deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1192
Published: 2023-11-01
Description: A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/CVE-2023-1192; https://bugzilla.redhat.com/show_bug.cgi?id=2154178; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d527f51331cace562393a8038d870b3e9916686f
CVE: CVE-2023-1193
Published: 2023-11-01
Description: A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/CVE-2023-1193; https://bugzilla.redhat.com/show_bug.cgi?id=2154177; https://lkml.kernel.org/linux-cifs/[PII_REDACTED]4951.6085-2-linkinjeon@kernel.org/T/
CVE: CVE-2023-3397
Published: 2023-11-01
Description: A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel information.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-362
References: https://access.redhat.com/security/cve/CVE-2023-3397; https://bugzilla.redhat.com/show_bug.cgi?id=2217271; https://www.spinics.net/lists/kernel/msg4788636.html
CVE: CVE-2023-46724
Published: 2023-11-01
Description: Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.
CVSS Score: 8.6 (HIGH)
CWE: CWE-125, CWE-129, CWE-786, CWE-823, CWE-1285
References: http://www.squid-cache.org/Versions/v5/SQUID-2023_4.patch; http://www.squid-cache.org/Versions/v6/SQUID-2023_4.patch; https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810
CVE: CVE-2023-46428
Published: 2023-11-01
Description: An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/fenglon/CVE/blob/main/analyse.md; https://github.com/fenglon/CVE/blob/main/analyse.md
CVE: CVE-2023-39281
Published: 2023-11-01
Description: A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2023054; https://www.insyde.com/security-pledge
CVE: CVE-2023-44025
Published: 2023-11-01
Description: SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrulebyid function in the AddifyfreegiftsModel.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/31/addifyfreegifts.html; https://security.friendsofpresta.org/modules/2023/10/31/addifyfreegifts.html
CVE: CVE-2023-45201
Published: 2023-11-01
Description: Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the admin.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://fluidattacks.com/advisories/uchida; https://projectworlds.in/; https://fluidattacks.com/advisories/uchida
CVE: CVE-2023-46448
Published: 2023-11-01
Description: Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.0xzon.dev/2023-10-15-Mejiro-Reflected-XSS-Via-Remote-File-Inclusion-CVE-2023-46448/; https://github.com/dmpop/mejiro/commit/309639339f[PII_REDACTED]902befe8c90cb6862537; https://blog.0xzon.dev/2023-10-15-Mejiro-Reflected-XSS-Via-Remote-File-Inclusion-CVE-2023-46448/
CVE: CVE-2023-44954
Published: 2023-11-01
Description: Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings functions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Ciber-Mike/BigTree_CMS-Stored_XSS-Developer_Settings/blob/main/README.md; https://www.bigtreecms.org/download/core/; https://github.com/Ciber-Mike/BigTree_CMS-Stored_XSS-Developer_Settings/blob/main/README.md
CVE: CVE-2023-45202
Published: 2023-11-01
Description: Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://fluidattacks.com/advisories/uchida; https://projectworlds.in/; https://fluidattacks.com/advisories/uchida
CVE: CVE-2023-45203
Published: 2023-11-01
Description: Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the login.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://fluidattacks.com/advisories/uchida; https://projectworlds.in/; https://fluidattacks.com/advisories/uchida
CVE: CVE-2023-5910
Published: 2023-11-02
Description: A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component Web Config. The manipulation of the argument Site Title with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-244229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://github.com/hujiahua1997/popojicms2.0.1-Storage-xss-exists/blob/main/image[PII_REDACTED]3[PII_REDACTED][PII_REDACTED].png; https://github.com/hujiahua1997/popojicms2.0.1-Storage-xss-exists/blob/main/popojicms2.0.1-Storage-xss-exists.md; https://vuldb.com/?ctiid.244229
CVE: CVE-2023-45111
Published: 2023-11-02
Description: Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/pires; https://projectworlds.in/; https://fluidattacks.com/advisories/pires
CVE: CVE-2023-45112
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45113
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45114
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45012
Published: 2023-11-02
Description: Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'user_email' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/oconnor; https://projectworlds.in/; https://fluidattacks.com/advisories/oconnor
CVE: CVE-2023-45013
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45014
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45015
Published: 2023-11-02
Description: Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'date' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/oconnor; https://projectworlds.in/; https://fluidattacks.com/advisories/oconnor
CVE: CVE-2023-45016
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45017
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45018
Published: 2023-11-02
Description: Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the includes/login.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/oconnor; https://projectworlds.in/; https://fluidattacks.com/advisories/oconnor
CVE: CVE-2023-45019
Published: 2023-11-02
Description: Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/oconnor; https://projectworlds.in/; https://fluidattacks.com/advisories/oconnor
CVE: CVE-2023-46327
Published: 2023-11-02
Description: Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: https://jvn.jp/en/vu/JVNVU96482726/index.html; https://security.business.xerox.com/en-us/documents/bulletins/; https://www.fujifilm.com/fbglobal/eng/company/news/notice/2023/1031_addressbook_announce.html
CVE: CVE-2023-5408
Published: 2023-11-02
Description: A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://access.redhat.com/errata/RHSA-2023:5006; https://access.redhat.com/errata/RHSA-2023:6130; https://access.redhat.com/errata/RHSA-2023:6842
CVE: CVE-2023-46695
Published: 2023-11-02
Description: An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://docs.djangoproject.com/en/4.2/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-47204
Published: 2023-11-02
Description: Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/toumorokoshi/transmute-core/pull/58; https://github.com/toumorokoshi/transmute-core/releases/tag/v1.13.5; https://github.com/toumorokoshi/transmute-core/pull/58
CVE: CVE-2023-46595
Published: 2023-11-02
Description: Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 (b570 or above),  A32.50 (b390 or above)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cwe.mitre.org/data/definitions/79.html; https://cwe.mitre.org/data/definitions/79.html
CVE: CVE-2023-5606
Published: 2023-11-02
Description: The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. NOTE: This vulnerability is a re-introduction of CVE-2023-4253.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2987335%40chatbot%2Ftrunk&old=2986133%40chatbot%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/fc305c48-8337-42b7-ad61-61aea8018def?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2987335%40chatbot%2Ftrunk&old=2986133%40chatbot%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-5875
Published: 2023-11-02
Description: Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious mattermost server
CVSS Score: 3.7 (LOW)
CWE: CWE-693
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5876
Published: 2023-11-02
Description: Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service.


