deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-45353
Published: 2023-10-09
Description: Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating system by leveraging the Common Management Portal web interface for Authenticated remote upload and creation of arbitrary files affecting the underlying operating system. This is also known as OCMP-6591.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://networks.unify.com/security/advisories/OBSO-2306-02.pdf; https://www.news.de/technik/857003738/unify-openscape-common-management-platform-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-update-zu-bekannten-schwachstellen-und-sicherheitsluecken-vom-03-07-2023/1/; https://networks.unify.com/security/advisories/OBSO-2306-02.pdf
CVE: CVE-2023-45354
Published: 2023-10-09
Description: Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated remote attacker to execute arbitrary code on the operating system by using the Common Management Portal web interface. This is also known as OCMP-6589.
CVSS Score: 8.8 (HIGH)
References: https://networks.unify.com/security/advisories/OBSO-2306-02.pdf; https://www.news.de/technik/857003738/unify-openscape-common-management-platform-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-update-zu-bekannten-schwachstellen-und-sicherheitsluecken-vom-03-07-2023/1/; https://networks.unify.com/security/advisories/OBSO-2306-02.pdf
CVE: CVE-2023-45355
Published: 2023-10-09
Description: Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an authenticated attacker into the platform operating system, leading to administrative access via the webservice. This is also known as OSFOURK-24120.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://networks.unify.com/security/advisories/OBSO-2308-02.pdf; https://www.news.de/technik/857079218/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-betroffene-systeme-und-produkte-neue-versionen-und-updates/1/; https://networks.unify.com/security/advisories/OBSO-2308-02.pdf
CVE: CVE-2023-45356
Published: 2023-10-09
Description: Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an authenticated attacker into the platform operating system, leading to administrative access, via dtb pages of the platform portal. This is also known as OSFOURK-23719.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://networks.unify.com/security/advisories/OBSO-2308-02.pdf; https://www.news.de/technik/857079218/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-betroffene-systeme-und-produkte-neue-versionen-und-updates/1/; https://networks.unify.com/security/advisories/OBSO-2308-02.pdf
CVE: CVE-2023-45363
Published: 2023-10-09
Description: An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html; https://phabricator.wikimedia.org/T333050; https://www.debian.org/security/2023/dsa-5520
CVE: CVE-2023-45364
Published: 2023-10-09
Description: An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestamp, both of which are not supposed to be public information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://phabricator.wikimedia.org/T264765; https://www.debian.org/security/2023/dsa-5520; https://phabricator.wikimedia.org/T264765
CVE: CVE-2023-45367
Published: 2023-10-09
Description: An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. A user can use a rest.php/checkuser/v0/useragent-clienthints/revision/ URL to store an arbitrary number of rows in cu_useragent_clienthints, leading to a denial of service.
CVSS Score: 6.5 (MEDIUM)
References: https://phabricator.wikimedia.org/T344923; https://phabricator.wikimedia.org/T344923
CVE: CVE-2023-45369
Published: 2023-10-09
Description: An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of hidden users are exposed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PageTriage/+/960676; https://phabricator.wikimedia.org/T344359; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PageTriage/+/960676
CVE: CVE-2023-45370
Published: 2023-10-09
Description: An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams: Special:SportsManagerLogo and Special:SportsTeamsManagerLogo do not check for the sportsteamsmanager user right, and thus an attacker may be able to affect pages that are concerned with sports teams.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SportsTeams/+/959699/; https://phabricator.wikimedia.org/T345680; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SportsTeams/+/959699/
CVE: CVE-2023-45371
Published: 2023-10-09
Description: An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264; https://phabricator.wikimedia.org/T345064; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264
CVE: CVE-2023-45372
Published: 2023-10-09
Description: An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-693
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264; https://phabricator.wikimedia.org/T345064; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264
CVE: CVE-2023-45373
Published: 2023-10-09
Description: An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. XSS can occur via formatNumNoSeparators.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ProofreadPage/+/961262; https://phabricator.wikimedia.org/T345693; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ProofreadPage/+/961262
CVE: CVE-2023-45374
Published: 2023-10-09
Description: An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not check for the anti-CSRF edit token in Special:SportsTeamsManager and Special:UpdateFavoriteTeams.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SportsTeams/+/952552/; https://phabricator.wikimedia.org/T345040; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SportsTeams/+/952552/
