deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49372
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/li-yu320/cms/blob/main/There%20is%20a%20CSRF%20present%20at%20the%20new%20location%20of%20the%20rotation%20image.md; https://github.com/li-yu320/cms/blob/main/There%20is%20a%20CSRF%20present%20at%20the%20new%20location%20of%20the%20rotation%20image.md
CVE: CVE-2023-49373
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/li-yu320/cms/blob/main/There%20is%20a%20CSRF%20at%20the%20deletion%20point%20of%20the%20broadcast%20image.md; https://github.com/li-yu320/cms/blob/main/There%20is%20a%20CSRF%20at%20the%20deletion%20point%20of%20the%20broadcast%20image.md
CVE: CVE-2023-49374
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/li-yu320/cms/blob/main/There%20is%20CSRF%20in%20the%20rotation%20image%20editing%20section.md; https://github.com/li-yu320/cms/blob/main/There%20is%20CSRF%20in%20the%20rotation%20image%20editing%20section.md
CVE: CVE-2023-49375
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/cui2shark/cms/blob/main/There%20is%20CSRF%20in%20the%20modification%20of%20the%20friendship%20link.md; https://github.com/cui2shark/cms/blob/main/There%20is%20CSRF%20in%20the%20modification%20of%20the%20friendship%20link.md
CVE: CVE-2023-49376
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/cui2shark/cms/blob/main/Delete%20existing%20CSRF%20in%20label%20management.md; https://github.com/cui2shark/cms/blob/main/Delete%20existing%20CSRF%20in%20label%20management.md
CVE: CVE-2023-49377
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/cui2shark/cms/blob/main/Modification%20of%20CSRF%20in%20Label%20Management.md; https://github.com/cui2shark/cms/blob/main/Modification%20of%20CSRF%20in%20Label%20Management.md
CVE: CVE-2023-49378
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/cui2shark/cms/blob/main/CSRF%20exists%20at%20the%20creation%20location%20of%20the%20custom%20table.md; https://github.com/cui2shark/cms/blob/main/CSRF%20exists%20at%20the%20creation%20location%20of%20the%20custom%20table.md
CVE: CVE-2023-49379
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/cui2shark/cms/blob/main/There%20is%20a%20CSRF%20in%20the%20new%20location%20of%20the%20friendship%20link.md; https://github.com/cui2shark/cms/blob/main/There%20is%20a%20CSRF%20in%20the%20new%20location%20of%20the%20friendship%20link.md
CVE: CVE-2023-49380
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/cui2shark/cms/blob/main/There%20is%20a%20CSRF%20at%20the%20deletion%20point%20of%20the%20friendship%20link.md; https://github.com/cui2shark/cms/blob/main/There%20is%20a%20CSRF%20at%20the%20deletion%20point%20of%20the%20friendship%20link.md
CVE: CVE-2023-49381
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/cui2shark/cms/blob/main/CSRF%20exists%20at%20the%20modification%20point%20of%20the%20custom%20table.md; https://github.com/cui2shark/cms/blob/main/CSRF%20exists%20at%20the%20modification%20point%20of%20the%20custom%20table.md
CVE: CVE-2023-49382
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/cui2shark/cms/blob/main/CSRF%20exists%20at%20the%20deletion%20point%20of%20the%20custom%20table.md; https://github.com/cui2shark/cms/blob/main/CSRF%20exists%20at%20the%20deletion%20point%20of%20the%20custom%20table.md
CVE: CVE-2023-49383
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/cui2shark/cms/blob/main/Added%20CSRF%20in%20Label%20Management.md; https://github.com/cui2shark/cms/blob/main/Added%20CSRF%20in%20Label%20Management.md
CVE: CVE-2023-49395
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20in%20the%20column%20management%20modification%20section.md; https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20in%20the%20column%20management%20modification%20section.md
CVE: CVE-2023-49396
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20at%20the%20newly%20added%20section%20of%20column%20management.md; https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20at%20the%20newly%20added%20section%20of%20column%20management.md
CVE: CVE-2023-49397
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20at%20the%20change%20of%20column%20management%20status.md; https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20at%20the%20change%20of%20column%20management%20status.md
CVE: CVE-2023-49398
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20at%20the%20deletion%20point%20of%20column%20management.md; https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20at%20the%20deletion%20point%20of%20column%20management.md
CVE: CVE-2023-49446
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/ysuzhangbin/cms/blob/main/There%20is%20a%20CSRF%20in%20the%20newly%20added%20navigation%20management%20area.md; https://github.com/ysuzhangbin/cms/blob/main/There%20is%20a%20CSRF%20in%20the%20newly%20added%20navigation%20management%20area.md
CVE: CVE-2023-49447
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/ysuzhangbin/cms/blob/main/CSRF%20exists%20at%20the%20navigation%20management%20modification%20location.md; https://github.com/ysuzhangbin/cms/blob/main/CSRF%20exists%20at%20the%20navigation%20management%20modification%20location.md
CVE: CVE-2023-49448
Published: 2023-12-05
Description: JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/ysuzhangbin/cms/blob/main/CSRF%20exists%20at%20the%20deletion%20point%20of%20navigation%20management.md; https://github.com/ysuzhangbin/cms/blob/main/CSRF%20exists%20at%20the%20deletion%20point%20of%20navigation%20management.md
CVE: CVE-2023-6180
Published: 2023-12-05
Description: The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-existing data in memory each time after completing a TLS connection causing the program to consume more resources with each new connection.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-404, CWE-401
References: https://github.com/cloudflare/boring/security/advisories/GHSA-pjrj-h4fg-6gm4; https://github.com/cloudflare/boring/security/advisories/GHSA-pjrj-h4fg-6gm4
CVE: CVE-2023-6357
Published: 2023-12-05
Description: A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://https://cert.vde.com/en/advisories/VDE-2023-066; https://cert.vde.com/en/advisories/VDE-2023-066; https://https://cert.vde.com/en/advisories/VDE-2023-066
CVE: CVE-2023-44297
Published: 2023-12-05
Description: 
Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information disclosure, information tampering, code execution, denial of service.


