deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-22653
Published: 2023-01-20
Description: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to exploit the official image signature to force injection unauthorized image signature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1; https://support.ruckuswireless.com/security_bulletins/302; https://support.ruckuswireless.com/security_bulletins/302
CVE: CVE-2020-22654
Published: 2023-01-20
Description: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to bypass firmware image bad md5 checksum failed error.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-494
References: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1; https://support.ruckuswireless.com/security_bulletins/302; https://support.ruckuswireless.com/security_bulletins/302
CVE: CVE-2020-22655
Published: 2023-01-20
Description: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to persistently to writing unauthorized image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1; https://support.ruckuswireless.com/security_bulletins/302; https://support.ruckuswireless.com/security_bulletins/302
CVE: CVE-2020-22656
Published: 2023-01-20
Description: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to make the Secure Boot in failed attempts state (rfwd).
CVSS Score: 7.5 (HIGH)
CWE: CWE-1272
References: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1; https://support.ruckuswireless.com/security_bulletins/302; https://support.ruckuswireless.com/security_bulletins/302
CVE: CVE-2020-22657
Published: 2023-01-20
Description: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to perform WEB GUI login authentication bypass.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1; https://support.ruckuswireless.com/security_bulletins/302; https://support.ruckuswireless.com/security_bulletins/302
CVE: CVE-2020-22658
Published: 2023-01-20
Description: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to switch completely to unauthorized image to be Boot as primary verified image.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-494
References: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1; https://support.ruckuswireless.com/security_bulletins/302; https://support.ruckuswireless.com/security_bulletins/302
CVE: CVE-2020-22659
Published: 2023-01-20
Description: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to exploit the official image signature to force injection unauthorized image signature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1; https://support.ruckuswireless.com/security_bulletins/302; https://support.ruckuswireless.com/security_bulletins/302
CVE: CVE-2020-22660
Published: 2023-01-20
Description: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to force bypass Secure Boot failed attempts and run temporarily the previous Backup image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1; https://support.ruckuswireless.com/security_bulletins/302; https://support.ruckuswireless.com/security_bulletins/302
CVE: CVE-2020-22661
Published: 2023-01-20
Description: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to erase the backup secondary official image and write secondary backup unauthorized image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1; https://support.ruckuswireless.com/security_bulletins/302; https://support.ruckuswireless.com/security_bulletins/302
CVE: CVE-2020-22662
Published: 2023-01-20
Description: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to change and set unauthorized "illegal region code" by remote code Execution command injection which leads to run illegal frequency with maxi output power. Vulnerability allows attacker to create an arbitrary amount of ssid wlans interface per radio which creates overhead over noise (the default max limit is 8 ssid only per radio in solo AP). Vulnerability allows attacker to unlock hidden regions by privilege command injection in WEB GUI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77, CWE-77
References: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1; https://support.ruckuswireless.com/security_bulletins/302; https://support.ruckuswireless.com/security_bulletins/302
CVE: CVE-2020-23256
Published: 2023-01-20
Description: An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/electerm/electerm/issues/1686; https://github.com/electerm/electerm/issues/1686
CVE: CVE-2020-29297
Published: 2023-01-20
Description: Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gist.github.com/kdrypr/999a245abb4511d43e41df1ccdbcf0cb; https://github.com/tourist5/Online-food-ordering-system; https://github.com/tourist5/Online-food-ordering-system/issues/1
CVE: CVE-2021-29368
Published: 2023-01-20
Description: Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384, CWE-384
References: https://github.com/CuppaCMS/CuppaCMS/issues/8; https://github.com/CuppaCMS/CuppaCMS/issues/8
CVE: CVE-2021-39011
Published: 2023-01-20
Description: 
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive information in log files that could be read by a privileged user. IBM X-Force ID: 213645.


