deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-23130
Published: 2023-02-01
Description: Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://github.com/l00neyhacker/CVE-2023-23130; https://github.com/l00neyhacker/CVE-2023-23130
CVE: CVE-2023-23131
Published: 2023-02-01
Description: Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://github.com/l00neyhacker/CVE-2023-23131; https://github.com/l00neyhacker/CVE-2023-23131
CVE: CVE-2023-23132
Published: 2023-02-01
Description: Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://github.com/l00neyhacker/CVE-2023-23132; https://github.com/l00neyhacker/CVE-2023-23132
CVE: CVE-2023-24610
Published: 2023-02-01
Description: NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. The client-side checks can be bypassed. This may allow attackers to steal Protected Health Information because the product is for health charting.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://gist.github.com/abbisQQ/d8392acf7e02003e73af973cc9f5f54a; https://github.com/shihjay2/docker-nosh; https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533
CVE: CVE-2023-24997
Published: 2023-02-01
Description: Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick  https://github.com/apache/inlong/pull/7223 https://github.com/apache/inlong/pull/7223  to solve it.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/nxvtxq7oxhwyzo9ty2hqz8rvh5r7ngd8; https://lists.apache.org/thread/nxvtxq7oxhwyzo9ty2hqz8rvh5r7ngd8
CVE: CVE-2022-48093
Published: 2023-02-01
Description: Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://www.yuque.com/litanhua-fost9/hu05qa/ng2cb9ln0i0oqpo7?singleDo; https://www.yuque.com/litanhua-fost9/hu05qa/ng2cb9ln0i0oqpo7?singleDo
CVE: CVE-2022-48094
Published: 2023-02-01
Description: lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://www.yuque.com/litanhua-fost9/hu05qa/gp3psgfdt1czpf45?singleDoc; https://www.yuque.com/litanhua-fost9/hu05qa/gp3psgfdt1czpf45?singleDoc
CVE: CVE-2023-23135
Published: 2023-02-01
Description: An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.yuque.com/litanhua-fost9/hu05qa/fdmgbrzlvq9qpg3a?singleDoc; https://www.yuque.com/litanhua-fost9/hu05qa/fdmgbrzlvq9qpg3a?singleDoc
CVE: CVE-2023-23136
Published: 2023-02-01
Description: lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.yuque.com/litanhua-fost9/hu05qa/izexczwp01w5c68i?singleDoc; https://www.yuque.com/litanhua-fost9/hu05qa/izexczwp01w5c68i?singleDoc
CVE: CVE-2022-4254
Published: 2023-02-01
Description: sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
CVSS Score: 8.8 (HIGH)
CWE: CWE-90, CWE-90
References: https://access.redhat.com/security/cve/CVE-2022-4254; https://bugzilla.redhat.com/show_bug.cgi?id=2149894; https://github.com/SSSD/sssd/commit/a2b9a[PII_REDACTED]1f2a4fa7e2bb5ab49fd561274
CVE: CVE-2023-0617
Published: 2023-02-01
Description: A vulnerability was found in TRENDNet TEW-811DRU 1.0.10.0. It has been classified as critical. This affects an unknown part of the file /wireless/guestnetwork.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219957 was assigned to this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://vuldb.com/?ctiid.219957; https://vuldb.com/?id.219957; https://vuldb.com/?ctiid.219957
CVE: CVE-2023-0618
Published: 2023-02-01
Description: A vulnerability was found in TRENDnet TEW-652BRP 3.04B01. It has been declared as critical. This vulnerability affects unknown code of the file cfg_op.ccp of the component Web Service. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219958 is the identifier assigned to this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://vuldb.com/?ctiid.219958; https://vuldb.com/?id.219958; https://vuldb.com/?ctiid.219958
CVE: CVE-2022-43922
Published: 2023-02-01
Description: IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, and 6.2 could disclose sensitive information to an attacker due to a weak hash of an API Key in the configuration.  IBM X-Force ID:  241583.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-326, CWE-328
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/241583; https://www.ibm.com/support/pages/node/6857807; https://exchange.xforce.ibmcloud.com/vulnerabilities/241583
CVE: CVE-2022-47983
Published: 2023-02-01
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  243161.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/243161; https://www.ibm.com/support/pages/node/6857695; https://exchange.xforce.ibmcloud.com/vulnerabilities/243161
CVE: CVE-2023-22281
Published: 2023-02-01
Description: On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP AFM NAT policy with a destination NAT rule is configured on a FastL4 virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.5 (HIGH)
CWE: CWE-908, CWE-908
References: https://my.f5.com/manage/s/article/K46048342; https://my.f5.com/manage/s/article/K46048342
CVE: CVE-2023-22283
Published: 2023-02-01
Description: On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://my.f5.com/manage/s/article/K07143733; https://my.f5.com/manage/s/article/K07143733
CVE: CVE-2023-22302
Published: 2023-02-01
Description: In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-772, CWE-772
References: https://my.f5.com/manage/s/article/K58550078; https://my.f5.com/manage/s/article/K58550078
CVE: CVE-2023-22323
Published: 2023-02-01
Description: In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CPU resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://my.f5.com/manage/s/article/K56412001; https://my.f5.com/manage/s/article/K56412001
CVE: CVE-2023-22326
Published: 2023-02-01
Description: In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell (tmsh) dig command which may allow an authenticated attacker with resource administrator or administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://my.f5.com/manage/s/article/K83284425; https://my.f5.com/manage/s/article/K83284425
CVE: CVE-2023-22340
Published: 2023-02-01
Description: On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://my.f5.com/manage/s/article/K34525368; https://my.f5.com/manage/s/article/K34525368
CVE: CVE-2023-22341
Published: 2023-02-01
Description: On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel (TMM) to terminate:

