deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2512
Published: 2023-05-12
Description: Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the forEach() method could end up reading from the wrong location in memory while iterating over elements. This would most likely lead to a segmentation fault, but could theoretically allow arbitrary undefined behavior.


In order for the bug to be exploitable, the process would need to be able to allocate 160GB of RAM. Due to this, the bug was never exploitable on the Cloudflare Workers platform, but could theoretically be exploitable on deployments of workerd running on machines with a huge amount of memory. Moreover, in order to be remotely exploited, an attacker would have to upload a single form-encoded HTTP request of at least tens of gigabytes in size. The application code would then have to use request.formData() to parse the request and formData.forEach() to iterate over this data. Due to these limitations, the exploitation likelihood was considered Low.

A fix that addresses this vulnerability has been released in version v1.20230419.0 and users are encouraged to update to the latest version available.



CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-190
References: https://github.com/cloudflare/workerd/releases/tag/v1.20230419.0; https://github.com/cloudflare/workerd/security/advisories/GHSA-8vx6-69vg-c46f; https://github.com/cloudflare/workerd/releases/tag/v1.20230419.0
CVE: CVE-2023-30130
Published: 2023-05-12
Description: An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://craftcms.com/; https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1; https://craftcms.com/
CVE: CVE-2023-30246
Published: 2023-05-12
Description: SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the contestant_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/qingning988/cve_report/blob/main/judging-management-system/SQLi-2.md; https://www.github.com; https://github.com/qingning988/cve_report/blob/main/judging-management-system/SQLi-2.md
CVE: CVE-2023-31985
Published: 2023-05-12
Description: A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the formAccept function in /bin/webs without any limitations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Erebua/CVE/blob/main/N300_BR-6428nS%20V4/3/Readme.md; https://github.com/Erebua/CVE/blob/main/N300_BR-6428nS%20V4/3/Readme.md
CVE: CVE-2023-23444
Published: 2023-05-12
Description: Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an unauthenticated remote attacker to influence the availability of the device by changing the IP settings of the device via broadcasted UDP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.pdf; https://sick.com/psirt
CVE: CVE-2023-2682
Published: 2023-05-12
Description: A vulnerability was found in Caton Live up to 2023-04-26 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/ping.cgi of the component Mini_HTTPD. The manipulation of the argument address with the input ;id;uname${IFS}-a leads to command injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-228911. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://vuldb.com/?ctiid.228911; https://vuldb.com/?id.228911; https://vuldb.com/?ctiid.228911
CVE: CVE-2022-47879
Published: 2023-05-12
Description: A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods. NOTE: The vendor states that the vulnerability affects installations running version 22.5 or earlier. The issue was resolved with version 23.2 and later versions are not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://jedox.com; https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf; https://jedox.mantishub.io/app/issues/57236
CVE: CVE-2022-47880
Published: 2023-05-12
Description: An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleartext password via the 'test connection' function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522, CWE-522
References: http://jedox.com; https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf; http://jedox.com
CVE: CVE-2023-1934
Published: 2023-05-12
Description: The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerability. Present within the hitlogcsv.jsp endpoint, this security flaw permits unauthenticated attackers to engage with the underlying database seamlessly and passively. Consequently, malicious actors could gain access to vital information, such as Industrial Control System (ICS) and OT data, alongside other sensitive records like SMS and SMS Logs. The unauthorized database access exposes compromised systems to potential manipulation or breach of essential infrastructure data, highlighting the severity of this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/172511/PnPSCADA-2.x-SQL-Injection.html; https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-12; http://packetstormsecurity.com/files/172511/PnPSCADA-2.x-SQL-Injection.html
CVE: CVE-2023-27823
Published: 2023-05-12
Description: An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-295
References: http://optoma.com; https://packetstormsecurity.com/files/172276/Optoma-1080PSTX-Firmware-C02-Authentication-Bypass.html; http://optoma.com
CVE: CVE-2023-31913
Published: 2023-05-12
Description: Jerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at jerry-core/parser/js/js-parser-expr.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/5061; https://github.com/jerryscript-project/jerryscript/issues/5061
