deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-31425
Published: 2023-08-01
Description: A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticated user to perform privilege escalation to root by breaking the rbash shell. Starting with Fabric OS v9.1.0, “root” account access is disabled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/external/content/SecurityAdvisories/0/22407; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31429
Published: 2023-08-01
Description: Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”, errmoduleshow, errfilterset, hassiscfgperrthreshold, supportshowcfgdisable and supportshowcfgenable commands that can cause the content of shell interpreted variables to be printed in the terminal.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-209, CWE-77
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22408; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31426
Published: 2023-08-01
Description: 


The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords in supportsave. This could allow a remote authenticated attacker to access sensitive information.






CVSS Score: 6.8 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22377; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31427
Published: 2023-08-01
Description: Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0, “root” account access is disabled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/external/content/SecurityAdvisories/0/22379; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-33560
Published: 2023-08-01
Description: There is a Cross Site Scripting (XSS) vulnerability in "cid" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4; https://www.phpjabbers.com/time-slots-booking-calendar/; https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4
CVE: CVE-2023-33561
Published: 2023-08-01
Description: Improper input validation of password parameter in PHP Jabbers Time Slots Booking Calendar v 3.3 results in insecure passwords.
CVSS Score: 9.8 (CRITICAL)
References: https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4; https://www.phpjabbers.com/time-slots-booking-calendar/; https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4
CVE: CVE-2023-33562
Published: 2023-08-01
Description: User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
CVSS Score: 9.8 (CRITICAL)
References: https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4; https://www.phpjabbers.com/time-slots-booking-calendar/; https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4
CVE: CVE-2023-33563
Published: 2023-08-01
Description: In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4; https://www.phpjabbers.com/time-slots-booking-calendar/; https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4
CVE: CVE-2023-33564
Published: 2023-08-01
Description: There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4; https://www.phpjabbers.com/time-slots-booking-calendar/; https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4
CVE: CVE-2023-34869
Published: 2023-08-01
Description: PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php?controller=pjAdmin&action=pjActionForgot.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4; https://www.phpjabbers.com/catering-system/; https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4
CVE: CVE-2023-36118
Published: 2023-08-01
Description: Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the page parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/172672/Faculty-Evaluation-System-1.0-Shell-Upload.html; https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/Faculty%20Evaluation%20System%20v1.0.md; https://hackmd.io/%40SY-T/Hy6HvwxPn
CVE: CVE-2023-36351
Published: 2023-08-01
Description: An issue in Viatom Health ViHealth for Android v.2.74.58 and before allows a remote attacker to execute arbitrary code via the com.viatom.baselib.mvvm.webWebViewActivity component.
CVSS Score: 7.8 (HIGH)
References: https://github.com/actuator/cve/blob/main/CVE-2023-36351; https://github.com/actuator/cve/blob/main/vihealth.md; https://github.com/actuator/cve/blob/main/CVE-2023-36351
CVE: CVE-2023-3107
Published: 2023-08-01
Description: A set of carefully crafted ipv6 packets can trigger an integer overflow in the calculation of a fragment reassembled packet's payload length field. This allows an attacker to trigger a kernel panic, resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-23:06.ipv6.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-23:06.ipv6.asc
CVE: CVE-2023-3494
Published: 2023-08-01
Description: The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports.  The interface lets the guest copy a string into a buffer resident in the bhyve process' memory.  A bug in the state machine implementation can result in a buffer overflowing when copying this string. Malicious, privileged software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root, mitigated by the capabilities assigned through the Capsicum sandbox available to the bhyve process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-23:07.bhyve.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-23:07.bhyve.asc
CVE: CVE-2023-3727
Published: 2023-08-01
Description: Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1454086; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-3728
Published: 2023-08-01
Description: Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1457421; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-3729
Published: 2023-08-01
Description: Use after free in Splitscreen in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-chromeos.html; https://crbug.com/1451803; https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-chromeos.html
CVE: CVE-2023-3730
Published: 2023-08-01
Description: Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1453465; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-3731
Published: 2023-08-01
Description: Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-chromeos.html; https://crbug.com/1441306; https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-chromeos.html
CVE: CVE-2023-3732
Published: 2023-08-01
Description: Out of bounds memory access in Mojo in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/174223/Chrome-IPCZ-FragmentDescriptors-Missing-Validation.html; https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1450899
CVE: CVE-2023-3733
Published: 2023-08-01
Description: Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1450203; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-3734
Published: 2023-08-01
Description: Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1450376; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-3735
Published: 2023-08-01
Description: Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-838
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1394410; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-3736
Published: 2023-08-01
Description: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1434438; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-3737
Published: 2023-08-01
Description: Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1446754; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-3738
Published: 2023-08-01
Description: Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1434330; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-3739
Published: 2023-08-01
Description: Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker to execute arbitrary code via a crafted shell script. (Chromium security severity: Low)
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-chromeos.html; https://crbug.com/1398986; https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-chromeos.html
CVE: CVE-2023-3740
Published: 2023-08-01
Description: Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve malicious content to a user via a crafted background URL. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://crbug.com/1405223; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-0632
Published: 2023-08-02
Description: An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/gitlab/-/issues/390148; https://hackerone.com/reports/1852677; https://gitlab.com/gitlab-org/gitlab/-/issues/390148
CVE: CVE-2023-1210
Published: 2023-08-02
Description: An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membership by email domain.
