deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-34755
Published: 2023-06-14
Description: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability; https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
CVE: CVE-2023-34756
Published: 2023-06-14
Description: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability; https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
CVE: CVE-2023-34823
Published: 2023-06-14
Description: fdkaac before 1.0.5 was discovered to contain a stack overflow in read_callback function in src/main.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/nu774/fdkaac/issues/55; https://github.com/nu774/fdkaac/issues/55
CVE: CVE-2023-34824
Published: 2023-06-14
Description: fdkaac before 1.0.5 was discovered to contain a heap buffer overflow in caf_info function in caf_reader.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/nu774/fdkaac/issues/55; https://github.com/nu774/fdkaac/issues/55
CVE: CVE-2023-34865
Published: 2023-06-14
Description: Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/ujcms/ujcms/issues/5; https://github.com/ujcms/ujcms/issues/5
CVE: CVE-2023-34878
Published: 2023-06-14
Description: An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://github.com/ujcms/ujcms/issues/6; https://github.com/ujcms/ujcms/issues/6
CVE: CVE-2023-35110
Published: 2023-06-14
Description: An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/grobmeier/jjson/issues/2; https://github.com/grobmeier/jjson/issues/2
CVE: CVE-2023-35116
Published: 2023-06-14
Description: jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-770
References: https://github.com/FasterXML/jackson-databind/issues/3972; https://github.com/FasterXML/jackson-databind/issues/3972
CVE: CVE-2023-24895
Published: 2023-06-14
Description: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24895; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24895
CVE: CVE-2023-24897
Published: 2023-06-14
Description: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24897; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24897
CVE: CVE-2023-24936
Published: 2023-06-14
Description: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24936; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24936
CVE: CVE-2023-28310
Published: 2023-06-14
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28310; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28310
CVE: CVE-2023-29326
Published: 2023-06-14
Description: .NET Framework Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29326; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29326
CVE: CVE-2023-29331
Published: 2023-06-14
Description: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29331; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29331
CVE: CVE-2023-29337
Published: 2023-06-14
Description: NuGet Client Remote Code Execution Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29337; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29337
CVE: CVE-2023-32024
Published: 2023-06-14
Description: Microsoft Power Apps Spoofing Vulnerability
CVSS Score: 3.0 (LOW)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32024; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32024
CVE: CVE-2023-32030
Published: 2023-06-14
Description: .NET and Visual Studio Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32030; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32030
CVE: CVE-2023-32031
Published: 2023-06-14
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32031; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32031
CVE: CVE-2023-34101
Published: 2023-06-14
Description: Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_input_storing` function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes can be read out of bounds in the `dao_input_storing` function. An attacker can truncate an ICMP packet so that it does not contain enough data, leading to an out-of-bounds read on these lines. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in release 4.9. As a workaround, one can apply the changes in Contiki-NG pull request #2435 to patch the system.
CVSS Score: 7.3 (HIGH)
CWE: CWE-125
References: https://github.com/contiki-ng/contiki-ng/pull/2435; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-fp66-ff6x-7w2w; https://github.com/contiki-ng/contiki-ng/pull/2435
CVE: CVE-2023-34540
Published: 2023-06-14
Description: Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/hwchase17/langchain/issues/4833; https://github.com/langchain-ai/langchain/pull/6992; https://github.com/langchain-ai/langchain/releases/tag/v0.0.225
CVE: CVE-2023-34867
Published: 2023-06-14
Description: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_property_hashmap_create at jerry-core/ecma/base/ecma-property-hashmap.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/5084; https://github.com/jerryscript-project/jerryscript/issues/5084
CVE: CVE-2023-34868
Published: 2023-06-14
Description: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start at jerry-core/parser/js/js-parser-statm.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/5083; https://github.com/jerryscript-project/jerryscript/issues/5083
CVE: CVE-2022-31640
Published: 2023-06-14
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]944-16/hpsbhf03805; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]944-16/hpsbhf03805
CVE: CVE-2022-31641
Published: 2023-06-14
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]944-16/hpsbhf03805; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]944-16/hpsbhf03805
CVE: CVE-2022-31642
Published: 2023-06-14
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]944-16/hpsbhf03805; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]944-16/hpsbhf03805
CVE: CVE-2023-0009
Published: 2023-06-14
Description: A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated privileges.