CVE: CVE-2023-31914
Published: 2023-05-12
Description: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/jerryscript-project/jerryscript/issues/5071; https://github.com/jerryscript-project/jerryscript/issues/5071
CVE: CVE-2023-31916
Published: 2023-05-12
Description: Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem_heap_finalize at jerry-core/jmem/jmem-heap.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/5062; https://github.com/jerryscript-project/jerryscript/issues/5062
CVE: CVE-2023-31918
Published: 2023-05-12
Description: Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser_parse_function_arguments at jerry-core/parser/js/js-parser.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/5064; https://github.com/jerryscript-project/jerryscript/issues/5064
CVE: CVE-2023-31919
Published: 2023-05-12
Description: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext_raise_exception at jerry-core/jcontext/jcontext.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/5069; https://github.com/jerryscript-project/jerryscript/issues/5069
CVE: CVE-2023-31920
Published: 2023-05-12
Description: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/5070; https://github.com/jerryscript-project/jerryscript/issues/5070
CVE: CVE-2023-31921
Published: 2023-05-12
Description: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_big_uint_div_mod at jerry-core/ecma/operations/ecma-big-uint.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/5068; https://github.com/jerryscript-project/jerryscript/issues/5068
CVE: CVE-2023-31922
Published: 2023-05-12
Description: QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/bellard/quickjs/issues/178; https://github.com/bellard/quickjs/issues/178
CVE: CVE-2023-32073
Published: 2023-05-12
Description: WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/WWBN/AVideo/commit/1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3; https://github.com/WWBN/AVideo/security/advisories/GHSA-2mhh-27v7-3vcx; https://github.com/WWBN/AVideo/commit/1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3
CVE: CVE-2023-32081
Published: 2023-05-12
Description: Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted. The issue is patched in Vert.x 3.9.16 and 4.4.2. There are no trivial workarounds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265b; https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-gvrq-cg5r-7chp; https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265b
CVE: CVE-2023-23867
Published: 2023-05-12
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gautam Thapar Button Builder – Buttons X plugin <= 0.8.6 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/buttons-x/wordpress-button-builder-buttons-x-plugin-0-8-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/buttons-x/wordpress-button-builder-buttons-x-plugin-0-8-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29242
Published: 2023-05-12
Description: Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00551.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00551.html
CVE: CVE-2023-30763
Published: 2023-05-12
Description: Heap-based overflow in Intel(R) SoC Watch based software before version 2021.1 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00547.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00547.html
CVE: CVE-2023-30768
Published: 2023-05-12
Description: Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family with the BIOS version 0016 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00056.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00056.html
CVE: CVE-2023-31197
Published: 2023-05-12
Description: Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00475.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00475.html
CVE: CVE-2023-31199
Published: 2023-05-12
Description: Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00074.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00074.html
CVE: CVE-2022-48020
Published: 2023-05-12
Description: Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. This vulnerability allows attackers to inject arbitrary code which will be executed by the victim user's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://seq.team/en/; https://seq.team/en/blog/reflected-cross-site-scripting-xss-in-vinteo-vcc/; https://www.linkedin.com/in/dmitry-kiryukhin-b5741421b/
CVE: CVE-2023-22685
Published: 2023-05-12
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/category-specific-rss-feed-menu/wordpress-category-specific-rss-feed-subscription-plugin-v2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/category-specific-rss-feed-menu/wordpress-category-specific-rss-feed-subscription-plugin-v2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23810
Published: 2023-05-12
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SnapOrbital Panorama plugin <= 1.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/project-panorama-lite/wordpress-panorama-wordpress-project-management-plugin-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/project-panorama-lite/wordpress-panorama-wordpress-project-management-plugin-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25428
Published: 2023-05-12