  *  An OAuth Server that references an OAuth Provider
  *  An OAuth profile with the Authorization Endpoint set to '/'
  *  An access profile that references the above OAuth profile and is associated with an HTTPS virtual server 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.



CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://my.f5.com/manage/s/article/K20717585; https://my.f5.com/manage/s/article/K20717585
CVE: CVE-2023-22358
Published: 2023-02-01
Description: In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://my.f5.com/manage/s/article/K76964818; https://my.f5.com/manage/s/article/K76964818
CVE: CVE-2023-22374
Published: 2023-02-01
Description: 
A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary.
 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.



CVSS Score: 8.5 (HIGH)
CWE: CWE-134, CWE-134
References: https://my.f5.com/manage/s/article/K000130415; https://my.f5.com/manage/s/article/K000130415
CVE: CVE-2023-22418
Published: 2023-02-01
Description: On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy.  This vulnerability allows an unauthenticated malicious attacker to build an open redirect URI.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://my.f5.com/manage/s/article/K95503300; https://my.f5.com/manage/s/article/K95503300
CVE: CVE-2023-22422
Published: 2023-02-01
Description: On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods: Reject are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://my.f5.com/manage/s/article/K43881487; https://my.f5.com/manage/s/article/K43881487
CVE: CVE-2023-22657
Published: 2023-02-01
Description: On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for command injection.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.0 (HIGH)
CWE: CWE-77, CWE-77
References: https://my.f5.com/manage/s/article/K06345931; https://my.f5.com/manage/s/article/K06345931
CVE: CVE-2023-22664
Published: 2023-02-01
Description: On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://my.f5.com/manage/s/article/K56676554; https://my.f5.com/manage/s/article/K56676554
CVE: CVE-2023-22839
Published: 2023-02-01
Description: On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://my.f5.com/manage/s/article/K37708118; https://my.f5.com/manage/s/article/K37708118
CVE: CVE-2023-22842
Published: 2023-02-01
Description: On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://my.f5.com/manage/s/article/K08182564; https://my.f5.com/manage/s/article/K08182564
CVE: CVE-2023-23552
Published: 2023-02-01
Description: On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://my.f5.com/manage/s/article/K17542533; https://my.f5.com/manage/s/article/K17542533
CVE: CVE-2023-23555
Published: 2023-02-01
Description: On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0, when FastL4 profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.5 (HIGH)
CWE: CWE-665, CWE-665
References: https://my.f5.com/manage/s/article/K24572686; https://my.f5.com/manage/s/article/K24572686
CVE: CVE-2023-22501
Published: 2023-02-01
Description: An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases:

* If the attacker is included on Jira issues or requests with these users, or
* If the attacker is forwarded or otherwise gains access to emails containing a “View Request” link from these users.

