/bd80ba833b9023d39ca22e29874296c8729dd53b; https://github.com/effectindex/tripreporter/security/advisories/GHSA-356r-rwp8-h6m6; https://github.com/effectindex/tripreporter/commit/bd80ba833b9023d39ca22e29874296c8729dd53b
CVE: CVE-2023-31125
Published: 2023-05-08
Description: Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package, including those who use depending packages like `socket.io`. This issue was fixed in version 6.4.2 of Engine.IO. There is no known workaround except upgrading to a safe version.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248
References: https://github.com/socketio/engine.io/commit/fc480b4f305e16fe5972cf337d055e598372dc44; https://github.com/socketio/engine.io/releases/tag/6.4.2; https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5
CVE: CVE-2023-31127
Published: 2023-05-08
Description: libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishment in libspdm prior to version 2.3.1. If a device supports both DHE session and PSK session with mutual
authentication, the attacker may be able to establish the session with `KEY_EXCHANGE` and `PSK_FINISH` to bypass the mutual authentication. This is most likely to happen when the Requester begins a session using one method (DHE, for example) and then uses the other method's finish (PSK_FINISH in this example) to establish the session. The session hashes would be expected to fail in this case, but the condition was not detected.

This issue only impacts the SPDM responder, which supports `KEY_EX_CAP=1 and `PSK_CAP=10b` at same time with mutual authentication requirement. The SPDM requester is not impacted. The SPDM responder is not impacted if `KEY_EX_CAP=0` or `PSK_CAP=0` or `PSK_CAP=01b`. The SPDM responder is not impacted if mutual authentication is not required.

libspdm 1.0, 2.0, 2.1, 2.2, 2.3 are all impacted. Older branches are not maintained, but users of the 2.3 branch may receive a patch in version 2.3.2. The SPDM specification (DSP0274) does not contain this vulnerability.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-287, CWE-372, CWE-287
References: https://github.com/DMTF/libspdm/pull/2006; https://github.com/DMTF/libspdm/pull/2007; https://github.com/DMTF/libspdm/security/advisories/GHSA-qw76-4v8p-xq9f
CVE: CVE-2023-31129
Published: 2023-05-08
Description: The Contiki-NG operating system versions 4.8 and prior can be triggered to dereference a NULL pointer in the message handling code for IPv6 router solicitiations. Contiki-NG contains an implementation of IPv6 Neighbor Discovery (ND) in the module `os/net/ipv6/uip-nd6.c`. The ND protocol includes a message type called Router Solicitation (RS), which is used to locate routers and update their address information via the SLLAO (Source Link-Layer Address Option). If the indicated source address changes, a given neighbor entry is set to the STALE state.

The message handler does not check for RS messages with an SLLAO that indicates a link-layer address change that a neighbor entry can actually be created for the indicated address. The resulting pointer is used without a check, leading to the dereference of a NULL pointer of type `uip_ds6_nbr_t`.

The problem has been patched in the `develop` branch of Contiki-NG, and will be included in the upcoming 4.9 release. As a workaround, users can apply Contiki-NG pull request #2271 to patch the problem directly.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/contiki-ng/contiki-ng/pull/2271; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-x29r-5qjg-75mq; https://github.com/contiki-ng/contiki-ng/pull/2271
CVE: CVE-2023-31133
Published: 2023-05-08
Description: Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.

Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/TryGhost/Ghost/commit/b3caf16005289cc[PII_REDACTED]b4a26f3f4a66a90; https://github.com/TryGhost/Ghost/releases/tag/v5.46.1; https://github.com/TryGhost/Ghost/security/advisories/GHSA-r97q-ghch-82j9
CVE: CVE-2023-31140
Published: 2023-05-08
Description: OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device on behalf of a user, their existing sessions are not terminated. The issue has been resolved in OpenProject version 12.5.4 by actively terminating sessions of user accounts having registered and confirmed a 2FA device. As a workaround, users who register the first 2FA device on their account can manually log out to terminate all other active sessions. This is the default behavior of OpenProject but might be disabled through a configuration option. Double check that this option is not overridden if one plans to employ the workaround.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-613
References: https://community.openproject.org/wp/48035; https://github.com/opf/openproject/pull/12508; https://github.com/opf/openproject/security/advisories/GHSA-xfp9-qqfj-x28q
CVE: CVE-2023-31141
Published: 2023-05-08
Description: OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-863
References: https://github.com/opensearch-project/security/security/advisories/GHSA-g8xc-6mf7-h28h; https://github.com/opensearch-project/security/security/advisories/GHSA-g8xc-6mf7-h28h
CVE: CVE-2023-31178
Published: 2023-05-08
Description: AgilePoint NX v8.0 SU2.2 & SU2.3 – Arbitrary File Delete Vulnerability allows arbitrary file deletion, by an unspecified request.


CVSS Score: 8.1 (HIGH)
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-31179
Published: 2023-05-08
Description: AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversal - Vulnerability allows path traversal and downloading files from the server, by an unspecified request.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-31180
Published: 2023-05-08
Description: 
WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS) through an unspecified request.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-31181
Published: 2023-05-08
Description: 
WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - CWE-22: Path Traversal



CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-31182
Published: 2023-05-08
Description: 
 EasyTor Applications – Authorization Bypass - EasyTor Applications may allow authorization bypass via unspecified method.





CVSS Score: 8.1 (HIGH)
CWE: CWE-639, CWE-639
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-31183
Published: 2023-05-08
Description: 
 Cybonet PineApp Mail Secure A reflected cross-site scripting (XSS) vulnerability was identified in the product, using an unspecified endpoint.







CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23894
Published: 2023-05-08
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Surbma Surbma | GDPR Proof Cookie Consent & Notice Bar plugin <= 17.5.3 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/surbma-gdpr-proof-google-analytics/wordpress-surbma-gdpr-proof-cookie-consent-notice-bar-plugin-17-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/surbma-gdpr-proof-google-analytics/wordpress-surbma-gdpr-proof-cookie-consent-notice-bar-plugin-17-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24376
Published: 2023-05-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nico Graff WP Simple Events plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-simple-events/wordpress-wp-simple-events-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-simple-events/wordpress-wp-simple-events-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-22710
Published: 2023-05-08
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in chilidevs Return and Warranty Management System for WooCommerce plugin <= 1.2.3 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wc-return-warrranty/wordpress-return-and-warranty-management-system-for-woocommerce-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc-return-warrranty/wordpress-return-and-warranty-management-system-for-woocommerce-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-22813
Published: 2023-05-08
Description: 









A device API
endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy
and missing authentication requirement for private IPs, a remote attacker on
the same network as the device could obtain device information by convincing a
victim user to visit an attacker-controlled server and issue a cross-site
request.



This issue affects
My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My
Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126;
ibi Web App: before 4.26.0-6126.


CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-862
References: https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update; https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update
CVE: CVE-2023-28762
Published: 2023-05-09
Description: SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user interaction. The attacker can impersonate any user on the platform resulting into accessing and modifying data. The attacker can also make the system partially or entirely unavailable.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://launchpad.support.sap.com/#/notes/3307833; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3307833