deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3462
Published: 2023-07-31
Description: HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714; https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714
CVE: CVE-2023-3825
Published: 2023-07-31
Description: 
PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a check to see if such an object is recursively defined, so an attack could send a maliciously created message that the decoder would try to decode until the stack overflowed and the device crashed.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-02
CVE: CVE-2023-37496
Published: 2023-08-01
Description: HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability.  An attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.

CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105904; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105904
CVE: CVE-2023-37772
Published: 2023-08-01
Description: Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://phpgurukul.com/shopping-portal-free-download/; https://github.com/anky-123/CVE-2023-37772/blob/main/CVE-2; https://phpgurukul.com/
CVE: CVE-2023-4033
Published: 2023-08-01
Description: OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/mlflow/mlflow/commit/6dde93758d42455cb90ef324407919ed67668b9b; https://huntr.dev/bounties/5312d6f8-67a5-4607-bd47-5e19966fa321; https://github.com/mlflow/mlflow/commit/6dde93758d42455cb90ef324407919ed67668b9b
CVE: CVE-2020-10962
Published: 2023-08-01
Description: In PowerShell App Deployment Toolkit (aka PSAppDeployToolkit) through 3.8.0, an incorrect access control vulnerability in the default configuration may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: https://discourse.psappdeploytoolkit.com/t/psappdeploytoolkit-3-8-2/2555; https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/releases; https://discourse.psappdeploytoolkit.com/t/psappdeploytoolkit-3-8-2/2555
CVE: CVE-2023-34960
Published: 2023-08-01
Description: A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://chamilo.com; http://packetstormsecurity.com/files/174314/Chamilo-1.11.18-Command-Injection.html; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-112-2023-04-20-Critical-impact-High-risk-Remote-Code-Execution
CVE: CVE-2023-36983
Published: 2023-08-01
Description: LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
CVSS Score: 7.5 (HIGH)
References: https://github.com/LavaLite/cms; https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-36983; https://github.com/LavaLite/cms
CVE: CVE-2023-36984
Published: 2023-08-01
Description: LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
CVSS Score: 7.5 (HIGH)
References: https://github.com/LavaLite/cms; https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-36984; https://github.com/LavaLite/cms
CVE: CVE-2023-26139
Published: 2023-08-01
Description: Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “__proto__”.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://gist.github.com/lelecolacola123/cc0d1e73780127aea9482c05f2ff3252; https://security.snyk.io/vuln/SNYK-JS-UNDERSCOREKEYPATH-5416714; https://gist.github.com/lelecolacola123/cc0d1e73780127aea9482c05f2ff3252
CVE: CVE-2023-23548
Published: 2023-08-01
Description: Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://checkmk.com/werk/15691; https://checkmk.com/werk/15691
CVE: CVE-2023-32302
Published: 2023-08-01
Description: Rejected reason: Authoritative user requested CVE rejection
https://github.com/github/advisory-database/pull/2575#issuecomment[PII_REDACTED]
CVE: CVE-2023-37478
Published: 2023-08-01
Description: pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/pnpm/pnpm/releases/tag/v7.33.4; https://github.com/pnpm/pnpm/releases/tag/v8.6.8; https://github.com/pnpm/pnpm/security/advisories/GHSA-5r98-f33j-g8h7
CVE: CVE-2022-39986
Published: 2023-08-01
Description: A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://packetstormsecurity.com/files/174190/RaspAP-2.8.7-Unauthenticated-Command-Injection.html; https://github.com/RaspAP/raspap-webgui/blob/master/ajax/openvpn/activate_ovpncfg.php; https://medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2
CVE: CVE-2022-39987
Published: 2023-08-01
Description: A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/RaspAP/raspap-webgui/blob/master/ajax/networking/get_wgkey.php; https://medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2; https://github.com/RaspAP/raspap-webgui/blob/master/ajax/networking/get_wgkey.php
CVE: CVE-2023-31710
Published: 2023-08-01
Description: TP-Link Archer AX21(US)_V3_1.1.4 Build 20230219 and AX21(US)_V3.6_1.1.4 Build 20230219 are vulnerable to Buffer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/xiaobye-ctf/My-CVE/tree/main/TP-Link/CVE-2023-31710; https://github.com/xiaobye-ctf/My-CVE/tree/main/TP-Link/CVE-2023-31710
CVE: CVE-2023-34634
Published: 2023-08-01
Description: Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/173825/GreenShot-1.2.10-Arbitrary-Code-Execution.html; http://packetstormsecurity.com/files/174222/Greenshot-1.3.274-Deserialization-Command-Execution.html; https://github.com/greenshot/greenshot/commit/a152e2883fca7f78051b3bd6b1e5cc57355cb44c
CVE: CVE-2023-39108
Published: 2023-08-01
Description: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_path_b.md; https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_path_b.md
CVE: CVE-2023-39109
Published: 2023-08-01
Description: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_path_a.md; https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_path_a.md
CVE: CVE-2023-39110
Published: 2023-08-01
Description: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_%20ajaxGetFileByPath.md; https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_%20ajaxGetFileByPath.md
CVE: CVE-2023-38357
Published: 2023-08-01
Description: Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-331
References: http://packetstormsecurity.com/files/173609/RWS-WorldServer-11.7.3-Session-Token-Enumeration.html; http://seclists.org/fulldisclosure/2023/Jul/30; https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-001/-session-token-enumeration-in-rws-worldserver
CVE: CVE-2023-4045
Published: 2023-08-01
Description: Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1833876; https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html; https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE: CVE-2023-4046
Published: 2023-08-01
Description: In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1837686; https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html; https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE: CVE-2023-4047
Published: 2023-08-01
Description: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1839073; https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html; https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE: CVE-2023-4048
Published: 2023-08-01
