deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-23866
Published: 2023-04-25
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Carlos Moreira Interactive Geo Maps plugin <= 1.5.8 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/interactive-geo-maps/wordpress-interactive-geo-maps-plugin-1-5-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/interactive-geo-maps/wordpress-interactive-geo-maps-plugin-1-5-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23889
Published: 2023-04-25
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/quick-paypal-payments/wordpress-quick-paypal-payments-plugin-5-7-25-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quick-paypal-payments/wordpress-quick-paypal-payments-plugin-5-7-25-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23995
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Reeves & David Stöckl TinyMCE Custom Styles plugin <= 1.1.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/tinymce-custom-styles/wordpress-tinymce-custom-styles-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tinymce-custom-styles/wordpress-tinymce-custom-styles-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24005
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin plugin <= 2.5.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/inline-tweet-sharer/wordpress-inline-tweet-sharer-twitter-sharing-plugin-plugin-2-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/inline-tweet-sharer/wordpress-inline-tweet-sharer-twitter-sharing-plugin-plugin-2-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25461
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in namithjawahar Wp-Insert plugin <= 2.5.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-insert/wordpress-wp-insert-plugin-2-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-insert/wordpress-wp-insert-plugin-2-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25652
Published: 2023-04-25
Description: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2023/04/25/2; https://github.com/git/git/commit/18e2b1cfc[PII_REDACTED]5d7b08e6e50f3e8cbc902; https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e
CVE: CVE-2023-25815
Published: 2023-04-25
Description: In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.

This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`.
CVSS Score: 3.3 (LOW)
CWE: CWE-22, CWE-134, CWE-134
References: http://www.openwall.com/lists/oss-security/2023/04/25/2; https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack; https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1
CVE: CVE-2023-28084
Published: 2023-04-25
Description: HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-522, CWE-522
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04468en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04468en_us
CVE: CVE-2023-20871
Published: 2023-04-25
Description: VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges to gain root access to the host operating system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://www.vmware.com/security/advisories/VMSA-2023-0008.html; https://www.vmware.com/security/advisories/VMSA-2023-0008.html
CVE: CVE-2023-20872
Published: 2023-04-25
Description: VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.vmware.com/security/advisories/VMSA-2023-0008.html; https://www.vmware.com/security/advisories/VMSA-2023-0008.html
CVE: CVE-2023-23839
Published: 2023-04-25
Description: The SolarWinds Platform was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users to access Orion.WebCommunityStrings SWIS schema object and obtain sensitive information.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23839; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm
CVE: CVE-2023-24512
Published: 2023-04-25
Description: On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (referred to as the TerminAttr agent) is enabled and gNMI access is configured on the agent. Note: This gNMI over the Streaming Telemetry Agent scenario is mostly commonly used when streaming to a 3rd party system and is not used by default when streaming to CloudVision
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-863
References: https://www.arista.com/en/support/advisories-notices/security-advisory/17250-security-advisory-0086; https://www.arista.com/en/support/advisories-notices/security-advisory/17250-security-advisory-0086
CVE: CVE-2023-29007
Published: 2023-04-25
Description: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.
CVSS Score: 7.0 (HIGH)
CWE: CWE-74
References: https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt; https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4; https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844
CVE: CVE-2023-29011
Published: 2023-04-25
Description: Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to connect e.g. to SSH servers via proxies when certain ports are blocked for outgoing connections. The location of `connect.exe`'s config file is hard-coded as `/etc/connectrc` which will typically be interpreted as `C:\etc\connectrc`. Since `C:\etc` can be created by any authenticated user, this makes `connect.exe` susceptible to malicious files being placed there by other users on the same multi-user machine. The problem has been patched in Git for Windows v2.40.1. As a workaround, create the folder `etc` on all drives where Git commands are run, and remove read/write access from those folders. Alternatively, watch out for malicious `<drive>:\etc\connectrc` files on multi-user machines.
CVSS Score: 7.5 (HIGH)
CWE: CWE-427
References: https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1; https://github.com/git-for-windows/git/security/advisories/GHSA-g4fv-xjqw-q7jm; https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1
CVE: CVE-2023-29012
Published: 2023-04-25
Description: Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed `doskey.exe` would be executed silently upon running Git CMD. The problem has been patched in Git for Windows v2.40.1. As a workaround, avoid using Git CMD or, if using Git CMD, avoid starting it in an untrusted directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-427
References: https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1; https://github.com/git-for-windows/git/security/advisories/GHSA-gq5x-v87v-8f7g; https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1
CVE: CVE-2023-2269
Published: 2023-04-25
Description: A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-413, CWE-667
References: https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63AJUCJTZCII2JMAF7MGZEM66KY7IALT/
CVE: CVE-2023-2293
Published: 2023-04-25
Description: A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been classified as problematic. This affects an unknown part of the file classes/Master.php?f=save_item. The manipulation of the argument description with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227463.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/biantaibao/bug_report/blob/main/XSS-1.md; https://vuldb.com/?ctiid.227463; https://vuldb.com/?id.227463
CVE: CVE-2023-30549
Published: 2023-04-25
Description: Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.1.0 and installations that include apptainer-suid < 1.1.8 on older operating systems where that CVE has not been patched. That includes Red Hat Enterprise Linux 7, Debian 10 buster (unless the linux-5.10 package is installed), Ubuntu 18.04 bionic and Ubuntu 20.04 focal. Use-after-free flaws in the kernel can be used to attack the kernel for denial of service and potentially for privilege escalation.