CVE: CVE-2023-39854
Published: 2023-10-09
Description: The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or user account) to include files via a URL in the /hydra/view/get_cc_url url parameter. There can be resultant SSRF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://wiki.notveg.ninja/blog/CVE-2023-39854/; https://wiki.notveg.ninja/blog/CVE-2023-39854/
CVE: CVE-2023-3589
Published: 2023-10-09
Description: A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2023-44231
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in NickDuncan Contact Form plugin <= 2.0.10 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/contact-form-ready/wordpress-contact-form-plugin-2-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-ready/wordpress-contact-form-plugin-2-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44232
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Hide Pages plugin <= 1.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-hide-pages/wordpress-wp-hide-pages-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-hide-pages/wordpress-wp-hide-pages-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44260
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mikk Mihkel Nurges, Rebing OÜ Woocommerce ESTO plugin <= 2.23.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-esto/wordpress-woocommerce-esto-plugin-2-23-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-esto/wordpress-woocommerce-esto-plugin-2-23-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44236
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Devnath verma WP Captcha plugin <= 2.0.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-captcha/wordpress-wp-captcha-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-captcha/wordpress-wp-captcha-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44237
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Moriyan Jay WP Site Protector plugin <= 2.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-site-protector/wordpress-wp-site-protector-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-site-protector/wordpress-wp-site-protector-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44238
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Joakim Ling Remove slug from custom post type plugin <= 1.0.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/remove-slug-from-custom-post-type/wordpress-remove-slug-from-custom-post-type-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/remove-slug-from-custom-post-type/wordpress-remove-slug-from-custom-post-type-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44246
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Matias s Shockingly Simple Favicon plugin <= 1.8.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/shockingly-simple-favicon/wordpress-shockingly-simple-favicon-plugin-1-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shockingly-simple-favicon/wordpress-shockingly-simple-favicon-plugin-1-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44240
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Peter Butler Timthumb Vulnerability Scanner plugin <= 1.54 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/timthumb-vulnerability-scanner/wordpress-timthumb-vulnerability-scanner-plugin-1-54-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/timthumb-vulnerability-scanner/wordpress-timthumb-vulnerability-scanner-plugin-1-54-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44473
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Tran Table of Contents Plus plugin <= 2302 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/table-of-contents-plus/wordpress-table-of-contents-plus-plugin-2302-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/table-of-contents-plus/wordpress-table-of-contents-plus-plugin-2302-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44993
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.7.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/chatbot/wordpress-ai-chatbot-plugin-4-7-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chatbot/wordpress-ai-chatbot-plugin-4-7-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45612
Published: 2023-10-09
Description: In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE
CVSS Score: 8.6 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-45613
Published: 2023-10-09
Description: In JetBrains Ktor before 2.3.5 server certificates were not verified
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-5330
Published: 2023-10-09
Description: Mattermost fails to enforce a limit for the size of the cache entry for  OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4/opengraph filling the cache and turning the server unavailable.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5331
Published: 2023-10-09
Description: Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5333
Published: 2023-10-09
Description: Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specially crafted request to /api/v4/users/ids with multiple identical IDs. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-43696
Published: 2023-10-09
Description: 
Improper Access Control in SICK APU allows an unprivileged remote attacker to
download as well as upload arbitrary files via anonymous access to the FTP server.


