deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27254
Published: 2023-10-25
Description: Unauthenticated SQL injection in the GetRoomChanges      method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.  
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27254; https://www.themissinglink.com.au/security-advisories/cve-2023-27254
CVE: CVE-2023-27255
Published: 2023-10-25
Description: Unauthenticated SQL injection in the DeleteRoomChanges       method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.  
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27255; https://www.themissinglink.com.au/security-advisories/cve-2023-27255
CVE: CVE-2023-27256
Published: 2023-10-25
Description: Missing authentication in the GetLogFiles   method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of sensitive log files by unauthenticated attackers.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27256; https://www.themissinglink.com.au/security-advisories/cve-2023-27256
CVE: CVE-2023-27257
Published: 2023-10-25
Description: Missing authentication in the GetActiveToiletPasses    method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student information by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27257; https://www.themissinglink.com.au/security-advisories/cve-2023-27257
CVE: CVE-2023-27258
Published: 2023-10-25
Description: Missing authentication in the GetStudentGroupStudents     method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student and teacher data by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27258; https://www.themissinglink.com.au/security-advisories/cve-2023-27258
CVE: CVE-2023-27259
Published: 2023-10-25
Description: Missing authentication in the GetAssignmentsDue      method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teacher data by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27259; https://www.themissinglink.com.au/security-advisories/cve-2023-27259
CVE: CVE-2023-27260
Published: 2023-10-25
Description: Unauthenticated SQL injection in the GetAssignmentsDue        method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.  
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27260; https://www.themissinglink.com.au/security-advisories/cve-2023-27260
CVE: CVE-2023-27261
Published: 2023-10-25
Description: Missing authentication in the DeleteAssignments         method in IDAttend’s IDWeb application 3.1.052 and earlier allows deletion of data by unauthenticated attackers.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27261; https://www.themissinglink.com.au/security-advisories/cve-2023-27261
CVE: CVE-2023-27262
Published: 2023-10-25
Description: Unauthenticated SQL injection in the GetAssignmentsDue        method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.  
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27260; https://www.themissinglink.com.au/security-advisories/cve-2023-27260
CVE: CVE-2023-27375
Published: 2023-10-25
Description: Missing authentication in the StudentPopupDetails_ContactDetails       method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27375; https://www.themissinglink.com.au/security-advisories/cve-2023-27375
CVE: CVE-2023-27376
Published: 2023-10-25
Description: Missing authentication in the StudentPopupDetails_StudentDetails       method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27376; https://www.themissinglink.com.au/security-advisories/cve-2023-27376
CVE: CVE-2023-27377
Published: 2023-10-25
Description: Missing authentication in the StudentPopupDetails_EmergencyContactDetails        method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-287
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27377; https://www.themissinglink.com.au/security-advisories/cve-2023-27377
CVE: CVE-2023-29973
Published: 2023-10-25
Description: Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-770
References: https://www.esecforte.com/cve-2023-29973-no-rate-limit/; https://www.esecforte.com/cve-2023-29973-no-rate-limit/
CVE: CVE-2023-30912
Published: 2023-10-25
Description: 
A remote code execution issue exists in HPE OneView.


CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04548en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04548en_us
CVE: CVE-2023-31580
Published: 2023-10-25
Description: light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://github.com/KANIXB/JWTIssues/blob/main/Certification%20Verification%20issue%20in%20light-oauth2.md; https://github.com/networknt/light-oauth2/issues/369; https://github.com/KANIXB/JWTIssues/blob/main/Certification%20Verification%20issue%20in%20light-oauth2.md
CVE: CVE-2023-31581
Published: 2023-10-25
Description: Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/dromara/sureness/issues/164; https://github.com/xubowenW/JWTissues/blob/main/sureness%20secure%20issues.md; https://github.com/dromara/sureness/issues/164
CVE: CVE-2023-31582
Published: 2023-10-25
Description: jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then; https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md; https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then
CVE: CVE-2023-34048
Published: 2023-10-25
Description: vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://www.vmware.com/security/advisories/VMSA-2023-0023.html; https://www.vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server; https://www.vmware.com/security/advisories/VMSA-2023-0023.html
CVE: CVE-2023-34056
Published: 2023-10-25
Description: vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://www.vmware.com/security/advisories/VMSA-2023-0023.html; https://www.vmware.com/security/advisories/VMSA-2023-0023.html
CVE: CVE-2023-34085
Published: 2023-10-25
Description: When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request

CVSS Score: 2.6 (LOW)
CWE: CWE-359
References: https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk[PII_REDACTED]44; https://www.pingidentity.com/en/resources/downloads/pingfederate.html; https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk[PII_REDACTED]44
CVE: CVE-2023-34446
Published: 2023-10-25
Description: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.

CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/Combodo/iTop/commit/e3ba826e5dfd3b724f1ee97bebfd20ded3c70b10; https://github.com/Combodo/iTop/security/advisories/GHSA-q4pp-j46r-gm68; https://github.com/Combodo/iTop/commit/e3ba826e5dfd3b724f1ee97bebfd20ded3c70b10
CVE: CVE-2023-34447
Published: 2023-10-25
Description: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/Combodo/iTop/commit/519751faa10b2fc5b75ea4516a1b8ef13ca35b33; https://github.com/Combodo/iTop/commit/b8f61362f570e1ef[PII_REDACTED]012b7fc8aba802; https://github.com/Combodo/iTop/security/advisories/GHSA-6rfm-2rwg-mj7p
CVE: CVE-2023-36085
Published: 2023-10-25
Description: The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to phishing attacks, malware distribution, and unauthorized access to sensitive resources.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/176991/SISQUAL-WFM-7.1.319.103-Host-Header-Injection.html; https://github.com/omershaik0/Handmade_Exploits/tree/main/SISQUALWFM-Host-Header-Injection-CVE-2023-36085; http://packetstormsecurity.com/files/176991/SISQUAL-WFM-7.1.319.103-Host-Header-Injection.html
CVE: CVE-2023-37283
Published: 2023-10-25
Description: Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter

CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk[PII_REDACTED]44; https://www.pingidentity.com/en/resources/downloads/pingfederate.html; https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk[PII_REDACTED]44
CVE: CVE-2023-37908
Published: 2023-10-25
Description: XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid attribute names. This can be exploited, e.g., via the link syntax in any content that supports XWiki syntax like comments in XWiki. When a user moves the mouse over a malicious link, the malicious JavaScript code is executed in the context of the user session. When this user is a privileged user who has programming rights, this allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. While this attribute was correctly recognized as not allowed, the attribute was still printed with a prefix `data-xwiki-translated-attribute-` without further cleaning or validation. This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by removing characters not allowed in data attributes and then validating the cleaned attribute again. There are no known workarounds apart from upgrading to a version including the fix.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-83, CWE-79
References: https://github.com/xwiki/xwiki-rendering/commit/f4d5acac451dccaf276e69f0b49b72221eef5d2f; https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-663w-2xp3-5739; https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp
CVE: CVE-2023-37909
Published: 2023-10-25
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.8 and 15.3-rc-1 by adding proper escaping. As a workaround, the patch can be manually applied to the document `Menu.UIExtensionSheet`; only three lines need to be changed.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/9e8f080094333dec63a8583229a3799208d773be; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v2rr-xw95-wcjx; https://jira.xwiki.org/browse/XWIKI-20746
CVE: CVE-2023-37910
Published: 2023-10-25
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any document (can be the user profile which is editable by default) can move any attachment of any other document to this attacker-controlled document. This allows the attacker to access and possibly publish any attachment of which the name is known, regardless if the attacker has view or edit rights on the source document of this attachment. Further, the attachment is deleted from the source document. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1. There is no workaround apart from upgrading to a fixed version.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rwwx-6572-mp29; https://jira.xwiki.org/browse/XWIKI-20334
CVE: CVE-2023-37911
Published: 2023-10-25
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 9.4-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, when a document has been deleted and re-created, it is possible for users with view right on the re-created document but not on the deleted document to view the contents of the deleted document. Such a situation might arise when rights were added to the deleted document. This can be exploited through the diff feature and, partially, through the REST API by using versions such as `deleted:1` (where the number counts the deletions in the wiki and is thus guessable). Given sufficient rights, the attacker can also re-create the deleted document, thus extending the scope to any deleted document as long as the attacker has edit right in the location of the deleted document. This vulnerability has been patched in XWiki 14.10.8 and 15.3 RC1 by properly checking rights when deleted revisions of a document are accessed. The only workaround is to regularly clean deleted documents to minimize the potential exposure. Extra care should be taken when deleting sensitive documents that are protected individually (and not, e.g., by being placed in a protected space) or deleting a protected space as a whole.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://extensions.xwiki.org/xwiki/bin/view/Extension/Index%20Application#HPermanentlydeleteallpages; https://github.com/xwiki/xwiki-platform/commit/f471f2a392aeeb9e51d59fdfe1d76fccf532523f; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gh64-qxh5-4m33
CVE: CVE-2023-37912
Published: 2023-10-25
Description: XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platform:xwiki-core-rendering-macro-footnotes` and `org.xwiki.platform:xwiki-rendering-macro-footnotes` and prior to version 15.1-rc-1 of `org.xwiki.platform:xwiki-rendering-macro-footnotes`, the footnote macro executed its content in a potentially different context than the one in which it was defined. In particular in combination with the include macro, this allows privilege escalation from a simple user account in XWiki to programming rights and thus remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.6 and 15.1-rc-1. There is no workaround apart from upgrading to a fixed version of the footnote macro.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-270
References: https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e; https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-35j5-m29r-xfq5; https://jira.xwiki.org/browse/XRENDERING-688
CVE: CVE-2023-37913
Published: 2023-10-25
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versions 14.10.8 and 15.3-rc-1, triggering the office converter with a specially crafted file name allows writing the attachment's content to an attacker-controlled location on the server as long as the Java process has write access to that location. In particular in the combination with attachment moving, a feature introduced in XWiki 14.0, this is easy to reproduce but it also possible to reproduce in versions as old as XWiki 3.5 by uploading the attachment through the REST API which doesn't remove `/` or `\` from the filename. As the mime type of the attachment doesn't matter for the exploitation, this could e.g., be used to replace the `jar`-file of an extension which would allow executing arbitrary Java code and thus impact the confidentiality, integrity and availability of the XWiki installation. This vulnerability has been patched in XWiki 14.10.8 and 15.3RC1. There are no known workarounds apart from disabling the office converter.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22, CWE-23, CWE-22
References: https://github.com/xwiki/xwiki-platform/commit/45d182a4141ff22f3ff289cf71e4669bdc714544; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vcvr-v426-3m3m; https://jira.xwiki.org/browse/XWIKI-20715
CVE: CVE-2023-38041
Published: 2023-10-25
Description: A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploit this condition to gain unauthorized elevated privileges on the affected system.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://forums.ivanti.com/s/article/CVE-2023-38041-New-client-side-release-to-address-a-privilege-escalation-on-Windows-user-machines?language=en_US; https://forums.ivanti.com/s/article/CVE-2023-38041-New-client-side-release-to-address-a-privilege-escalation-on-Windows-user-machines?language=en_US
CVE: CVE-2023-39219
Published: 2023-10-25
Description: PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests

CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk[PII_REDACTED]44; https://www.pingidentity.com/en/resources/downloads/pingfederate.html; https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk[PII_REDACTED]44
CVE: CVE-2023-39231
Published: 2023-10-25
Description: PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's first factor credentials.
CVSS Score: 7.3 (HIGH)
CWE: CWE-288, CWE-306
References: https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks[PII_REDACTED]94; https://www.pingidentity.com/en/resources/downloads/pingid.html; https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks[PII_REDACTED]94
CVE: CVE-2023-39619
Published: 2023-10-25
Description: ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://gist.github.com/6en6ar/712a4c1eab0324f15e09232c77ea08f8; https://github.com/teomantuncer/node-email-check/blob/main/main.js%2C; https://www.npmjs.com/package/node-email-check
CVE: CVE-2023-39732
Published: 2023-10-25
Description: The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
CVSS Score: 8.2 (HIGH)
CWE: CWE-269
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39732.md; https://liff.line.me/[PII_REDACTED]-elb6bNQj; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39732.md
CVE: CVE-2023-39733
Published: 2023-10-25
Description: The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
CVSS Score: 8.2 (HIGH)
CWE: CWE-269
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39733.md; https://liff.line.me/[PII_REDACTED]-bk5k9PO4; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39733.md
CVE: CVE-2023-39734
Published: 2023-10-25
Description: The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
CVSS Score: 8.2 (HIGH)
CWE: CWE-269
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39734.md; https://liff.line.me/[PII_REDACTED]-eMKgg4rJ; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39734.md
CVE: CVE-2023-39735
Published: 2023-10-25
Description: The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39735.md; https://liff.line.me/[PII_REDACTED]-MkPLqO5D; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39735.md
CVE: CVE-2023-39736
Published: 2023-10-25
Description: The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39736.md; https://liff.line.me/[PII_REDACTED]-4Kp0xVrP; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39736.md
CVE: CVE-2023-39737
Published: 2023-10-25
Description: The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39737.md; https://liff.line.me/[PII_REDACTED]-JD5Q5Yp1; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39737.md