CVSS Score: 3.1 (LOW)
CWE: CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5920
Published: 2023-11-02
Description: Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input.


CVSS Score: 2.9 (LOW)
CWE: CWE-200
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-43076
Published: 2023-11-02
Description: 
Dell PowerScale OneFS 8.2.x,9.0.0.x-9.5.0.x contains a denial-of-service vulnerability. A low privilege remote attacker could potentially exploit this vulnerability to cause an out of memory (OOM) condition.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://www.dell.com/support/kbdoc/en-us/000218934/powerscale-onefs-security-updates-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218934/powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
CVE: CVE-2023-43087
Published: 2023-11-02
Description: 
Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exploit this vulnerability to cause information disclosure.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-280, CWE-755
References: https://www.dell.com/support/kbdoc/en-us/000218934/powerscale-onefs-security-updates-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218934/powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
CVE: CVE-2023-5916
Published: 2023-11-02
Description: A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-244305 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/Lissy93/dashy/issues/1336; https://treasure-blarney-085.notion.site/Dashy-0dca8a0ebbd84f78ae6d03528ff1538c?pvs=4; https://vuldb.com/?ctiid.244305
CVE: CVE-2023-5917
Published: 2023-11-02
Description: A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/phpbb/phpbb/commit/ccf6e6c255d38692d72fcb613b113e6eaa240aac; https://github.com/phpbb/phpbb/releases/tag/release-3.3.11; https://vuldb.com/?ctiid.244307
CVE: CVE-2023-3164
Published: 2023-11-02
Description: A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://access.redhat.com/security/cve/CVE-2023-3164; https://bugzilla.redhat.com/show_bug.cgi?id=2213531; https://gitlab.com/libtiff/libtiff/-/issues/542
CVE: CVE-2023-43193
Published: 2023-11-02
Description: Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). An attacker can create a malicious link in the forum that leads to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fuchai.net/cve/CVE-2023-43193; https://github.com/Submitty/Submitty/pull/8032; https://fuchai.net/cve/CVE-2023-43193
CVE: CVE-2023-43336
Published: 2023-11-02
Description: Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://freepbx.com; http://sangoma.com; https://medium.com/%40janirudransh/security-disclosure-of-vulnerability-cve-2023-23336-4429d416f826
CVE: CVE-2023-5860
Published: 2023-11-02
Description: The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/changeset/2987296/icons-font-loader; https://www.wordfence.com/threat-intel/vulnerabilities/id/12a9fbe8-445a-478a-b6ce-cd669ccb6a2d?source=cve; https://plugins.trac.wordpress.org/changeset/2987296/icons-font-loader
CVE: CVE-2023-5918
Published: 2023-11-02
Description: A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-244308.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Castle1984/CveRecord/blob/main/Sql_apply.md; https://vuldb.com/?ctiid.244308; https://vuldb.com/?id.244308
CVE: CVE-2023-46475
Published: 2023-11-02
Description: A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/easysoft/zentaopms; https://github.com/elementalSec/CVE-Disclosures/blob/main/ZentaoPMS/CVE-2023-46475/CVE-2023-46475%20-%20Cross-Site%20Scripting%20%28Stored%29.md; https://github.com/easysoft/zentaopms
CVE: CVE-2023-26452
Published: 2023-11-02
Description: Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.


CVSS Score: 7.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE: CVE-2023-26453
Published: 2023-11-02
Description: Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.


CVSS Score: 7.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json