CVSS Score: 7.8 (HIGH)
CWE: CWE-807
References: https://security.paloaltonetworks.com/CVE-2023-0009; https://security.paloaltonetworks.com/CVE-2023-0009
CVE: CVE-2023-0010
Published: 2023-06-14
Description: A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/CVE-2023-0010; https://security.paloaltonetworks.com/CVE-2023-0010
CVE: CVE-2023-25367
Published: 2023-06-14
Description: Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution (RCE) with SCPI interface or web server.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25367.md; https://siglent.com; https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25367.md
CVE: CVE-2023-34095
Published: 2023-06-14
Description: cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. In versions 1.0 through 2.0b4, cpdb-libs is vulnerable to buffer overflows via improper use of `scanf(3)`. cpdb-libs uses the `fscanf()` and `scanf()` functions to parse command lines and configuration files, dropping the read string components into fixed-length buffers, but does not limit the length of the strings to be read by `fscanf()` and `scanf()` causing buffer overflows when a string is longer than 1023 characters. A patch for this issue is available at commit f181bd1f14757c2ae0f17cc76dc20421a40f30b7. As all buffers have a length of 1024 characters, the patch limits the maximum string length to be read to 1023 by replacing all occurrences of `%s` with `%1023s` in all calls of the `fscanf()` and `scanf()` functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: http://www.openwall.com/lists/oss-security/2023/06/14/7; https://github.com/OpenPrinting/cpdb-libs/blob/85555fba64d34f53a2fce099b0488904cc48ed35/cpdb/cpdb-frontend.c#L372; https://github.com/OpenPrinting/cpdb-libs/blob/85555fba64d34f53a2fce099b0488904cc48ed35/tools/cpdb-text-frontend.c#L362
CVE: CVE-2022-31644
Published: 2023-06-14
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]458-16/hpsbhf03806; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]458-16/hpsbhf03806
CVE: CVE-2022-31645
Published: 2023-06-14
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. 
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]458-16/hpsbhf03806; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]458-16/hpsbhf03806
CVE: CVE-2022-31646
Published: 2023-06-14
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]458-16/hpsbhf03806; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]458-16/hpsbhf03806
CVE: CVE-2023-2976
Published: 2023-06-14
Description: Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://github.com/google/guava/issues/2575; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01006.html
CVE: CVE-2023-31671
Published: 2023-06-14
Description: PrestaShop postfinance <= 17.1.13 is vulnerable to SQL Injection via PostfinanceValidationModuleFrontController::postProcess().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://friends-of-presta.github.io/security-advisories/modules/2023/06/13/postfinance.html; https://shop.webbax.ch/modules-de-paiement/123-module-postfinance.html; https://friends-of-presta.github.io/security-advisories/modules/2023/06/13/postfinance.html
CVE: CVE-2022-4284
Published: 2023-06-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-25368
Published: 2023-06-14
Description: Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Incorrect Access Control. An unauthenticated attacker can overwrite firmnware.
CVSS Score: 7.5 (HIGH)
References: https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25368.md; https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25368.md
CVE: CVE-2023-25369
Published: 2023-06-14
Description: Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Denial of Service on the user interface triggered by malformed SCPI command.