CVSS Score: 4.2 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213645; https://www.ibm.com/support/pages/node/6856403; https://exchange.xforce.ibmcloud.com/vulnerabilities/213645
CVE: CVE-2021-39089
Published: 2023-01-20
Description: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request.  IBM X-Force ID:  216387.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/216387; https://www.ibm.com/support/pages/node/6856405; https://exchange.xforce.ibmcloud.com/vulnerabilities/216387
CVE: CVE-2022-35977
Published: 2023-01-20
Description: Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/redis/redis/commit/1ec82e6e97e1db06a72ca505f9fbf6b981f31ef7; https://github.com/redis/redis/releases/tag/6.0.17; https://github.com/redis/redis/releases/tag/6.2.9
CVE: CVE-2022-39193
Published: 2023-01-20
Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer of edits and logged actions. This information should not allow public viewing: it is supposed to be viewable only by users with suppression rights.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://phabricator.wikimedia.org/T311337; https://phabricator.wikimedia.org/T311337
CVE: CVE-2022-41733
Published: 2023-01-20
Description: 
IBM InfoSphere Information Server 11.7 could allow a remote attacked to cause some of the components to be unusable until the process is restarted. IBM X-Force ID: 237583.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/237583; https://www.ibm.com/support/pages/node/6840399; https://exchange.xforce.ibmcloud.com/vulnerabilities/237583
CVE: CVE-2022-45537
Published: 2023-01-20
Description: EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_LIST_URL".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/34; https://github.com/weng-xianhu/eyoucms/issues/34
CVE: CVE-2022-45538
Published: 2023-01-20
Description: EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_GOBACK_URL".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/35; https://github.com/weng-xianhu/eyoucms/issues/35
CVE: CVE-2022-45539
Published: 2023-01-20
Description: EyouCMS <= 1.6.0 was discovered a reflected-XSS in FileManager component in GET value "activepath" when creating a new file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/38; https://github.com/weng-xianhu/eyoucms/issues/38
CVE: CVE-2022-45540
Published: 2023-01-20
Description: EyouCMS <= 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-8 char.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/37; https://github.com/weng-xianhu/eyoucms/issues/37
CVE: CVE-2022-45541
Published: 2023-01-20
Description: EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-integer char.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/36; https://github.com/weng-xianhu/eyoucms/issues/36
CVE: CVE-2022-45542
Published: 2023-01-20
Description: EyouCMS <= 1.6.0 was discovered a reflected-XSS in the FileManager component in GET parameter "filename" when editing any file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/33; https://github.com/weng-xianhu/eyoucms/issues/33
CVE: CVE-2022-45557
Published: 2023-01-20
Description: Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hundredrabbits/Left/issues/167; https://github.com/hundredrabbits/Left/issues/167
CVE: CVE-2022-45558
Published: 2023-01-20
Description: Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via the meta tag.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hundredrabbits/Left/issues/168; https://github.com/hundredrabbits/Left/issues/168
CVE: CVE-2022-45748
Published: 2023-01-20
Description: An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/AssetLib/Collada/ColladaParser.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/assimp/assimp/issues/4286; https://github.com/assimp/assimp/issues/4286
CVE: CVE-2022-47012
Published: 2023-01-20
Description: Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908, CWE-908
References: https://github.com/GNS3/dynamips/issues/125; https://github.com/GNS3/dynamips/issues/125
CVE: CVE-2022-47015
Published: 2023-01-20
Description: MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/MariaDB/server/commit/be0a46b3d52b58956fd0d47d040b9f[PII_REDACTED]; https://lists.debian.org/debian-lts-announce/2023/06/msg00005.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O22PO3Q6TRSNJI2A2WTJH3VVCHEKBF6C/
CVE: CVE-2022-47016
Published: 2023-01-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-47021
Published: 2023-01-20
Description: A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/xiph/opusfile/commit/0a4cd796df5b030cb866f3f4a5e41a4b92caddf5; https://github.com/xiph/opusfile/issues/36; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ODIA6QRIRBNF2HRXOE5VCZ2AFP4ZB4R/
CVE: CVE-2022-47024
Published: 2023-01-20
Description: A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/vim/vim/commit/a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EX6N2DB75A73MQGVW3CS4VTNPAYVM2M/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWIJBSQX53P7DHV77KRXJIXA4GH7XHC/
CVE: CVE-2022-48120
Published: 2023-01-20
Description: SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers to execute arbitrary commands via the contact and doctor parameters to /search.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/kishan0725/Hospital-Management-System/issues/32; https://github.com/kishan0725/Hospital-Management-System/issues/32
CVE: CVE-2022-48152
Published: 2023-01-20
Description: SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicines/profile.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/remoteclinic/RemoteClinic/issues/20; https://github.com/remoteclinic/RemoteClinic/issues/20
CVE: CVE-2022-48279
Published: 2023-01-20
Description: In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.
