deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1591
Published: 2023-03-23
Description: A vulnerability classified as critical has been found in SourceCodester Automatic Question Paper Generator System 1.0. This affects an unknown part of the file classes/Users.php?f=save_ruser. The manipulation of the argument id/email leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-223659.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.223659; https://vuldb.com/?id.223659; https://vuldb.com/?ctiid.223659
CVE: CVE-2023-1592
Published: 2023-03-23
Description: A vulnerability classified as critical was found in SourceCodester Automatic Question Paper Generator System 1.0. This vulnerability affects unknown code of the file admin/courses/view_class.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-223660.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.223660; https://vuldb.com/?id.223660; https://vuldb.com/?ctiid.223660
CVE: CVE-2023-1593
Published: 2023-03-23
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Automatic Question Paper Generator System 1.0. This issue affects some unknown processing of the file classes/Master.php?f=save_class. The manipulation of the argument description leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-223661 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.223661; https://vuldb.com/?id.223661; https://vuldb.com/?ctiid.223661
CVE: CVE-2023-1594
Published: 2023-03-23
Description: A vulnerability, which was classified as critical, was found in novel-plus 3.6.2. Affected is the function MenuService of the file sys/menu/list. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223662 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/OYyunshen/Poc/blob/main/Novel-PlusV3.6.2Sqli.pdf; https://vuldb.com/?ctiid.223662; https://vuldb.com/?id.223662
CVE: CVE-2018-25048
Published: 2023-03-23
Description: The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://customers.codesys.com/fileadmin/data/customers/security/2018/Advisory2018-04_CDS-59017.pdf; https://customers.codesys.com/fileadmin/data/customers/security/2018/Advisory2018-04_CDS-59017.pdf
CVE: CVE-2023-1595
Published: 2023-03-23
Description: A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/log/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223663.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/[PII_REDACTED]/novel-plus-v3.6.2----Background-SQL-Injection-Vulnerability-/blob/main/novel-plus%20v3.6.2%20--%20Background%20SQL%20Injection%20Vulnerability.md; https://vuldb.com/?ctiid.223663; https://vuldb.com/?id.223663
CVE: CVE-2022-44742
Published: 2023-03-23
Description: Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/community-events/wordpress-community-events-plugin-1-4-8-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/community-events/wordpress-community-events-plugin-1-4-8-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45843
Published: 2023-03-23
Description: Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin <= 3.5.1.9 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/smart-slider-3/wordpress-smart-slider-3-3-5-1-9-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smart-slider-3/wordpress-smart-slider-3-3-5-1-9-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-47431
Published: 2023-03-23
Description: Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/open-rdw-kenteken-voertuiginformatie/wordpress-open-rdw-kenteken-voertuiginformatie-plugin-2-0-14-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/open-rdw-kenteken-voertuiginformatie/wordpress-open-rdw-kenteken-voertuiginformatie-plugin-2-0-14-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-4224
Published: 2023-03-23
Description: In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1188, CWE-1188
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17553&token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17553&token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d&download=
CVE: CVE-2023-22704
Published: 2023-03-23
Description: Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 8.1.8 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/teachpress/wordpress-teachpress-plugin-8-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/teachpress/wordpress-teachpress-plugin-8-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28422
Published: 2023-03-23
Description: Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/mage-eventpress/wordpress-event-manager-for-woocommerce-plugin-3-8-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mage-eventpress/wordpress-event-manager-for-woocommerce-plugin-3-8-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-28492
Published: 2023-03-23
Description: TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/B2eFly/CVE/blob/main/totolink/CP900/8/8.md; https://github.com/B2eFly/Router/blob/main/totolink/CP900/8/8.md; https://github.com/B2eFly/CVE/blob/main/totolink/CP900/8/8.md
CVE: CVE-2023-22712
Published: 2023-03-23
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TemplatesNext TemplatesNext ToolKit plugin <= 3.2.7 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/templatesnext-toolkit/wordpress-templatesnext-toolkit-plugin-3-2-7-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/templatesnext-toolkit/wordpress-templatesnext-toolkit-plugin-3-2-7-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-22715
Published: 2023-03-23
Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Lester 'GaMerZ' Chan WP-CommentNavi plugin <= 1.12.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-commentnavi/wordpress-wp-commentnavi-plugin-1-12-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-commentnavi/wordpress-wp-commentnavi-plugin-1-12-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-22716
Published: 2023-03-23
Description: Auth. (admin+) Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.35 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/oopspam-anti-spam/wordpress-oopspam-anti-spam-plugin-1-1-35-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/oopspam-anti-spam/wordpress-oopspam-anti-spam-plugin-1-1-35-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23650
Published: 2023-03-23
Description: Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in MainWP MainWP Code Snippets Extension plugin <= 4.0.2 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mainwp-code-snippets-extension/wordpress-mainwp-code-snippets-extension-plugin-4-0-2-subscriber-stored-cross-site-scripting-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mainwp-code-snippets-extension/wordpress-mainwp-code-snippets-extension-plugin-4-0-2-subscriber-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE: CVE-2023-23864
Published: 2023-03-23
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Michael Aronoff Very Simple Google Maps plugin <= 2.8.4 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/very-simple-google-maps/wordpress-very-simple-google-maps-plugin-2-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/very-simple-google-maps/wordpress-very-simple-google-maps-plugin-2-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27079
Published: 2023-03-23
Description: Command Injection vulnerability found in Tenda G103 v.1.0.05 allows an attacker to obtain sensitive information via a crafted package
CVSS Score: 7.5 (HIGH)
CWE: CWE-77, CWE-77
References: https://github.com/B2eFly/Router/blob/main/Tenda/G103/2.md; https://github.com/B2eFly/Router/blob/main/Tenda/G103/2.md
CVE: CVE-2023-27655
Published: 2023-03-23
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2019-9587. Reason: This record is a reservation duplicate of CVE-2019-9587. Notes: All CVE users should reference CVE-2019-9587 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2022-28491
Published: 2023-03-23
Description: TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/B2eFly/CVE/blob/main/totolink/CP900/2/2.md; https://github.com/B2eFly/Router/blob/main/totolink/CP900/1/2.md; https://github.com/B2eFly/CVE/blob/main/totolink/CP900/2/2.md
CVE: CVE-2022-28493
Published: 2023-03-23
Description: A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service,
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/B2eFly/Router/blob/main/totolink/CP900/7/7.md; https://github.com/B2eFly/Router/blob/main/totolink/CP900/7/7.md
CVE: CVE-2022-47589
Published: 2023-03-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in this.Functional CTT Expresso para WooCommerce plugin <= 3.2.11 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ctt-expresso-para-woocommerce/wordpress-ctt-expresso-para-woocommerce-plugin-3-2-11-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/ctt-expresso-para-woocommerce/wordpress-ctt-expresso-para-woocommerce-plugin-3-2-11-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-22702
Published: 2023-03-23
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.13 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpappninja/wordpress-wpmobile-app-android-and-ios-mobile-application-plugin-11-13-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpappninja/wordpress-wpmobile-app-android-and-ios-mobile-application-plugin-11-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23722
Published: 2023-03-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP eBay Product Feeds plugin <= 3.3.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ebay-feeds-for-wordpress/wordpress-wp-ebay-product-feeds-plugin-3-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ebay-feeds-for-wordpress/wordpress-wp-ebay-product-feeds-plugin-3-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23728
Published: 2023-03-23
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Flipclock plugin <= 1.7.4 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-flipclock/wordpress-wp-flipclock-plugin-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-flipclock/wordpress-wp-flipclock-plugin-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27077
Published: 2023-03-23
Description: Stack Overflow vulnerability found in 360 D901 allows a remote attacker to cause a Distributed Denial of Service (DDOS) via a crafted HTTP package.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/B2eFly/Router/blob/main/360/360D901.md; https://github.com/B2eFly/Router/blob/main/360/360D901.md
CVE: CVE-2023-27078
Published: 2023-03-23
Description: A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted request to the tftp endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/B2eFly/Router/blob/main/TPLINK/MR3020/1.md; https://github.com/B2eFly/Router/blob/main/TPLINK/MR3020/1.md
CVE: CVE-2023-27135
Published: 2023-03-23
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/setWanIeCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Am1ngl/ttt/tree/main/29; https://github.com/Am1ngl/ttt/tree/main/29
CVE: CVE-2023-28772
Published: 2023-03-23
Description: An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3; https://github.com/torvalds/linux/commit/d3b16034a24a112bb83aeb669ac5b9b01f744bb7; https://lkml.kernel.org/r/[PII_REDACTED]2156.47889-1-yun.zhou%40windriver.com
CVE: CVE-2022-28497
Published: 2023-03-23
Description: TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_write_bootloader function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/B2eFly/Router/blob/main/totolink/CP900/6/6.md; https://github.com/B2eFly/Router/blob/main/totolink/CP900/6/6.md
