deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-47070
Published: 2023-11-17
Description: Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb23-66.html; https://helpx.adobe.com/security/products/after_effects/apsb23-66.html
CVE: CVE-2023-47071
Published: 2023-11-17
Description: Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb23-66.html; https://helpx.adobe.com/security/products/after_effects/apsb23-66.html
CVE: CVE-2023-47072
Published: 2023-11-17
Description: Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/after_effects/apsb23-66.html; https://helpx.adobe.com/security/products/after_effects/apsb23-66.html
CVE: CVE-2023-47073
Published: 2023-11-17
Description: Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb23-66.html; https://helpx.adobe.com/security/products/after_effects/apsb23-66.html
CVE: CVE-2020-11447
Published: 2023-11-17
Description: An issue was discovered on Bell HomeHub 3000 SG48222070 devices. Remote authenticated users can retrieve the serial number via cgi/json-req - this is an information leak because the serial number is intended to prove an actor's physical access to the device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://0xem.ma/posts/HH3K-CVE/; https://support.bell.ca/Internet/Connection-help/Access_control_in_the_Home_Hub_modems; https://0xem.ma/posts/HH3K-CVE/
CVE: CVE-2020-11448
Published: 2023-11-17
Description: An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://0xem.ma/posts/HH3K-CVE/; https://support.bell.ca/Internet/Connection-help/Access_control_in_the_Home_Hub_modems; https://0xem.ma/posts/HH3K-CVE/
CVE: CVE-2023-22268
Published: 2023-11-17
Description: Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to information disclosure by an low-privileged authenticated attacker. Exploitation of this issue does not require user interaction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html; https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html
CVE: CVE-2023-22272
Published: 2023-11-17
Description: Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Input Validation vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html; https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html
CVE: CVE-2023-22273
Published: 2023-11-17
Description: Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to Remote Code Execution by an admin authenticated attacker. Exploitation of this issue does not require user interaction.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html; https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html
CVE: CVE-2023-22274
Published: 2023-11-17
Description: Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html; https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html
CVE: CVE-2023-22275
Published: 2023-11-17
Description: Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html; https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html
CVE: CVE-2023-44324
Published: 2023-11-17
Description: Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default admin's password. Exploitation of this issue does not require user interaction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://helpx.adobe.com/security/products/framemaker-publishing-server/apsb23-58.html; https://helpx.adobe.com/security/products/framemaker-publishing-server/apsb23-58.html
CVE: CVE-2023-48029
Published: 2023-11-17
Description: Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploited when an administrator visits the user management section, exports the data to a CSV file, and then opens it, leading to the execution of the malicious payload on the administrator's computer.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1236
References: https://gist.github.com/bugplorer/09d312373066a3b72996ebd76a7a23a5; https://nitipoom-jar.github.io/CVE-2023-48029/; https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48029
CVE: CVE-2023-26347
Published: 2023-11-17
Description: Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
CVE: CVE-2023-26364
Published: 2023-11-17
Description: @adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS. Exploitation of this issue does not require user interaction or privileges.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/adobe/css-tools/security/advisories/GHSA-hpx4-r86g-5jrg; https://github.com/adobe/css-tools/security/advisories/GHSA-hpx4-r86g-5jrg
CVE: CVE-2023-44350
Published: 2023-11-17
Description: Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
CVE: CVE-2023-44351
Published: 2023-11-17
Description: Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
CVE: CVE-2023-44352
Published: 2023-11-17
Description: Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
CVE: CVE-2023-44353
Published: 2023-11-17
Description: Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
CVE: CVE-2023-44355
Published: 2023-11-17
Description: Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to impact a minor integrity feature. Exploitation of this issue does require user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
CVE: CVE-2023-48024
Published: 2023-11-17
Description: Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hash_destroy(hash_table_t *h) at hash.c
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/howerj/liblisp/issues/1; https://github.com/howerj/liblisp/issues/1
CVE: CVE-2023-48025
Published: 2023-11-17
Description: Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned get_length(lisp_cell_t * x) at eval.c
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://github.com/howerj/liblisp/issues/1; https://github.com/howerj/liblisp/issues/1
CVE: CVE-2023-6179
Published: 2023-11-17
Description: Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most recent version of this product, service or offering (Pro-watch 6.0.2, 6.0, 5.5.2,5.0.5).


CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices; https://www.honeywell.com/us/en/product-security; https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices
CVE: CVE-2023-48185
Published: 2023-11-17
Description: Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://forum.terra-master.com/cn/viewtopic.php?f=100&t=3842&p=17623#p; https://forum.terra-master.com/cn/viewtopic.php?f=100&t=3842&p=17623#p17623; https://forum.terra-master.com/cn/viewtopic.php?f=100&t=3842&p=17623#p
CVE: CVE-2023-6188
Published: 2023-11-17
Description: A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edit.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-245735.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-94
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1352; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1358; https://vuldb.com/?ctiid.245735
CVE: CVE-2023-48295
Published: 2023-11-17
Description: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting (XSS) vulnerability in the device group popups. This issue has been addressed in commit `faf66035ea` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/blob/63eeeb71722237d1461a37bb6da99fda25e02c91/app/Http/Controllers/DeviceGroupController.php#L173C21-L173C21; https://github.com/librenms/librenms/commit/faf66035ea1f4c1c4f34559b9d0ed40ee4a19f90; https://github.com/librenms/librenms/security/advisories/GHSA-8phr-637g-pxrg
CVE: CVE-2023-46745
Published: 2023-11-17
Description: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions the login method has no rate limit. An attacker may be able to leverage this vulnerability to gain access to user accounts. This issue has been addressed in version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://github.com/librenms/librenms/security/advisories/GHSA-rq42-58qf-v3qx; https://github.com/librenms/librenms/security/advisories/GHSA-rq42-58qf-v3qx
CVE: CVE-2023-48238
Published: 2023-11-17
Description: joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to be transferred between two parties. Affected versions of the json-web-token library are vulnerable to a JWT algorithm confusion attack. On line 86 of the 'index.js' file, the algorithm to use for verifying the signature of the JWT token is taken from the JWT token, which at that point is still unverified and thus shouldn't be trusted. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work against this library is the RS256 algorithm is in use, however it is a best practice to use that algorithm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://github.com/joaquimserafim/json-web-token/security/advisories/GHSA-4xw9-cx39-r355; https://github.com/joaquimserafim/json-web-token/security/advisories/GHSA-4xw9-cx39-r355
CVE: CVE-2023-48294
Published: 2023-11-17
Description: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to `graph.php` to access graphs generated on the particular Device. This request can be accessed by a low privilege user and they can enumerate devices on librenms with their id or hostname. Leveraging this vulnerability a low privilege user can see all devices registered by admin users. This vulnerability has been addressed in commit `489978a923` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/librenms/librenms/blob/fa93034edd40c130c2ff00667ca2498d84be6e69/html/graph.php#L19C1-L25C2; https://github.com/librenms/librenms/commit/489978a923ed52aa243d3419889ca298a8a6a7cf; https://github.com/librenms/librenms/security/advisories/GHSA-fpq5-4vwm-78x4
CVE: CVE-2023-43177
Published: 2023-11-18
Description: CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-913
References: https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/; https://github.com/the-emmons/CVE-Disclosures/blob/main/Pending/CrushFTP-2023-1.md; https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/
CVE: CVE-2023-44796
Published: 2023-11-18
Description: Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _generaloptions_panel.php component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Hebing123/CVE-2023-44796/issues/1; https://github.com/Hebing123/cve/issues/4; https://github.com/LimeSurvey/LimeSurvey/pull/3483
CVE: CVE-2023-46402
Published: 2023-11-18
Description: git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://gist.github.com/6en6ar/7c2424c93e7fbf2b6fc44e7fb9acb95d; https://gist.github.com/6en6ar/7c2424c93e7fbf2b6fc44e7fb9acb95d
CVE: CVE-2023-48028
Published: 2023-11-18
Description: kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based on varying response messages, potentially paving the way for a brute force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://gist.github.com/bugplorer/9ae8ad7a9f2a3053ebd07a1b7b54deae; https://nitipoom-jar.github.io/CVE-2023-48028/; https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48028
CVE: CVE-2023-48017
Published: 2023-11-18
Description: Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/moonsabc123/dreamer_cms/blob/main/Add%20permissions%20to%20CSRF%20in%20Permission%20Management.md; https://github.com/moonsabc123/dreamer_cms/blob/main/Add%20permissions%20to%20CSRF%20in%20Permission%20Management.md
CVE: CVE-2023-4214
Published: 2023-11-18
Description: The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
CVSS Score: 8.1 (HIGH)
CWE: CWE-620, CWE-640
References: https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_API_Limit.php?rev=2997182; https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_WPAPI_Mods.php#L567; https://plugins.trac.wordpress.org/changeset/2997160/apppresser
CVE: CVE-2023-6187
Published: 2023-11-18
Description: The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/browser/paid-memberships-pro/tags/2.12.3/includes/fields.php#L564; https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/fields.php; https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/functions.php
CVE: CVE-2023-40809
Published: 2023-11-18
Description: OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://www.esecforte.com/cve-2023-40809-html-injection-search/; https://www.esecforte.com/cve-2023-40809-html-injection-search/
CVE: CVE-2023-40810
Published: 2023-11-18
Description: OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-40810-html-injection-product-creation/; https://www.esecforte.com/cve-2023-40810-html-injection-product-creation/
CVE: CVE-2023-40812
Published: 2023-11-18
Description: OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-40812-html-injection-accounts-group/; https://www.esecforte.com/cve-2023-40812-html-injection-accounts-group/
CVE: CVE-2023-40813
Published: 2023-11-18
Description: OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-40813-html-injection-saved-search/; https://www.esecforte.com/cve-2023-40813-html-injection-saved-search/
CVE: CVE-2023-40814
Published: 2023-11-18
Description: OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-40814-html-injection-accounts/; https://www.esecforte.com/cve-2023-40814-html-injection-accounts/
CVE: CVE-2023-40815
Published: 2023-11-18
Description: OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-40815-html-injection-category/; https://www.esecforte.com/cve-2023-40815-html-injection-category/
CVE: CVE-2023-40816
Published: 2023-11-18
Description: OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-40816-html-injection-activity-milestone/; https://www.esecforte.com/cve-2023-40816-html-injection-activity-milestone/
CVE: CVE-2023-40817
Published: 2023-11-18
Description: OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-40817-html-injection-product-configuration/; https://www.esecforte.com/cve-2023-40817-html-injection-product-configuration/
CVE: CVE-2023-38361
Published: 2023-11-18
Description: IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  260770.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260770; https://www.ibm.com/support/pages/node/7066431; https://exchange.xforce.ibmcloud.com/vulnerabilities/260770