Apptainer 1.1.8 includes a patch that by default disables mounting of extfs filesystem types in setuid-root mode, while continuing to allow mounting of extfs filesystems in non-setuid "rootless" mode using fuse2fs.

Some workarounds are possible. Either do not install apptainer-suid (for versions 1.1.0 through 1.1.7) or set `allow setuid = no` in apptainer.conf.  This requires having unprivileged user namespaces enabled and except for apptainer 1.1.x versions will disallow mounting of sif files, extfs files, and squashfs files in addition to other, less significant impacts.  (Encrypted sif files are also not supported unprivileged in apptainer 1.1.x.). Alternatively, use the `limit containers` options in apptainer.conf/singularity.conf to limit sif files to trusted users, groups, and/or paths, and set `allow container extfs = no` to disallow mounting of extfs overlay files.  The latter option by itself does not disallow mounting of extfs overlay partitions inside SIF files, so that's why the former options are also needed.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/cve-2022-1184; https://github.com/apptainer/apptainer/commit/5a4964f5ba9c8d89a0e353b97f51fd607670a9f7; https://github.com/apptainer/apptainer/releases/tag/v1.1.8
CVE: CVE-2023-30609
Published: 2023-04-25
Description: matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826; https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0; https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw
CVE: CVE-2023-20869
Published: 2023-04-25
Description: VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.vmware.com/security/advisories/VMSA-2023-0008.html; https://www.vmware.com/security/advisories/VMSA-2023-0008.html
CVE: CVE-2023-20870
Published: 2023-04-25
Description: VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.vmware.com/security/advisories/VMSA-2023-0008.html; https://www.vmware.com/security/advisories/VMSA-2023-0008.html
CVE: CVE-2023-30842
Published: 2023-04-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-25313. Reason: This candidate is a reservation duplicate of CVE-2023-25313. Notes: All CVE users should reference CVE-2023-25313 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-0045
Published: 2023-04-25
Description: The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set  function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall.  The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176.

