deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4098
Published: 2023-10-03
Description: It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige
CVE: CVE-2023-4099
Published: 2023-10-03
Description: The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.
CVSS Score: 7.6 (HIGH)
CWE: CWE-639, CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige
CVE: CVE-2023-4100
Published: 2023-10-03
Description: Allows an attacker to perform XSS attacks stored on certain resources. Exploiting this vulnerability can lead to a DoS condition, among other actions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige
CVE: CVE-2023-4101
Published: 2023-10-03
Description: The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige
CVE: CVE-2023-4102
Published: 2023-10-03
Description: QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige
CVE: CVE-2023-4103
Published: 2023-10-03
Description: QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-idm-sistemas-qsige
CVE: CVE-2023-5350
Published: 2023-10-03
Description:  SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/salesagility/suitecrm/commit/c43eaa311fb010b7928983e6afc6f9075c3996aa; https://huntr.dev/bounties/c56563cb-b74e-4174-a09a-cd07689d6736; https://github.com/salesagility/suitecrm/commit/c43eaa311fb010b7928983e6afc6f9075c3996aa
CVE: CVE-2023-5351
Published: 2023-10-03
Description: Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/salesagility/suitecrm/commit/c43eaa311fb010b7928983e6afc6f9075c3996aa; https://huntr.dev/bounties/f7c7fcbc-5421-4a29-9385-346a1caa485b; https://github.com/salesagility/suitecrm/commit/c43eaa311fb010b7928983e6afc6f9075c3996aa
CVE: CVE-2023-2681
Published: 2023-10-03
Description: An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious SQL code on the "/leaves/validate" path and the “id” parameter, managing to extract arbritary information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/jorani-sql-injection; https://www.incibe.es/en/incibe-cert/notices/aviso/jorani-sql-injection
CVE: CVE-2023-32669
Published: 2023-10-03
Description: Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss
CVE: CVE-2023-32670
Published: 2023-10-03
Description: Cross-Site Scripting vulnerability 

in BuddyBoss 2.2.9 version

, which could allow a local attacker with basic privileges to execute a malicious payload through the "[name]=image.jpg" parameter, allowing to assign a persistent javascript payload that would be triggered when the associated image is loaded.

CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss
CVE: CVE-2023-32671
Published: 2023-10-03
Description: A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript payload via POST request when sending an invitation.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss
CVE: CVE-2023-32790
Published: 2023-10-03
Description: Cross-Site Scripting (XSS) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inject a malicious JavaScript payload into the 'Full Name' field during a user edit, due to improper sanitization of the input parameter.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nxlog-manager; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nxlog-manager
CVE: CVE-2023-32791
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts within the platform by sending a specifically crafted query to the server. The vulnerability is based on the lack of proper validation of the origin of incoming requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nxlog-manager; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nxlog-manager
CVE: CVE-2023-32792
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to eliminate roles within the platform by sending a specifically crafted query to the server. The vulnerability is based on the absence of proper validation of the origin of incoming requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nxlog-manager; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nxlog-manager
CVE: CVE-2023-39159
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin <= 2.1.5 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers/wordpress-fraud-prevention-for-woocommerce-plugin-2-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers/wordpress-fraud-prevention-for-woocommerce-plugin-2-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-40009
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-pipes/wordpress-wp-pipes-plugin-1-4-0-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-pipes/wordpress-wp-pipes-plugin-1-4-0-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-40198
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in Antsanchez Easy Cookie Law plugin <= 3.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/easy-cookie-law/wordpress-easy-cookie-law-plugin-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-cookie-law/wordpress-easy-cookie-law-plugin-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-40199
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab WP Like Button plugin <= 1.7.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-like-button/wordpress-wp-like-button-plugin-1-6-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-like-button/wordpress-wp-like-button-plugin-1-6-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-40201
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in FuturioWP Futurio Extra plugin <= 1.8.4 versions leads to activation of arbitrary plugin.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/futurio-extra/wordpress-futurio-extra-plugin-1-8-2-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/futurio-extra/wordpress-futurio-extra-plugin-1-8-2-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-40202
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in Hannes Etzelstorfer // codemiq WP HTML Mail plugin <= 3.4.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-html-mail/wordpress-email-template-designer-wp-html-mail-plugin-3-4-0-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/wp-html-mail/wordpress-email-template-designer-wp-html-mail-plugin-3-4-0-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-40212
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Product Attachment for WooCommerce plugin <= 2.1.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-product-attachment/wordpress-product-attachment-for-woocommerce-plugin-2-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-product-attachment/wordpress-product-attachment-for-woocommerce-plugin-2-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-42508
Published: 2023-10-03
Description: JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories; https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories
CVE: CVE-2023-5353
Published: 2023-10-03
Description: Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/salesagility/suitecrm/commit/c43eaa311fb010b7928983e6afc6f9075c3996aa; https://huntr.dev/bounties/3b3bb4f1-1aea-4134-99eb-157f245fa752; https://github.com/salesagility/suitecrm/commit/c43eaa311fb010b7928983e6afc6f9075c3996aa
CVE: CVE-2023-0506
Published: 2023-10-03
Description: The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera Control Panel, whose exploitation could allow a low-privileged attacker to gain administrator access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/zerolynx/wstg/blob/master/document/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.md; https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-demes-group-products; https://github.com/zerolynx/wstg/blob/master/document/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.md
CVE: CVE-2023-27435
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin <= 0.3.2 versions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/http-auth/wordpress-http-auth-plugin-0-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/http-auth/wordpress-http-auth-plugin-0-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-2544
Published: 2023-10-03
Description: Authorization bypass vulnerability in UPV PEIX, affecting the component "pdf_curri_new.php". Through a POST request, an authenticated user could change the ID parameter to retrieve all the stored information of other registered users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-upv-peix; https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-upv-peix
CVE: CVE-2023-32091
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in POEditor plugin <= 0.9.4 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/poeditor/wordpress-poeditor-plugin-0-9-4-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/poeditor/wordpress-poeditor-plugin-0-9-4-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2023-39158
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Banner Management For WooCommerce plugin <= 2.4.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/banner-management-for-woocommerce/wordpress-banner-management-for-woocommerce-plugin-2-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/banner-management-for-woocommerce/wordpress-banner-management-for-woocommerce-plugin-2-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-3349
Published: 2023-10-03
Description: Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as usernames, IP addresses or SQL queries sent to the application. By accessing the URL /RPS2019Service/status.html, the application enables the logging mechanism by generating the log file, which can be downloaded.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200, CWE-532
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019
CVE: CVE-2023-3350
Published: 2023-10-03
Description: A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the password hashes coded with AES-CBC-128 bits algorithm, which can be decrypted with a .NET function, obtaining the username's password in plain text.
CVSS Score: 8.2 (HIGH)
CWE: CWE-532, CWE-327
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019
CVE: CVE-2023-40558
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/youtube-showcase/wordpress-video-gallery-management-plugin-3-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/youtube-showcase/wordpress-video-gallery-management-plugin-3-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-41244
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in Buildfail Localize Remote Images plugin <= 1.0.9 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/localize-remote-images/wordpress-localize-remote-images-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/localize-remote-images/wordpress-localize-remote-images-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-41693
Published: 2023-10-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview MyCryptoCheckout plugin <= 2.125 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mycryptocheckout/wordpress-mycryptocheckout-plugin-2-125-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mycryptocheckout/wordpress-mycryptocheckout-plugin-2-125-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-4929
Published: 2023-10-03
Description: All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insufficient checks on firmware updates or upgrades, potentially allowing malicious users to manipulate the firmware and gain control of devices.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-233328-nport-5000-series-firmware-improper-validation-of-integrity-check-vulnerability; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-233328-nport-5000-series-firmware-improper-validation-of-integrity-check-vulnerability
CVE: CVE-2023-4882
Published: 2023-10-03
Description: DOS vulnerability that could allow an attacker to register a new VNF (Virtual Network Function) value. This action could trigger the args_assets() function defined in the arg-log.php file, which would then execute the args-abort.c file, causing the service to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-404
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs
CVE: CVE-2023-4883
Published: 2023-10-03
Description:  Invalid pointer release vulnerability. Exploitation of this vulnerability could allow an attacker to interrupt the correct operation of the service by sending a specially crafted json string to the VNF (Virtual Network Function), and triggering the ogs_sbi_message_free function, which could cause a service outage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-763, CWE-763
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs
CVE: CVE-2023-4884
Published: 2023-10-03
Description: An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs
CVE: CVE-2023-4885
Published: 2023-10-03
Description: Man in the Middle vulnerability, which could allow an attacker to intercept VNF (Virtual Network Function) communications resulting in the exposure of sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-300
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs
CVE: CVE-2023-4886
Published: 2023-10-03
Description: A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2023:7851; https://access.redhat.com/errata/RHSA-2024:1061; https://access.redhat.com/security/cve/CVE-2023-4886
CVE: CVE-2023-2222
Published: 2023-10-03
Description: Rejected reason: This was deemed not a security vulnerability by upstream.
CVE: CVE-2023-3196
Published: 2023-10-03
Description: This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the administration panel.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sources/webcore/src/canopsis-next/src/config.js?ref_type=heads#L38; https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sources/webcore/src/canopsis-next/src/helpers/html.js?ref_type=heads; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canopsis-capensis
CVE: CVE-2023-4564
Published: 2023-10-03
Description: This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sources/webcore/src/canopsis-next/src/config.js?ref_type=heads#L38; https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sources/webcore/src/canopsis-next/src/helpers/html.js?ref_type=heads; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canopsis-capensis
CVE: CVE-2023-4817
Published: 2023-10-03
Description: This vulnerability allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entire device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-file-upload-vulnerability-icp-das-et-7060; https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-file-upload-vulnerability-icp-das-et-7060
CVE: CVE-2023-33200
Published: 2023-10-03
Description: A local non-privileged user can make improper GPU processing operations to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities