deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-6440
Published: 2023-11-30
Description: A vulnerability was found in SourceCodester Book Borrower System 1.0 and classified as problematic. This issue affects some unknown processing of the file endpoint/add-book.php. The manipulation of the argument Book Title/Book Author leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246443.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/lscjl/lsi.webray.com.cn/blob/main/CVE-project/Book%20Borrower%20System%20Cross%20site%20scripting.md; https://vuldb.com/?ctiid.246443; https://vuldb.com/?id.246443
CVE: CVE-2023-6442
Published: 2023-11-30
Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file add-phlebotomist.php. The manipulation of the argument empid/fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246445 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/dhabaleshwar/niv_testing_sxss/blob/main/exploit.md; https://vuldb.com/?ctiid.246445; https://vuldb.com/?id.246445
CVE: CVE-2021-35975
Published: 2023-11-30
Description: Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.777) allows remote attackers to read arbitrary files via a full pathname in GET parameter "file" in URL. Also: affected components in same product - HTTP Adapter (up to v.1.8.0.15), MSSQL MessageBus Proxy (up to v.1.1.06), Financial Calculator (up to v.1.3.05), FIX Adapter (up to v.2.4.0.25)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/fbkcs/CVE-2021-35975; https://github.com/fbkcs/CVE-2021-35975
CVE: CVE-2023-39226
Published: 2023-11-30
Description: In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a single UDP packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-01
CVE: CVE-2023-46690
Published: 2023-11-30
Description: In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, which could lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-35, CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-01
CVE: CVE-2023-47207
Published: 2023-11-30
Description: In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-01
CVE: CVE-2023-48894
Published: 2023-11-30
Description: Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/jishenghua/jshERP/issues/98; https://github.com/jishenghua/jshERP/issues/98
CVE: CVE-2023-49735
Published: 2023-11-30
Description: ** UNSUPPORTED WHEN ASSIGNED **

The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles.

This issue affects Apache Tiles from version 2 onwards.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://lists.apache.org/thread/8ktm4vxr6vvc1qsxh6ft8jzmom1zl65p; https://lists.apache.org/thread/8ktm4vxr6vvc1qsxh6ft8jzmom1zl65p
CVE: CVE-2023-5908
Published: 2023-11-30
Description: 




KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.





CVSS Score: 9.1 (CRITICAL)
CWE: CWE-122, CWE-120
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03
CVE: CVE-2023-5909
Published: 2023-11-30
Description: 








KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.








CVSS Score: 7.5 (HIGH)
CWE: CWE-297, CWE-295
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03
CVE: CVE-2023-42916
Published: 2023-11-30
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://seclists.org/fulldisclosure/2023/Dec/12; http://seclists.org/fulldisclosure/2023/Dec/13; http://seclists.org/fulldisclosure/2023/Dec/3
CVE: CVE-2023-42917
Published: 2023-11-30
Description: A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/12; http://seclists.org/fulldisclosure/2023/Dec/13; http://seclists.org/fulldisclosure/2023/Dec/3
CVE: CVE-2023-46326
Published: 2023-11-30
Description: ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q; https://github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q
CVE: CVE-2023-46383
Published: 2023-11-30
Description: LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the password and gain full control of Loytec device configuration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html; https://seclists.org/fulldisclosure/2023/Nov/6; https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
CVE: CVE-2023-46384
Published: 2023-11-30
Description: LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Cleartext storage of credentials allows remote attackers to disclose admin password and bypass an authentication to login Loytec device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html; https://seclists.org/fulldisclosure/2023/Nov/6; https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
CVE: CVE-2023-46385
Published: 2023-11-30
Description: LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html; https://seclists.org/fulldisclosure/2023/Nov/6; https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
CVE: CVE-2023-46386
Published: 2023-11-30
Description: LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html; http://seclists.org/fulldisclosure/2023/Nov/7; https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
CVE: CVE-2023-46387
Published: 2023-11-30
Description: LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file. This vulnerability allows remote attackers to disclose sensitive information on Loytec device data point configuration.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html; http://seclists.org/fulldisclosure/2023/Nov/7; https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
CVE: CVE-2023-46388
Published: 2023-11-30
Description: LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html; http://seclists.org/fulldisclosure/2023/Nov/7; https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
CVE: CVE-2023-46389
Published: 2023-11-30
Description: LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file. This vulnerability allows remote attackers to disclose sensitive information on LINX configuration.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html; http://seclists.org/fulldisclosure/2023/Nov/7; https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
CVE: CVE-2023-46956
Published: 2023-11-30
Description: SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/admin/?page=user/manage_user&id file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/geilihan/bug_reports/blob/main/packers-and-movers-management-system/SQL-1.md; https://github.com/geilihan/bug_reports/blob/main/packers-and-movers-management-system/SQL-1.md
CVE: CVE-2023-47279
Published: 2023-11-30
Description: In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a single UDP packet, obtain plaintext credentials, or perform NTLM relaying.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-01
CVE: CVE-2023-47307
Published: 2023-11-30
Description: Buffer Overflow vulnerability in /apply.cgi in Shenzhen Libituo Technology Co., Ltd LBT-T300-T310 v2.2.2.6 allows attackers to cause a denial of service via the ApCliAuthMode parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/forever-more-cjy/overflow/blob/main/LBT-T310%20Buffer%20overflow.md; https://github.com/forever-more-cjy/overflow/blob/main/LBT-T310%20Buffer%20overflow.md
CVE: CVE-2023-43089
Published: 2023-12-01
Description: 
Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malicious standard user could potentially exploit this vulnerability to modify the content of the policy file, leading to unauthorized access to resources.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000218066/dsa-2023-371; https://www.dell.com/support/kbdoc/en-us/000218066/dsa-2023-371
CVE: CVE-2023-43453
Published: 2023-12-01
Description: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the setDiagnosisCfg component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/2.md; https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/2.md
CVE: CVE-2023-43454
Published: 2023-12-01
Description: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of the switchOpMode component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/1.md; https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/1.md
CVE: CVE-2023-43455
Published: 2023-12-01
Description: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/3.md; https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/3.md
CVE: CVE-2023-48016
Published: 2023-12-01
Description: Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/Serhatcck/cves/blob/main/CVE-2023-48016-restaurant-table-booking-system-SQLInjection.md; https://github.com/Serhatcck/cves/blob/main/CVE-2023-48016-restaurant-table-booking-system-SQLInjection.md
CVE: CVE-2023-45252
Published: 2023-12-01
Description: DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the service in a directory that grants write privileges to standard users, allows attackers to manipulate files, execute arbitrary code, and escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253/; https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253/
CVE: CVE-2023-45253
Published: 2023-12-01
Description: An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privileges via RollingFileAppender.DeleteFile method performed by the log4net library.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253/; https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253/
CVE: CVE-2023-3443
Published: 2023-12-01
Description: An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/416497; https://hackerone.com/reports/2036500; https://gitlab.com/gitlab-org/gitlab/-/issues/416497
CVE: CVE-2023-3949
Published: 2023-12-01
Description: An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint when release access on the public was set to only project members.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://gitlab.com/gitlab-org/gitlab/-/issues/419664; https://hackerone.com/reports/2079374; https://gitlab.com/gitlab-org/gitlab/-/issues/419664
CVE: CVE-2023-3964
Published: 2023-12-01
Description: An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/419857; https://hackerone.com/reports/2037316; https://gitlab.com/gitlab-org/gitlab/-/issues/419857
CVE: CVE-2023-4317
Published: 2023-12-01
Description: An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/421846; https://hackerone.com/reports/2089517; https://gitlab.com/gitlab-org/gitlab/-/issues/421846
CVE: CVE-2023-4658
Published: 2023-12-01
Description: An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/423835; https://hackerone.com/reports/2104540; https://gitlab.com/gitlab-org/gitlab/-/issues/423835
CVE: CVE-2023-4912
Published: 2023-12-01
Description: An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input.
CVSS Score: 2.6 (LOW)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/424882; https://hackerone.com/reports/2137421; https://gitlab.com/gitlab-org/gitlab/-/issues/424882
CVE: CVE-2023-5226
Published: 2023-12-01
Description: An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-94
References: https://gitlab.com/gitlab-org/gitlab/-/issues/426400; https://hackerone.com/reports/2173053; https://gitlab.com/gitlab-org/gitlab/-/issues/426400
CVE: CVE-2023-5915
Published: 2023-12-01
Description: A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerability may allow to a remote attacker to cause a denial-of-service condition to the FCN/FCJ controller by sending a crafted packet. While sending the packet, the maintenance homepage of the controller could not be accessed. Therefore, functions of the maintenance homepage, changing configuration, viewing logs, etc. are not available. But the controller’s operation is not stopped by the condition.

The affected products and versions are as follows: STARDOM FCN/FCJ R1.01 to R4.31.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://jvn.jp/vu/JVNVU95177889/index.html; https://web-material3.yokogawa.com/1/35463/files/YSAR-23-0003-E.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-02
CVE: CVE-2023-5995
Published: 2023-12-01
Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/425361; https://hackerone.com/reports/2138880; https://gitlab.com/gitlab-org/gitlab/-/issues/425361
CVE: CVE-2023-6033
Published: 2023-12-01
Description: Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/431201; https://hackerone.com/reports/2236039; https://gitlab.com/gitlab-org/gitlab/-/issues/431201
CVE: CVE-2023-5427
Published: 2023-12-01
Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r44p0 through r45p0; Valhall GPU Kernel Driver: from r44p0 through r45p0; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r45p0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/176029/ARM-Mali-r44p0-Use-After-Free.html; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; http://packetstormsecurity.com/files/176029/ARM-Mali-r44p0-Use-After-Free.html
CVE: CVE-2023-6449
Published: 2023-12-01
Description: The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name' function in versions up to, and including, 5.8.3. This makes it possible for authenticated attackers with editor-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed in most cases. By default, the file will be deleted from the server immediately. However, in some cases, other plugins may make it possible for the file to live on the server longer. This can make remote code execution possible when combined with another vulnerability, such as local file inclusion.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://contactform7.com/2023/11/30/contact-form-7-584/; https://github.com/rocklobster-in/contact-form-7/compare/v5.8.3...v5.8.4; https://plugins.trac.wordpress.org/browser/contact-form-7/tags/5.8.3/includes/formatting.php#L275
CVE: CVE-2023-28895
Published: 2023-12-01
Description: The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip.

Vulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.
CVSS Score: 3.5 (LOW)
CWE: CWE-259, CWE-798
References: https://asrg.io/security-advisories/hard-coded-password-for-access-to-power-controller-chip-memory/; https://asrg.io/security-advisories/hard-coded-password-for-access-to-power-controller-chip-memory/