Description: An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1841368; https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html; https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE: CVE-2023-4049
Published: 2023-08-01
Description: Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1842658; https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html; https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE: CVE-2023-4050
Published: 2023-08-01
Description: In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1843038; https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html; https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE: CVE-2023-4051
Published: 2023-08-01
Description: A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.
CVSS Score: 7.5 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1821884; https://www.mozilla.org/security/advisories/mfsa2023-29/; https://www.mozilla.org/security/advisories/mfsa2023-36/
CVE: CVE-2023-4052
Published: 2023-08-01
Description: The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user. 
*This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1824420; https://www.mozilla.org/security/advisories/mfsa2023-29/; https://www.mozilla.org/security/advisories/mfsa2023-31/
CVE: CVE-2023-4053
Published: 2023-08-01
Description: A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1839079; https://www.mozilla.org/security/advisories/mfsa2023-29/; https://www.mozilla.org/security/advisories/mfsa2023-36/
CVE: CVE-2023-4054
Published: 2023-08-01
Description: When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. 
*This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1.
CVSS Score: 5.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1840777; https://www.mozilla.org/security/advisories/mfsa2023-29/; https://www.mozilla.org/security/advisories/mfsa2023-30/
CVE: CVE-2023-4055
Published: 2023-08-01
Description: When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1782561; https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html; https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE: CVE-2023-4056
Published: 2023-08-01
Description: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1820587%2C1824634%2C1839235%2C1842325%2C1843847; https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html; https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE: CVE-2023-4057
Published: 2023-08-01
Description: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1841682; https://www.mozilla.org/security/advisories/mfsa2023-29/; https://www.mozilla.org/security/advisories/mfsa2023-31/
CVE: CVE-2023-4058
Published: 2023-08-01
Description: Memory safety bugs present in Firefox 115. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1819160%2C1828024; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-29/
CVE: CVE-2023-33493
Published: 2023-08-01
Description: An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmanager) module for PrestaShop through 2.3.0, allows remote attackers to upload dangerous files without restrictions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://security.friendsofpresta.org/module/2023/07/28/ajaxmanager.html; https://security.friendsofpresta.org/module/2023/07/28/ajaxmanager.html
CVE: CVE-2023-36210
Published: 2023-08-01
Description: MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keyword parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://vulners.com/zdt/1337DAY-ID-38750; https://www.exploit-db.com/exploits/51499; https://vulners.com/zdt/1337DAY-ID-38750
CVE: CVE-2023-36211
Published: 2023-08-01
Description: The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/51502; https://www.exploit-db.com/exploits/51502
CVE: CVE-2023-38559
Published: 2023-08-01
Description: A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-120
References: https://access.redhat.com/errata/RHSA-2023:6544; https://access.redhat.com/errata/RHSA-2023:7053; https://access.redhat.com/security/cve/CVE-2023-38559
CVE: CVE-2023-38560
Published: 2023-08-01
Description: An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://access.redhat.com/security/cve/CVE-2023-38560; https://bugs.ghostscript.com/show_bug.cgi?id=706898; https://bugzilla.redhat.com/show_bug.cgi?id=2224368
CVE: CVE-2023-34551
Published: 2023-08-01
Description: In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware versions before V5.3.2 build 230221 and CS-C6N-A0-1C2WFR-MUL Firmware versions before V5.3.2 build 230218 and CS-CV310-A0-3C2WFRL-1080p Firmware versions before V5.2.7 build 230302 and CS-CV310-A0-1C2WFR Wifi IP66 2.8mm 1080p Firmware versions before V5.3.2 build 230214 and CS-CV248-A0-32WMFR Firmware versions before V5.2.3 build 230217 and EZVIZ LC1C Firmware versions before V5.3.4 build 230214. The impact is: execute arbitrary code (remote).
CVSS Score: 8.0 (HIGH)
CWE: CWE-787
References: http://ezviz.com; https://www.ezviz.com/data-security/security-notice/detail/827; http://ezviz.com
CVE: CVE-2023-34552
Published: 2023-08-01
Description: In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_pack_type functions of the SADP multicast protocol can allow an unauthenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware versions before V5.3.2 build 230221 and CS-C6N-A0-1C2WFR-MUL Firmware versions before V5.3.2 build 230218 and CS-CV310-A0-3C2WFRL-1080p Firmware versions before V5.2.7 build 230302 and CS-CV310-A0-1C2WFR Wifi IP66 2.8mm 1080p Firmware versions before V5.3.2 build 230214 and CS-CV248-A0-32WMFR Firmware versions before V5.2.3 build 230217 and EZVIZ LC1C Firmware versions before V5.3.4 build 230214.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-121
References: http://ezviz.com; https://www.ezviz.com/data-security/security-notice/detail/827; http://ezviz.com
CVE: CVE-2023-39147
Published: 2023-08-01
Description: An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/173878/Uvdesk-1.1.3-Shell-Upload.html; https://docs.google.com/document/d/1uv9DjHmKuDxZIjNhWX05EsxHEp8fGalXB7XK-QSyr_0/edit?usp=sharing; http://packetstormsecurity.com/files/173878/Uvdesk-1.1.3-Shell-Upload.html
CVE: CVE-2023-20583
Published: 2023-08-01
Description: A potential power side-channel vulnerability in
AMD processors may allow an authenticated attacker to monitor the CPU power
consumption as the data in a cache line changes over time potentially resulting
in a leak of sensitive information.














CVSS Score: 4.7 (MEDIUM)
CWE: CWE-203
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7006; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7006
CVE: CVE-2023-3718
Published: 2023-08-01
Description: 
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands on the underlying operating system as a privileged user on the affected switch. This allows an attacker to fully compromise the underlying operating system on the device running AOS-CX.




CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-010.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-010.txt