Bot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://jira.atlassian.com/browse/JSDSERVER-12312; https://jira.atlassian.com/browse/JSDSERVER-12312
CVE: CVE-2023-23469
Published: 2023-02-01
Description: 
IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 244504.


CVSS Score: 4.0 (MEDIUM)
CWE: CWE-525
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244504; https://www.ibm.com/support/pages/node/6857999; https://exchange.xforce.ibmcloud.com/vulnerabilities/244504
CVE: CVE-2023-23969
Published: 2023-02-01
Description: In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://docs.djangoproject.com/en/4.1/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://lists.debian.org/debian-lts-announce/2023/02/msg00000.html
CVE: CVE-2022-46934
Published: 2023-02-01
Description: kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/kekingcn/kkFileView/issues/411; https://github.com/kekingcn/kkFileView/issues/411
CVE: CVE-2023-0619
Published: 2023-02-01
Description: The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset image optimizations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/kraken-image-optimizer/tags/2.6.6/kraken.php#L705; https://www.wordfence.com/threat-intel/vulnerabilities/id/f94eabc5-6e3b-46df-9e36-d7d0fad833de?source=cve; https://plugins.trac.wordpress.org/browser/kraken-image-optimizer/tags/2.6.6/kraken.php#L705
CVE: CVE-2023-22284
Published: 2023-02-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2023-22287
Published: 2023-02-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2023-23073
Published: 2023-02-01
Description: Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]9171?tab=originator; https://www.manageengine.com/products/service-desk/CVE-2023-23073.html; https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]9171?tab=originator
CVE: CVE-2023-23074
Published: 2023-02-01
Description: Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]9195?tab=originator; https://www.manageengine.com/products/service-desk/CVE-2023-23074.html; https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]9195?tab=originator
CVE: CVE-2023-23075
Published: 2023-02-01
Description: Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]3045?tab=originator; https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]3045?tab=originator
CVE: CVE-2023-23076
Published: 2023-02-01
Description: OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]9751?tab=originator; https://www.manageengine.com/products/support-center/CVE-2023-23076.html; https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]9751?tab=originator
CVE: CVE-2023-23077
Published: 2023-02-01
Description: Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]7693?tab=originator; https://www.manageengine.com/products/service-desk/CVE-2023-23077.html; https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]7693?tab=originator
CVE: CVE-2023-23078
Published: 2023-02-01
Description: Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]8675?tab=originator; https://www.manageengine.com/products/service-desk/CVE-2023-23078.html; https://bugbounty.zohocorp.com/bb/#/bug/[PII_REDACTED]8675?tab=originator
CVE: CVE-2022-30904
Published: 2023-02-01
Description: In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no check for the SegN field of the Transaction Start PDU.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: https://docs.google.com/document/d/1is3dYwMcRIkhjvujzi5OgnaGBsQVtlew/edit; https://docs.google.com/document/d/1is3dYwMcRIkhjvujzi5OgnaGBsQVtlew/edit
CVE: CVE-2022-31363
Published: 2023-02-01
Description: Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is pb_transport_handle_frag_. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered during mesh provisioning. Because there is no check for mismatched SegN and TotalLength in Transaction Start PDU.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: https://docs.google.com/document/d/1iSZze8Ig6HZVsrldmXw0bibZLGMMTU5w/edit; https://docs.google.com/document/d/1iSZze8Ig6HZVsrldmXw0bibZLGMMTU5w/edit