Description: A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leading to code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://packetstormsecurity.com/files/172259/Soft-o-Free-Password-Manager-1.1.20-DLL-Hijacking.html; https://www.soft-o.com/products/free-password-manager.html; https://packetstormsecurity.com/files/172259/Soft-o-Free-Password-Manager-1.1.20-DLL-Hijacking.html
CVE: CVE-2023-25460
Published: 2023-05-12
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodeSolz Easy Ad Manager plugin <= 1.0.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-ad-manager/wordpress-easy-ad-manager-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-ad-manager/wordpress-easy-ad-manager-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25958
Published: 2023-05-12
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Justin Saad Simple Tooltips plugin <= 2.1.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-tooltips/wordpress-simple-tooltips-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-tooltips/wordpress-simple-tooltips-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28414
Published: 2023-05-12
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ApexChat plugin <= 1.3.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/apexchat/wordpress-apexchat-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/apexchat/wordpress-apexchat-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-31983
Published: 2023-05-12
Description: A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the mp function in /bin/webs without any limitations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Erebua/CVE/blob/main/N300_BR-6428nS%20V4/2/Readme.md; https://github.com/Erebua/CVE/blob/main/N300_BR-6428nS%20V4/2/Readme.md
CVE: CVE-2023-25927
Published: 2023-05-12
Description: IBM Security Verify Access 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, and 10.0.5 could allow an attacker to crash the webseald process using specially crafted HTTP requests resulting in loss of access to the system.  IBM X-Force ID:  247635.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247635; https://https://www.ibm.com/support/pages/node/6989653; https://www.ibm.com/support/pages/node/6989653?_ga=2.22[PII_REDACTED][PII_REDACTED][PII_REDACTED]17[PII_REDACTED]719
CVE: CVE-2023-2457
Published: 2023-05-12
Description: Out of bounds write in ChromeOS Audio Server in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker to potentially exploit heap corruption via crafted audio file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-chromeos.html; https://crbug.com/1420790; https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-chromeos.html
CVE: CVE-2023-2458
Published: 2023-05-12
Description: Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-chromeos.html; https://crbug.com/1430692; https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-chromeos.html
CVE: CVE-2023-27863
Published: 2023-05-12
Description: IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be used to access vSnap data stores.  IBM X-Force ID:  249325.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249325; https://www.ibm.com/support/pages/node/6965812; https://exchange.xforce.ibmcloud.com/vulnerabilities/249325
CVE: CVE-2023-30247
Published: 2023-05-12
Description: File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code via the update_settings parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/qingning988/cve_report/blob/main/storage-unit-rental-management-system/RCE-1.md; https://www.github.com; https://github.com/qingning988/cve_report/blob/main/storage-unit-rental-management-system/RCE-1.md
CVE: CVE-2023-32305
Published: 2023-05-12
Description: aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the aiven-extras extension. A low privileged user can create objects that collide with existing function names, which will then be executed instead. Exploiting this vulnerability could allow a low privileged user to acquire `superuser` privileges, which would allow full, unrestricted access to all data and database functions. And could lead to arbitrary code execution or data access on the underlying host as the `postgres` user. The issue has been patched as of version 1.1.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-1321
References: https://github.com/aiven/aiven-extras/commit/8682ae01bec0791708bf25791786d776e2fb0250; https://github.com/aiven/aiven-extras/security/advisories/GHSA-7r4w-fw4h-67gp; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-32306
Published: 2023-05-12
Description: Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3; https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3
CVE: CVE-2023-1096
Published: 2023-05-12
Description: SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to gain access as an admin user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-20877
Published: 2023-05-12
Description: VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.vmware.com/security/advisories/VMSA-2023-0009.html; https://www.vmware.com/security/advisories/VMSA-2023-0009.html
CVE: CVE-2023-20878
Published: 2023-05-12
Description: VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.vmware.com/security/advisories/VMSA-2023-0009.html; https://www.vmware.com/security/advisories/VMSA-2023-0009.html