deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22317
Published: 2023-08-03
Description: Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22314.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://jvn.jp/en/vu/JVNVU92877622/; https://jvn.jp/en/vu/JVNVU92877622/
CVE: CVE-2022-26838
Published: 2023-08-03
Description: Path traversal vulnerability in Importing Mobile Device Data of Cybozu Remote Service 3.1.2 allows a remote authenticated attacker to cause a denial-of-service (DoS) condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN52694228/; https://kb.cybozu.support/article/37653/; https://jvn.jp/en/jp/JVN52694228/
CVE: CVE-2023-22277
Published: 2023-08-03
Description: Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22317 and CVE-2023-22314.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://jvn.jp/en/vu/JVNVU92877622/; https://jvn.jp/en/vu/JVNVU92877622/
CVE: CVE-2023-25600
Published: 2023-08-03
Description: An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial of service. This is fixed in version 01.01.04.0016.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2023028; https://www.insyde.com/security-pledge
CVE: CVE-2023-28468
Published: 2023-08-03
Description: An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2023039; https://www.insyde.com/security-pledge
CVE: CVE-2023-2754
Published: 2023-08-03
Description: The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client did not assign loopback IPv6 addresses but Unique Local Addresses, which under certain conditions could point towards unknown devices in the same local network which enables an Attacker to view DNS queries made by the device.



CVSS Score: 7.4 (HIGH)
CWE: CWE-319, CWE-319
References: https://developers.cloudflare.com/warp-client/; https://github.com/cloudflare/advisories/security/advisories/GHSA-mv6g-7577-vq4w; https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release
CVE: CVE-2023-36298
Published: 2023-08-03
Description: DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE).
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/MentalityXt/Dedecms-v5.7.109-RCE; https://github.com/MentalityXt/Dedecms-v5.7.109-RCE
CVE: CVE-2023-36299
Published: 2023-08-03
Description: A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and options-general parameters in index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/MentalityXt/typecho-v1.2.1-RCE; https://github.com/typecho/typecho/releases/tag/v1.2.1; https://github.com/MentalityXt/typecho-v1.2.1-RCE
CVE: CVE-2023-38812
Published: 2023-08-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-39096
Published: 2023-08-03
Description: WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and output encoding.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.realinfosec.net/advisories/WEBBOSS-P-XSS-2023-0xt2tt.html; https://www.realinfosec.net/advisories/WEBBOSS-P-XSS-2023-0xt2tt.html
CVE: CVE-2023-39097
Published: 2023-08-03
Description: WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://realinfosec.net/advisories/WEBBOSS-P-XSS-2023-0xf8gi.html; https://realinfosec.net/advisories/WEBBOSS-P-XSS-2023-0xf8gi.html
CVE: CVE-2023-3180
Published: 2023-08-03
Description: A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/security/cve/CVE-2023-3180; https://bugzilla.redhat.com/show_bug.cgi?id=2222424; https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html
CVE: CVE-2023-3348
Published: 2023-08-03
Description: The Wrangler command line tool  (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command). This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server.




CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://developers.cloudflare.com/workers/wrangler/; https://github.com/cloudflare/workers-sdk; https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-8c93-4hch-xgxp
CVE: CVE-2023-3766
Published: 2023-08-03
Description: A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker with knowledge of this vulnerability to craft and send specially designed encrypted queries to targeted ODOH servers running with odoh-rs. Upon successful exploitation, the server will crash abruptly, disrupting its normal operation and rendering the service temporarily unavailable.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/cloudflare/odoh-rs/pull/28; https://github.com/cloudflare/odoh-rs/security/advisories/GHSA-gpcv-p28p-fv2p; https://github.com/cloudflare/odoh-rs/pull/28
CVE: CVE-2023-4132
Published: 2023-08-03
Description: A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416, CWE-416
References: https://access.redhat.com/errata/RHSA-2023:6901; https://access.redhat.com/errata/RHSA-2023:7077; https://access.redhat.com/errata/RHSA-2024:0575
CVE: CVE-2023-4133
Published: 2023-08-03
Description: A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, causing a denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/errata/RHSA-2024:2394; https://access.redhat.com/errata/RHSA-2024:2950; https://access.redhat.com/errata/RHSA-2024:3138
CVE: CVE-2023-4136
Published: 2023-08-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/174304/CrafterCMS-4.0.2-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/30; https://docs.craftercms.org/en/4.0/security/advisory.html#cv[PII_REDACTED]
CVE: CVE-2023-4138
Published: 2023-08-03
Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/ikus060/rdiffweb/commit/feef0d7b11d86aed29bf98c[PII_REDACTED]7964d85; https://huntr.dev/bounties/1b1fa915-d588-4bb1-9e82-6a6be79befed; https://github.com/ikus060/rdiffweb/commit/feef0d7b11d86aed29bf98c[PII_REDACTED]7964d85
CVE: CVE-2023-33363
Published: 2023-08-03
Description: An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functionality on BioStar 2 servers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33363; https://kb.supremainc.com/knowledge/doku.php?id=en:release_note_291; https://claroty.com/team82/disclosure-dashboard/cve-2023-33363
CVE: CVE-2023-33364
Published: 2023-08-03
Description: An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioStar 2 server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33364; https://kb.supremainc.com/knowledge/doku.php?id=en:release_note_291; https://claroty.com/team82/disclosure-dashboard/cve-2023-33364
CVE: CVE-2023-33365
Published: 2023-08-03
Description: A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files from the server's web server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33365; https://kb.supremainc.com/knowledge/doku.php?id=en:release_note_291; https://claroty.com/team82/disclosure-dashboard/cve-2023-33365
CVE: CVE-2023-33366
Published: 2023-08-03
Description: A SQL injection vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows authenticated users to inject arbitrary SQL directives into an SQL statement and execute arbitrary SQL commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33366; https://kb.supremainc.com/knowledge/doku.php?id=en:release_note_291; https://claroty.com/team82/disclosure-dashboard/cve-2023-33366
CVE: CVE-2023-38947
Published: 2023-08-03
Description: An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-616
References: https://gitee.com/CTF-hacker/pwn/issues/I7LH2N; https://github.com/capture0x/WBCE_CMS; https://packetstormsecurity.com/files/176018/WBCE-CMS-1.6.1-Shell-Upload.html
CVE: CVE-2023-38948
Published: 2023-08-03
Description: An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin.
CVSS Score: 7.2 (HIGH)
CWE: CWE-552
References: https://gitee.com/CTF-hacker/pwn/issues/I7LI4E; https://gitee.com/CTF-hacker/pwn/issues/I7LI4E
CVE: CVE-2023-25524
Published: 2023-08-03
Description: 
NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access token is displayed in the browser user's address bar. An attacker could use this token to impersonate the user to access launcher resources. A successful exploit of this vulnerability may lead to information disclosure.


CVSS Score: 4.0 (MEDIUM)
CWE: CWE-598
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5472; https://nvidia.custhelp.com/app/answers/detail/a_id/5472
CVE: CVE-2023-36213
Published: 2023-08-03
Description: SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/172698/MotoCMS-3.4.3-SQL-Injection.html; https://www.exploit-db.com/exploits/51504; https://packetstormsecurity.com/files/172698/MotoCMS-3.4.3-SQL-Injection.html
CVE: CVE-2023-4145
Published: 2023-08-03
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2; https://huntr.dev/bounties/ce[PII_REDACTED]-40b4-bb4e-c4d10023eeb0; https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2
CVE: CVE-2022-42986
Published: 2023-08-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-39122. Reason: This candidate is a reservation duplicate of CVE-2023-39122. Notes: All CVE users should reference CVE-2023-39122 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-32764
Published: 2023-08-03
Description: Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.
CVSS Score: 7.8 (HIGH)
References: https://help.supportservices.fabasoft.com/index.php?topic=doc/Vulnerabilities-Fabasoft-Folio/vulnerabilities-2023.htm#client-autoupdate-harmful-code-installation-vulnerability-pdo06614-; https://www.compass-security.com/fileadmin/Research/Advisories/2023_01_CSNC-2023-002_LPE_Cloud_Client.txt; https://help.supportservices.fabasoft.com/index.php?topic=doc/Vulnerabilities-Fabasoft-Folio/vulnerabilities-2023.htm#client-autoupdate-harmful-code-installation-vulnerability-pdo06614-
CVE: CVE-2023-35081
Published: 2023-08-03
Description: A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3,  11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US; https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35081
CVE: CVE-2023-36217
Published: 2023-08-03
Description: Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 allows a remote attacker to execute arbitrary code via the category name field of the image manager function.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.10; https://www.exploit-db.com/exploits/51520; https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.10
CVE: CVE-2023-39075
Published: 2023-08-03
Description: Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) allows attackers to crash the infotainment system by sending arbitrary USB data via a USB device.