CVSS Score: 7.1 (HIGH)
CWE: CWE-1234, CWE-667
References: https://www.dell.com/support/kbdoc/en-us/000220047/dsa-2023-429-security-update-for-dell-16g-poweredge-server-bios-for-a-debug-code-security-vulnerability; https://www.dell.com/support/kbdoc/en-us/000220047/dsa-2023-429-security-update-for-dell-16g-poweredge-server-bios-for-a-debug-code-security-vulnerability
CVE: CVE-2023-44298
Published: 2023-12-05
Description: 
Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information tampering, code execution, denial of service.


CVSS Score: 3.6 (LOW)
CWE: CWE-1234, CWE-667
References: https://www.dell.com/support/kbdoc/en-us/000220047/dsa-2023-429-security-update-for-dell-16g-poweredge-server-bios-for-a-debug-code-security-vulnerability; https://www.dell.com/support/kbdoc/en-us/000220047/dsa-2023-429-security-update-for-dell-16g-poweredge-server-bios-for-a-debug-code-security-vulnerability
CVE: CVE-2023-45083
Published: 2023-12-05
Description: An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane.

An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently succeeding.

This issue affects HyperCloud versions 1.0 to any release before 2.1.


CVSS Score: 4.2 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://advisories.softiron.cloud; https://advisories.softiron.cloud
CVE: CVE-2023-45084
Published: 2023-12-05
Description: An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw, which impacts data availability and integrity.

This issue only impacts SoftIron HyperCloud "density" storage nodes running HyperCloud software versions 1.0 to before 2.0.3.


CVSS Score: 7.0 (HIGH)
CWE: CWE-820, CWE-662
References: https://advisories.softiron.cloud; https://advisories.softiron.cloud
CVE: CVE-2023-45085
Published: 2023-12-05
Description: An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process.  In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which impacts the availability of these workloads that may be deployed during this time window.

This issue impacts HyperCloud versions from 2.0.0 to before 2.0.3.