CVSS Score: 7.5 (HIGH)
CWE: CWE-436, CWE-436
References: https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/; https://github.com/SpiderLabs/ModSecurity/pull/2795; https://github.com/SpiderLabs/ModSecurity/pull/2797
CVE: CVE-2023-0101
Published: 2023-01-20
Description: A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potentially execute a specially crafted file to obtain root or NT AUTHORITY / SYSTEM privileges on the Nessus host.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://www.tenable.com/security/tns-2023-01; https://www.tenable.com/security/tns-2023-02; https://www.tenable.com/security/tns-2023-01
CVE: CVE-2023-22458
Published: 2023-01-20
Description: Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/redis/redis/commit/16f408b1a0121cacd44cbf8aee275d69dc627f02; https://github.com/redis/redis/releases/tag/6.2.9; https://github.com/redis/redis/releases/tag/7.0.8
CVE: CVE-2023-23010
Published: 2023-01-20
Description: Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows attackers to execute arbitrary code via the languages and trans_load parameters in file add_product.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/8a836008e9f635a2f80d09c9a8b5a533; https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d5904379ca55014c5df34c67deda982c73dc7fe5; https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/issues/242
CVE: CVE-2023-23012
Published: 2023-01-20
Description: Cross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecified impacts via the input bgcol in file Weeks.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/bd8ec37999c216eceabd6b80d5a95f94; https://github.com/craigrodway/classroombookings/issues/52; https://gist.github.com/enferas/bd8ec37999c216eceabd6b80d5a95f94
CVE: CVE-2023-23014
Published: 2023-01-20
Description: Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe[PII_REDACTED]501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_store_name and edit_active inputs in file InventorySystem.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/649f39c955ce2816ba1abae620e749c7; https://github.com/ronknight/InventorySystem/issues/23; https://gist.github.com/enferas/649f39c955ce2816ba1abae620e749c7
CVE: CVE-2023-23015
Published: 2023-01-20
Description: Cross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/eaf[PII_REDACTED]45f1b339f64cca4a36d; https://github.com/kalkun-sms/Kalkun/issues/487; https://gist.github.com/enferas/eaf[PII_REDACTED]45f1b339f64cca4a36d
CVE: CVE-2023-23024
Published: 2023-01-20
Description: Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the writer parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/6ae66b7daf4f86997cd5320975f209e2; https://gist.github.com/enferas/6ae66b7daf4f86997cd5320975f209e2
CVE: CVE-2023-23143
Published: 2023-01-20
Description: Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC version 2.3-DEV-rev1-g4669ba229-master.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/commit/af6a5e7a96ee01a139cce6c9e4edfc069aad17a6; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/commit/af6a5e7a96ee01a139cce6c9e4edfc069aad17a6
CVE: CVE-2023-23144
Published: 2023-01-20
Description: Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/gpac/gpac/commit/3a2458a49b3e6399709d456d7b35e7a6f50cfb86; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/commit/3a2458a49b3e6399709d456d7b35e7a6f50cfb86