deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-24474
Published: 2023-07-13
Description: Experion server may experience a DoS due to a heap overflow which could occur when handling a specially crafted message
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://process.honeywell.com; https://process.honeywell.com
CVE: CVE-2023-24480
Published: 2023-07-13
Description: Controller DoS due to stack overflow when decoding a message from the server. 

See Honeywell Security Notification for recommendations on upgrading and versioning. 


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116, CWE-787
References: https://process.honeywell.com; https://process.honeywell.com
CVE: CVE-2023-25078
Published: 2023-07-13
Description: Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. 

See Honeywell Security Notification for recommendations on upgrading and versioning. 


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://process.honeywell.com; https://process.honeywell.com
CVE: CVE-2023-25178
Published: 2023-07-13
Description: Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning. 


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345, CWE-345
References: https://process.honeywell.com; https://process.honeywell.com
CVE: CVE-2023-25770
Published: 2023-07-13
Description: Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning. 


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://process.honeywell.com; https://process.honeywell.com
CVE: CVE-2023-3658
Published: 2023-07-13
Description: A vulnerability, which was classified as critical, was found in SourceCodester AC Repair and Services System 1.0. Affected is an unknown function of the file Master.php?f=delete_book of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234012.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234012; https://vuldb.com/?id.234012; https://vuldb.com/?ctiid.234012
CVE: CVE-2023-3659
Published: 2023-07-13
Description: A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/?page=user/manage_user. The manipulation of the argument firstname/middlename leads to cross site scripting. The attack can be launched remotely. The identifier VDB-234013 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.234013; https://vuldb.com/?id.234013; https://vuldb.com/?ctiid.234013
CVE: CVE-2023-25948
Published: 2023-07-13
Description: Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning. 


CVSS Score: 7.5 (HIGH)
CWE: CWE-394, CWE-209
References: https://process.honeywell.com; https://process.honeywell.com
CVE: CVE-2023-26597
Published: 2023-07-13
Description: Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. See Honeywell Security Notification for recommendations on upgrading and versioning. 


CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-787
References: https://process.honeywell.com; https://process.honeywell.com
CVE: CVE-2023-2003
Published: 2023-07-13
Description: Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-506
References: https://www.hackplayers.com/2023/07/vulnerabilidad-vision1210-unitronics.html; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/embedded-malicious-code-vulnerability-unitronics-vision1210; https://www.hackplayers.com/2023/07/vulnerabilidad-vision1210-unitronics.html
CVE: CVE-2023-3660
Published: 2023-07-13
Description: A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/add_user_modal.php. The manipulation of the argument un leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-234014 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Retro%20Cellphone%20Online%20Store%20-%20vlun%206.pdf; https://vuldb.com/?ctiid.234014; https://vuldb.com/?id.234014
CVE: CVE-2023-3661
Published: 2023-07-13
Description: A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. This affects an unknown part of the file /classes/Master.php?f=save_inquiry. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-234015.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234015; https://vuldb.com/?id.234015; https://vuldb.com/?ctiid.234015
CVE: CVE-2023-31819
Published: 2023-07-13
Description: An issue found in KEISEI STORE Co, Ltd. LIVRE KEISEI v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: http://keisei.com; http://livre.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-31819.md
CVE: CVE-2023-31820
Published: 2023-07-13
Description: An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: http://shizutetsu.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-31820.md; http://shizutetsu.com
CVE: CVE-2023-31822
Published: 2023-07-13
Description: An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu Store function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: http://entetsu.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-31822.md; http://entetsu.com
CVE: CVE-2023-31825
Published: 2023-07-13
Description: An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: http://inageya.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-31825.md; http://inageya.com
CVE: CVE-2023-35070
Published: 2023-07-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection.This issue affects Web Collection: before 31197.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0406; https://www.usom.gov.tr/bildirim/tr-23-0406
CVE: CVE-2023-37267
Published: 2023-07-13
Description: Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/umbraco/Umbraco-CMS/commit/1f26f2c6f[PII_REDACTED]cde5c6d8441fb041e410e; https://github.com/umbraco/Umbraco-CMS/commit/20a4e475c8d7b91d263e4e103ef19f3644e7b569; https://github.com/umbraco/Umbraco-CMS/commit/82eae48d098b9deecbdf86cf288b2b18020e1fed
CVE: CVE-2022-24834
Published: 2023-07-13
Description: Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
CVSS Score: 7.0 (HIGH)
CWE: CWE-122, CWE-680
References: https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/
CVE: CVE-2023-31704
Published: 2023-07-13
Description: Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the administrator's role.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/d34dun1c02n/CVE-2023-31704; https://www.sourcecodester.com/php/16397/online-computer-and-laptop-store-using-php-and-mysql-source-code-free-download.html; https://github.com/d34dun1c02n/CVE-2023-31704
CVE: CVE-2023-31705
Published: 2023-07-13
Description: A Reflected Cross-site scripting (XSS) vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript into the page parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/d34dun1c02n/CVE-2023-31705; https://www.sourcecodester.com/download-code?nid=16451&title=Task+Reminder+System+in+PHP+and+MySQL+Source+Code+Free+Download; https://github.com/d34dun1c02n/CVE-2023-31705
CVE: CVE-2023-31821
Published: 2023-07-13
Description: An issue found in ALBIS Co. ALBIS v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp ALBIS function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://albis.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-31821.md; http://albis.com
CVE: CVE-2023-31823
Published: 2023-07-13
Description: An issue found in Marui Co Marui Official app v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Marui Official Store function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://marui.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-31823.md; http://marui.com
CVE: CVE-2023-31824
Published: 2023-07-13
Description: An issue found in DERICIA Co. Ltd, DELICIA v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp DELICIA function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://delicia.com; http://dericia.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-31824.md
CVE: CVE-2023-33768
Published: 2023-07-13
Description: Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WSP080 v1.2 allows attackers to cause a Denial of Service (DoS) via a crafted firmware file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347
References: https://github.com/purseclab/CVE-2023-33768; https://play.google.com/store/apps/details?id=com.belkin.wemoandroid&hl=en_US&gl=US; https://www.amazon.com/Control-Devices-Remotely-Assistant-HomeKit/dp/B08CJGZZZ1
CVE: CVE-2023-37743
Published: 2023-07-13
Description: A cross-site scripting (XSS) vulnerability in Teacher Subject Allocation System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search text box.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://phpgurukul.com/teacher-subject-allocation-system-using-php-and-mysql/; https://phpgurukul.com/teacher-subject-allocation-system-using-php-and-mysql/
CVE: CVE-2023-37744
Published: 2023-07-13
Description: Maid Hiring Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/search-booking-request.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://phpgurukul.com/maid-hiring-management-system-using-php-and-mysql/; https://phpgurukul.com/maid-hiring-management-system-using-php-and-mysql/
CVE: CVE-2023-37745
Published: 2023-07-13
Description: A cross-site scripting (XSS) vulnerability in Maid Hiring Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Description of the /admin/aboutus.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://phpgurukul.com/maid-hiring-management-system-using-php-and-mysql/; https://phpgurukul.com/maid-hiring-management-system-using-php-and-mysql/
CVE: CVE-2023-30151
Published: 2023-07-13
Description: A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the `key` GET parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/en/shipping-carriers/1755-boxtal-connect-turnkey-shipping-solution.html; https://help.boxtal.com/hc/fr/articles/[PII_REDACTED]77-J-ai-besoin-du-module-PrestaShop-ancienne-version-Boxtal-Envoimoinscher-pour-mon-site; https://security.friendsofpresta.org/module/2023/06/20/envoimoinscher.html
CVE: CVE-2023-35833
Published: 2023-07-13
Description: An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not require the password to be (re)entered. This results in exposing cleartext credentials when connecting to a rogue LDAP server. NOTE: the vendor originally reported this as a security issue but then reconsidered because of the requirement for Admin access in order to change the configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://www.ysoft.com/en/legal/ldaps-encryption-downgrade-attack-vulnerability; https://ysoft.com; https://www.ysoft.com/en/legal/ldaps-encryption-downgrade-attack-vulnerability
CVE: CVE-2023-37746
Published: 2023-07-13
Description: A cross-site scripting (XSS) vulnerability in Maid Hiring Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter of the /admin/contactus.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://phpgurukul.com/maid-hiring-management-system-using-php-and-mysql/; https://phpgurukul.com/maid-hiring-management-system-using-php-and-mysql/
CVE: CVE-2023-37785
Published: 2023-07-13
Description: A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the component /editprofile.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/CrownZTX/cve-description; https://github.com/CrownZTX/cve-description
CVE: CVE-2023-37786
Published: 2023-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail Settings[backend], Mail Settings[host], Mail Settings[port] and Mail Settings[auth] parameters of the /admin/configuration.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/CrownZTX/reflectedxss1; https://github.com/CrownZTX/reflectedxss1
CVE: CVE-2023-37787
Published: 2023-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Rule and Route parameters of /admin/router.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/CrownZTX/storedXSS; https://github.com/CrownZTX/storedXSS
CVE: CVE-2023-30559
Published: 2023-07-13
Description: The firmware update package for the wireless card is not properly signed and can be modified.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-20, CWE-345, CWE-287
References: https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx; https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE: CVE-2022-42045
Published: 2023-07-13
Description: Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zemana AntiMalware 3.2.28.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-94
References: https://github.com/ReCryptLLC/CVE-2022-42045/tree/main; https://github.com/ReCryptLLC/CVE-2022-42045/tree/main
CVE: CVE-2023-30560
Published: 2023-07-13
Description: The configuration from the PCU can be modified without authentication using physical connection to the PCU. 








CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx; https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE: CVE-2023-34458
Published: 2023-07-13
Description: mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag `RelayedNonceFixEnableEpoch` was needed. This was a strict processing issue while validating blocks on a chain. This vulnerability has been patched in version 1.4.17.
CVSS Score: 7.1 (HIGH)
CWE: CWE-400
References: https://github.com/multiversx/mx-chain-go/blob/babdb144f1316ab6176bf3dbd7d[PII_REDACTED]d43/integrationTests/vm/txsFee/relayedMoveBalance_test.go#LL165C14-L165C14; https://github.com/multiversx/mx-chain-go/commit/babdb144f1316ab6176bf3dbd7d[PII_REDACTED]d43; https://github.com/multiversx/mx-chain-go/releases/tag/v1.4.17
CVE: CVE-2023-30561
Published: 2023-07-13
Description: The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a specially crafted device while an infusion is running.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx; https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE: CVE-2023-30562
Published: 2023-07-13
Description: A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs. 




CVSS Score: 6.7 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx; https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE: CVE-2023-30563
Published: 2023-07-13
Description: A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx; https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE: CVE-2023-30564
Published: 2023-07-13
Description: Alaris Systems Manager does not perform input validation during the Device Import Function.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx; https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE: CVE-2023-30565
Published: 2023-07-13
Description: An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.
CVSS Score: 3.5 (LOW)
CWE: CWE-319, CWE-924, CWE-319
References: https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx; https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE: CVE-2023-37463
Published: 2023-07-13
Description: cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.

CVSS Score: 6.4 (MEDIUM)
CWE: CWE-400
References: https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12; https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5; https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12
CVE: CVE-2023-35945
Published: 2023-07-13
Description: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-459
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r; https://github.com/nghttp2/nghttp2/blob/e7f59406556c80904b81b593d38508591bb7523a/lib/nghttp2_session.c#L3346; https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r
CVE: CVE-2023-36473
Published: 2023-07-13
Description: Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.

CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/discourse/discourse/security/advisories/GHSA-9f52-624j-8ppq; https://github.com/discourse/discourse/security/advisories/GHSA-9f52-624j-8ppq
CVE: CVE-2023-37468
Published: 2023-07-13
Description: Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.


CVSS Score: 6.0 (MEDIUM)
CWE: CWE-312
References: https://github.com/thm-mni-ii/feedbacksystem/commit/8d896125263e1efb1b70990987c[PII_REDACTED]bcf; https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.9.2; https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-g28r-8wg3-7349
CVE: CVE-2023-37598
Published: 2023-07-13
Description: A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/sahiloj/CVE-2023-37598; https://github.com/sahiloj/CVE-2023-37598
CVE: CVE-2023-37599
Published: 2023-07-13
Description: An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://github.com/sahiloj/CVE-2023-37599; https://github.com/sahiloj/CVE-2023-37599