CVSS Score: 3.1 (LOW)
CWE: CWE-209
References: https://gitlab.com/gitlab-org/gitlab/-/issues/394775; https://hackerone.com/reports/1884672; https://gitlab.com/gitlab-org/gitlab/-/issues/394775
CVE: CVE-2023-2164
Published: 2023-08-02
Description: An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/407783; https://hackerone.com/reports/1940598; https://gitlab.com/gitlab-org/gitlab/-/issues/407783
CVE: CVE-2023-31428
Published: 2023-08-02
Description: Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user's home directory using grep.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/external/content/SecurityAdvisories/0/22380; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31430
Published: 2023-08-02
Description: A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated privileged user to crash the Brocade Fabric OS switch leading to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/external/content/SecurityAdvisories/0/22381; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31431
Published: 2023-08-02
Description: A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crash the Brocade Fabric OS switch leading to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/external/content/SecurityAdvisories/0/22384; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31432
Published: 2023-08-02
Description: Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/external/content/SecurityAdvisories/0/22385; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31928
Published: 2023-08-02
Description: A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html  of Brocade Fabric OS version before Brocade Fabric OS v9.2.0 that could allow a remote unauthenticated attacker to execute arbitrary JavaScript code in a target user’s session with the Brocade Webtools application.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/external/content/SecurityAdvisories/0/22390; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-36121
Published: 2023-08-02
Description: Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/e107%20v2.3.2.md; https://www.chtsecurity.com/news/0a4743a5-491e-4685-95ee-df8316ab5284; https://www.chtsecurity.com/news/6c6675d4-3254-46ce-a16d-26523ff80540
CVE: CVE-2023-38990
Published: 2023-08-02
Description: An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the Administrator.
CVSS Score: 4.3 (MEDIUM)
References: https://github.com/thinkgem/jeesite/issues/519; https://github.com/thinkgem/jeesite/issues/519
CVE: CVE-2023-3364
Published: 2023-08-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/gitlab/-/issues/415995; https://hackerone.com/reports/1959727; https://gitlab.com/gitlab-org/gitlab/-/issues/415995
CVE: CVE-2023-3385
Published: 2023-08-02
Description: An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://gitlab.com/gitlab-org/gitlab/-/issues/416161; https://hackerone.com/reports/2032730; https://gitlab.com/gitlab-org/gitlab/-/issues/416161
CVE: CVE-2023-31926
Published: 2023-08-02
Description: System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-281, CWE-665, CWE-281, CWE-665
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/external/content/SecurityAdvisories/0/22388; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31927
Published: 2023-08-02
Description: An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated attacker to get technical details about the web interface.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/external/content/SecurityAdvisories/0/22389; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-3500
Published: 2023-08-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/416902; https://hackerone.com/reports/2010926; https://gitlab.com/gitlab-org/gitlab/-/issues/416902
CVE: CVE-2023-3900
Published: 2023-08-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1287
References: https://gitlab.com/gitlab-org/gitlab/-/issues/418770; https://hackerone.com/reports/2058514; https://gitlab.com/gitlab-org/gitlab/-/issues/418770