CVE: CVE-2022-47173
Published: 2023-03-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nasirahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration plugin <= 1.62.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-form-integration/wordpress-connect-contact-form-7-woocommerce-to-google-sheets-other-platforms-advanced-form-integration-plugin-1-62-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-form-integration/wordpress-connect-contact-form-7-woocommerce-to-google-sheets-other-platforms-advanced-form-integration-plugin-1-62-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-28610
Published: 2023-03-23
Description: The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image. This allows a remote attacker to gain root access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://www.omicronenergy.com/en/support/product-security/; https://www.omicronenergy.com/fileadmin/user_upload/website/files/product-security/osa-5.txt; https://www.omicronenergy.com/en/support/product-security/
CVE: CVE-2022-28496
Published: 2023-03-23
Description: TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/B2eFly/Router/blob/main/totolink/CP900/1/1.md; https://github.com/B2eFly/Router/blob/main/totolink/CP900/1/1.md
CVE: CVE-2022-47145
Published: 2023-03-23
Description: Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/blockonomics-bitcoin-payments/wordpress-wordpress-bitcoin-payments-blockonomics-plugin-3-5-7-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/blockonomics-bitcoin-payments/wordpress-wordpress-bitcoin-payments-blockonomics-plugin-3-5-7-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-20027
Published: 2023-03-23
Description: A vulnerability in the implementation of the IPv4 Virtual Fragmentation Reassembly (VFR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper reassembly of large packets that occurs when VFR is enabled on either a tunnel interface or on a physical interface that is configured with a maximum transmission unit (MTU) greater than 4,615 bytes. An attacker could exploit this vulnerability by sending fragmented packets through a VFR-enabled interface on an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-416
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv4-vfr-dos-CXxtFacb; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv4-vfr-dos-CXxtFacb
CVE: CVE-2023-20029
Published: 2023-03-23
Description: A vulnerability in the Meraki onboarding feature of Cisco IOS XE Software could allow an authenticated, local attacker to gain root level privileges on an affected device. This vulnerability is due to insufficient memory protection in the Meraki onboarding feature of an affected device. An attacker could exploit this vulnerability by modifying the Meraki registration parameters. A successful exploit could allow the attacker to elevate privileges to root.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-sABD8hcU; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-sABD8hcU
CVE: CVE-2023-20035
Published: 2023-03-23
Description: A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability is due to insufficient input validation by the system CLI. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges. An attacker with limited user privileges could use this vulnerability to gain complete control over the system. Note: For additional information about specific impacts, see the Details section of this advisory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-146
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw
CVE: CVE-2023-20055
Published: 2023-03-23
Description: A vulnerability in the management API of Cisco DNA Center could allow an authenticated, remote attacker to elevate privileges in the context of the web-based management interface on an affected device. This vulnerability is due to the unintended exposure of sensitive information. An attacker could exploit this vulnerability by inspecting the responses from the API. Under certain circumstances, a successful exploit could allow the attacker to access the API with the privileges of a higher-level user account. To successfully exploit this vulnerability, the attacker would need at least valid Observer credentials.
CVSS Score: 8.0 (HIGH)
CWE: CWE-200
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-privesc-QFXe74RS; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-privesc-QFXe74RS
CVE: CVE-2023-20056
Published: 2023-03-23
Description: A vulnerability in the management CLI of Cisco access point (AP) software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command. A successful exploit could allow the attacker to cause an affected device to reload spontaneously, resulting in a DoS condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-cli-dos-tc2EKEpu; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-cli-dos-tc2EKEpu
CVE: CVE-2023-20059
Published: 2023-03-23
Description: A vulnerability in the implementation of the Cisco Network Plug-and-Play (PnP) agent of Cisco DNA Center could allow an authenticated, remote attacker to view sensitive information in clear text. The attacker must have valid low-privileged user credentials. This vulnerability is due to improper role-based access control (RBAC) with the integration of PnP. An attacker could exploit this vulnerability by authenticating to the device and sending a query to an internal API. A successful exploit could allow the attacker to view sensitive information in clear text, which could include configuration files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-555, CWE-312
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-infodisc-pe7zAbdR; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-infodisc-pe7zAbdR