We recommend upgrading past commit a664ec9158eeddd75121d39c9a[PII_REDACTED]fa96
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-610, CWE-610
References: https://git.kernel.org/tip/a664ec9158eeddd75121d39c9a[PII_REDACTED]fa96; https://github.com/google/security-research/security/advisories/GHSA-9x5g-vmxf-4qj8; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE: CVE-2023-31223
Published: 2023-04-25
Description: Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-31223; https://dradisframework.com/ce/security_reports.html#fixed-4.8.0; https://excellium-services.com/cert-xlm-advisory/cve-2023-31223/
CVE: CVE-2012-5872
Published: 2023-04-26
Description: ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.ush.it/2012/11/22/arc-v2011-12-01-multiple-vulnerabilities/; https://www.ush.it/2012/11/22/arc-v2011-12-01-multiple-vulnerabilities/
CVE: CVE-2012-5873
Published: 2023-04-26
Description: ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in an output=htmltab action.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.ush.it/2012/11/22/arc-v2011-12-01-multiple-vulnerabilities/; https://www.ush.it/2012/11/22/arc-v2011-12-01-multiple-vulnerabilities/
CVE: CVE-2023-26560
Published: 2023-04-26
Description: Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and potentially discover credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: https://cfengine.com/blog/2023/cve-2023-26560/; https://northern.tech; https://cfengine.com/blog/2023/cve-2023-26560/
CVE: CVE-2023-26735
Published: 2023-04-26
Description: blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources. NOTE: this is disputed by third parties because authentication can be configured.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: http://blackboxexporter.com; http://prometheus.com; https://github.com/prometheus/blackbox_exporter#tls-and-basic-authentication
CVE: CVE-2023-27843
Published: 2023-04-26
Description: SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://addons.prestashop.com/en/quotes/3725-ask-for-a-quote-convert-to-order-messaging-system.html; https://friends-of-presta.github.io/security-advisories/modules/2023/04/25/askforaquote.html; https://addons.prestashop.com/en/quotes/3725-ask-for-a-quote-convert-to-order-messaging-system.html
CVE: CVE-2023-30106
Published: 2023-04-26
Description: Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Rajeshwar40/CVE/blob/main/2023-30106; https://www.sourcecodester.com; https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-mts_0.zip
CVE: CVE-2023-30111
Published: 2023-04-26
Description: Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Rajeshwar40/CVE/blob/main/2023-30111; https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-mts_0.zip; https://github.com/Rajeshwar40/CVE/blob/main/2023-30111
CVE: CVE-2023-30404
Published: 2023-04-26
Description: Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd parameter in the formSysCmd function. This vulnerability is exploited via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://aigital.com; https://mandomat.github.io/2023-04-13-testing-a-cheap-wifi-repeater/; http://aigital.com
CVE: CVE-2022-36769
Published: 2023-04-26
Description: 
IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 232034.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/232034; https://www.ibm.com/support/pages/node/6980959; https://exchange.xforce.ibmcloud.com/vulnerabilities/232034
CVE: CVE-2022-41739
Published: 2023-04-26
Description: 
IBM Spectrum Scale (IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0) could allow programs running inside the container to overcome isolation mechanism and gain additional capabilities or access sensitive information on the host. IBM X-Force ID: 237815.


CVSS Score: 7.9 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/237815; https://www.ibm.com/support/pages/node/6964568; https://exchange.xforce.ibmcloud.com/vulnerabilities/237815
CVE: CVE-2023-2294
Published: 2023-04-26
Description: A vulnerability was found in UCMS 1.6.0. It has been classified as problematic. This affects an unknown part of the file saddpost.php of the component Column Configuration. The manipulation of the argument strorder leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227481 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/yztale/UCMS1.6/blob/main/README.md; https://vuldb.com/?ctiid.227481; https://vuldb.com/?id.227481
CVE: CVE-2023-2273
Published: 2023-04-26
Description: Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write arbitrary files. This issue is remediated in version 3.3.0 via safe guards that reject inputs that attempt to do path traversal.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://docs.rapid7.com/release-notes/insightagent/20230425/; https://docs.rapid7.com/release-notes/insightagent/20230425/