CVSS Score: 7.5 (HIGH)
References: https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25369.md; https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25369.md
CVE: CVE-2023-25434
Published: 2023-06-14
Description: libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://gitlab.com/libtiff/libtiff/-/issues/519; https://gitlab.com/libtiff/libtiff/-/issues/519
CVE: CVE-2023-26062
Published: 2023-06-14
Description: A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user can execute administrative functions. Exploitation is not possible from outside of mobile network solution architecture. This means that exploit is not possible from mobile network user UEs, from roaming networks, or from the Internet. Exploitation is possible only from a CSP (Communication Service Provider) mobile network solution internal BTS management network.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: https://nokia.com; https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-26062/; https://nokia.com
CVE: CVE-2023-30082
Published: 2023-06-14
Description: A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284, CWE-1284
References: https://blog.manavparekh.com/2023/06/cve-2023-30082.html; https://github.com/manavparekh/CVEs/blob/main/CVE-2023-30082/Steps%20to%20reproduce.txt; https://blog.manavparekh.com/2023/06/cve-2023-30082.html
CVE: CVE-2023-34367
Published: 2023-06-14
Description: Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation of TCP/IP, which is vulnerable to the Idle scan attack (including many IoT devices). NOTE: The vendor considers this a low severity issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://blog.pi3.com.pl/?p=850; https://portswigger.net/daily-swig/blind-tcp-ip-hijacking-is-resurrected-for-windows-7; https://pwnies.com/windows-7-blind-tcp-ip-hijacking/
CVE: CVE-2023-1329
Published: 2023-06-14
Description: A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Buffer Overflow and/or Remote Code Execution when running HP Workpath solutions on potentially affected products.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://support.hp.com/us-en/document/ish_8[PII_REDACTED]769-16/hpsbpi03849; https://support.hp.com/us-en/document/ish_8[PII_REDACTED]769-16/hpsbpi03849
CVE: CVE-2023-26965
Published: 2023-06-14
Description: loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/libtiff/libtiff/-/merge_requests/472; https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-30150
Published: 2023-06-14
Description: PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://friends-of-presta.github.io/security-advisories/module/2023/06/06/leocustomajax.html; https://friends-of-presta.github.io/security-advisories/module/2023/06/06/leocustomajax.html
CVE: CVE-2023-31746
Published: 2023-06-14
Description: There is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. An unauthenticated attacker can exploit the vulnerability to execute system commands as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/D2y6p/CVE/blob/main/adslr/CVE-2023-31746/1/VW2100_RCE1.pdf; https://github.com/D2y6p/CVE/blob/main/adslr/CVE-2023-31746/2/VW2100_RCE2.pdf; https://github.com/D2y6p/CVE/blob/main/adslr/CVE-2023-31746/3/VW2100_RCE3.pdf
CVE: CVE-2023-33515
Published: 2023-06-14
Description: SoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/%40williamamorim256/stored-xss-found-in-se-suite-version-2-1-9-understanding-and-addressing-the-issue-cve-2023-33515-d59990eac324; https://medium.com/%40williamamorim256/stored-xss-found-in-se-suite-version-2-1-9-understanding-and-addressing-the-issue-cve-2023-33515-d59990eac324
CVE: CVE-2023-34449
Published: 2023-06-14
Description: ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through `CallBuilder::delegate` or `ink_env::invoke_contract_delegate`, is decoded incorrectly. This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of pull request 1450. Since this feature was only released in ink! 4.0.0, no previous versions are affected. Users who have an ink! 4.x series contract should upgrade to 4.2.1 to receive a patch.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-253, CWE-754
References: https://docs.rs/ink_env/4.2.0/ink_env/call/struct.CallBuilder.html#method.delegate; https://docs.rs/ink_env/4.2.0/ink_env/fn.invoke_contract_delegate.html; https://github.com/paritytech/ink/commit/f1407ee9f87e5f64d467a22d26ee88f61db7f3db
CVE: CVE-2023-34565
Published: 2023-06-14
Description: Netbox 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the "Create Wireless LAN Groups" function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/grayfullbuster0804/netbox/issues/1; https://github.com/grayfullbuster0804/netbox/issues/1
CVE: CVE-2023-2819
Published: 2023-06-14
Description: A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (PTR/TRAP) could allow an authenticated administrator on an adjacent network to replace the image file with an arbitrary MIME type.  This could result in arbitrary javascript code execution in an admin context. All versions prior to 5.10.0 are affected.  
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0002; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0002
CVE: CVE-2023-2820
Published: 2023-06-14
Description: An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be used by an attacker on an adjacent network to obtain credentials to integrated services via a man-in-the-middle position or cryptanalysis of the session traffic. An attacker could use these credentials to impersonate PTR/TRAP to these services. All versions prior to 5.10.0 are affected. 

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0003; https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0003
CVE: CVE-2023-34251
Published: 2023-06-14
Description: Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://github.com/getgrav/grav/blob/develop/system/src/Grav/Common/Twig/Extension/GravExtension.php#L174; https://github.com/getgrav/grav/commit/9d01140a63c77075ef09b26ef57cf186138151a5; https://github.com/getgrav/grav/security/advisories/GHSA-f9jf-4cp4-4fq5