CVSS Score: 3.2 (LOW)
CWE: CWE-665
References: https://advisories.softiron.cloud; https://advisories.softiron.cloud
CVE: CVE-2023-45287
Published: 2023-12-05
Description: Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://go.dev/cl/326012/26; https://go.dev/issue/20654; https://groups.google.com/g/golang-announce/c/QMK8IQALDvA
CVE: CVE-2023-46674
Published: 2023-12-05
Description: An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

CVSS Score: 6.0 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9-0-security-update-esa-2023-28/348663; https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9-0-security-update-esa-2023-28/348663
CVE: CVE-2023-6448
Published: 2023-12-05
Description: Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188, CWE-798
References: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf; https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf; https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems
CVE: CVE-2023-44221
Published: 2023-12-05
Description: Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44221
CVE: CVE-2023-46736
Published: 2023-12-05
Description: EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) vulnerability via the upload image from url api. Users who have access to `the /Attachment/fromImageUrl` endpoint can specify URL to point to an internal host. Even though there is check for content type, it can be bypassed by redirects in some cases. This SSRF can be leveraged to disclose internal information (in some cases), target internal hosts and bypass firewalls. This vulnerability has been addressed in commit `c536cee63` which is included in release version 8.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/espocrm/espocrm/commit/c536cee6375e2088f961af13db7aaa652c983072; https://github.com/espocrm/espocrm/security/advisories/GHSA-g955-rwxx-jvf6; https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
CVE: CVE-2023-49297
Published: 2023-12-05
Description: PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.3 (LOW)
CWE: CWE-502
References: https://github.com/iterative/PyDrive2/commit/c57355dc2033ad90b7050d681b2c3ba548ff0004; https://github.com/iterative/PyDrive2/security/advisories/GHSA-v5f6-hjmf-9mc5; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYR5SJKOFSSXFV3E3D2SLXBUBA5WMJJG/
CVE: CVE-2023-5970
Published: 2023-12-05
Description: Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018
CVE: CVE-2023-49282
Published: 2023-12-05
Description: msgraph-sdk-php is the Microsoft Graph Library for PHP. The Microsoft Graph PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php.  The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application’s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in versions 1.109.1 and 2.0.0-RC5. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php` file, remove access to the `/vendor` directory, or disable the phpinfo function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200
References: https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1; https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2; https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1
CVE: CVE-2023-49283
Published: 2023-12-05
Description: microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application’s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200
References: https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1; https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2; https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86
CVE: CVE-2023-24547
Published: 2023-12-06
Description: On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local logs or remote logging servers by authenticated users, as well as appear in clear text in the device’s running config. 

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://www.arista.com/en/support/advisories-notices/security-advisory/18644-security-advisory-0090; https://www.arista.com/en/support/advisories-notices/security-advisory/18644-security-advisory-0090
CVE: CVE-2023-28875
Published: 2023-12-06
Description: A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://filerun.com/changelog; https://herolab.usd.de/security-advisories/usd-2022-0009/; https://filerun.com/changelog
CVE: CVE-2023-28876
Published: 2023-12-06
Description: A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users.
CVSS Score: 4.3 (MEDIUM)
References: https://filerun.com/changelog; https://herolab.usd.de/security-advisories/usd-2022-0010/; https://filerun.com/changelog
CVE: CVE-2023-48930
Published: 2023-12-06
Description: xinhu xinhuoa 2.2.1 contains a File upload vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gist.github.com/Maverickfir/b8113bdb51ec66e454ffa5b50674c446; https://github.com/Maverickfir/Vulnerability-recurrence/blob/main/xinhuOA.md; https://github.com/Maverickfir/xinhuOA2.2.1
CVE: CVE-2021-27795
Published: 2023-12-06
Description: Brocade Fabric OS (FOS) hardware 
platforms running any version of Brocade Fabric OS software, which 
supports the license string format; contain cryptographic 
issues that could allow for the installation of forged or fraudulent 
license keys. This would allow attackers or a malicious party to forge a
 counterfeit license key that the Brocade Fabric OS platform would 
authenticate and activate as if it were a legitimate license key. 




CVSS Score: 6.4 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21289; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21289