CVSS Score: 4.6 (MEDIUM)
References: https://blog.dhjeong.kr/posts/automotive/2023/12/how-to-fuzzing-realcars/; https://blog.dhjeong.kr/posts/vuln/202307/renault-zoe/; https://blog.jhyeon.dev/posts/vuln/202307/renault-zoe/
CVE: CVE-2023-0956
Published: 2023-08-03
Description: 
External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.


CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://cert.pl/posts/2023/07/CVE-2023-0956/; https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03; https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956
CVE: CVE-2023-38942
Published: 2023-08-03
Description: Dango-Translator v4.5.5 was discovered to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.json.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/PantsuDango/Dango-Translator; https://github.com/PantsuDango/Dango-Translator/issues/127; https://github.com/PantsuDango/Dango-Translator
CVE: CVE-2023-33666
Published: 2023-08-03
Description: ai-dev aioptimizedcombinations before v0.1.3 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/08/03/aioptimizedcombinations.html; https://www.boutique.ai-dev.fr/en/ergonomie/59-optimized-combinations.html; https://security.friendsofpresta.org/modules/2023/08/03/aioptimizedcombinations.html
CVE: CVE-2023-39121
Published: 2023-08-03
Description: emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/safe-b/CVE/issues/1; https://github.com/safe-b/CVE/issues/1#issue[PII_REDACTED]; https://github.com/safe-b/CVE/issues/1
CVE: CVE-2023-3749
Published: 2023-08-03
Description: A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.
CVSS Score: 7.1 (HIGH)
CWE: CWE-349, CWE-345
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-04; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-04
CVE: CVE-2023-20181
Published: 2023-08-03
Description: A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduct XSS attacks. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-web-multi-7kvPmu2F; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-web-multi-7kvPmu2F
CVE: CVE-2023-20204
Published: 2023-08-03
Description: A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
 This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-commpilot-xss-jC46sezF; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-commpilot-xss-jC46sezF
CVE: CVE-2023-20214
Published: 2023-08-03
Description: A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to gain read permissions or limited write permissions to the configuration of an affected Cisco SD-WAN vManage instance.
 This vulnerability is due to insufficient request validation when using the REST API feature. An attacker could exploit this vulnerability by sending a crafted API request to an affected vManage instance. A successful exploit could allow the attacker to retrieve information from and send information to the configuration of the affected Cisco vManage instance. This vulnerability only affects the REST API and does not affect the web-based management interface or the CLI.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-unauthapi-sphCLYPA; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-unauthapi-sphCLYPA
CVE: CVE-2023-20215
Published: 2023-08-03
Description: A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked.
 This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-202
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-vXvqwzsj; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-vXvqwzsj
CVE: CVE-2023-20216
Published: 2023-08-03
Description: A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileges to root on an affected system. 
 This vulnerability is due to incorrect implementation of user role permissions. An attacker could exploit this vulnerability by authenticating to the application as a user with the BWORKS or BWSUPERADMIN role and issuing crafted commands on an affected system. A successful exploit could allow the attacker to execute commands beyond the sphere of their intended access level, including initiating installs or running operating system commands with elevated permissions.
   There are workarounds that address this vulnerability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-269, CWE-732
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-priv-esc-qTgUZOsQ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-priv-esc-qTgUZOsQ
CVE: CVE-2023-20218
Published: 2023-08-03
Description: A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to modify a web page in the context of a user's browser.
 This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks.
 Cisco will not release software updates that address this vulnerability.  
  {{value}} ["%7b%7bvalue%7d%7d"])}]]
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-web-multi-7kvPmu2F; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-web-multi-7kvPmu2F
CVE: CVE-2023-30950
Published: 2023-08-03
Description: The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290, CWE-862
References: https://palantir.safebase.us/?tcuUid=d839709d-c50f-4a37-8faa-b0c35054418a; https://palantir.safebase.us/?tcuUid=d839709d-c50f-4a37-8faa-b0c35054418a