CVSS Score: 8.2 (HIGH)
CWE: CWE-284, CWE-434
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf; https://sick.com/psirt
CVE: CVE-2023-43699
Published: 2023-10-09
Description: 
Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU
allows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts
are not limited.


CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-307
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf; https://sick.com/psirt
CVE: CVE-2023-43700
Published: 2023-10-09
Description: Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication.


CVSS Score: 7.7 (HIGH)
CWE: CWE-862, CWE-862
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf; https://sick.com/psirt
CVE: CVE-2023-45247
Published: 2023-10-09
Description: Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36497, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://security-advisory.acronis.com/advisories/SEC-6600; https://security-advisory.acronis.com/advisories/SEC-6600
CVE: CVE-2023-45248
Published: 2023-10-09
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36497, Acronis Cyber Protect 16 (Windows) before build 37391.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-6052; https://security-advisory.acronis.com/advisories/SEC-6052
CVE: CVE-2023-43697
Published: 2023-10-09
Description: 
Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an
unprivileged remote attacker to make the site unable to load necessary strings via changing file paths
using HTTP requests.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-471
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf; https://sick.com/psirt
CVE: CVE-2023-43698
Published: 2023-10-09
Description: 
Improper Neutralization of Input During Web Page Generation (’Cross-site Scripting’) in RDT400 in SICK APU allows an unprivileged remote attacker to run arbitrary code in the clients
browser via injecting code into the website.



CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf; https://sick.com/psirt
CVE: CVE-2023-5100
Published: 2023-10-09
Description: 
Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an
unprivileged remote attacker to retrieve potentially sensitive information via intercepting network traffic
that is not encrypted.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf; https://sick.com/psirt
CVE: CVE-2023-5101
Published: 2023-10-09
Description: 
Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an
unprivileged remote attacker to download various files from the server via HTTP requests.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf; https://sick.com/psirt
CVE: CVE-2023-5102
Published: 2023-10-09
Description: 
Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests.



CVSS Score: 5.3 (MEDIUM)
CWE: CWE-691
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf; https://sick.com/psirt
CVE: CVE-2023-5103
Published: 2023-10-09
Description: Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sensitive information via tricking a user into
clicking on an actionable item using an iframe.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf; https://sick.com/psirt
CVE: CVE-2022-35950
Published: 2023-10-09
Description: OroCommerce is an open-source Business to Business Commerce application. In versions 4.1.0 through 4.1.13, 4.2.0 through 4.2.10, 5.0.0 prior to 5.0.11, and 5.1.0 prior to 5.1.1, the JS payload added to the product name may be executed at the storefront when adding a note to the shopping list line item containing a vulnerable product. An attacker should be able to edit a product in the admin area and force a user to add this product to Shopping List and click add a note for it. Versions 5.0.11 and 5.1.1 contain a fix for this issue.

CVSS Score: 6.9 (MEDIUM)
CWE: CWE-79
References: https://github.com/oroinc/orocommerce/security/advisories/GHSA-2jc6-3fhj-8q84; https://github.com/oroinc/orocommerce/security/advisories/GHSA-2jc6-3fhj-8q84
CVE: CVE-2023-25822
Published: 2023-10-09
Description: ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the `com.epam.reportportal:service-api` module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1 test inside when the test_item.path field is exceeded the allowable `ltree` field type indexing limit (path length>=120, approximately recursive nesting of the nested steps). REINDEX INDEX path_gist_idx and path_idx aren't helped. The problem was fixed in `com.epam.reportportal:service-api` module version 5.10.0 (product release 23.2), where the maximum number of nested elements were programmatically limited. A workaround is available. After deletion of the data with long paths, and reindexing both indexes (path_gist_idx and path_idx), the database becomes stable and ReportPortal works properly.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/reportportal/reportportal/releases/tag/v23.2; https://github.com/reportportal/reportportal/security/advisories/GHSA-mj24-gpw7-23m9; https://reportportal.io/docs/releases/Version23.2/
CVE: CVE-2023-36820
Published: 2023-10-09
Description: Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.

CVSS Score: 4.8 (MEDIUM)
CWE: CWE-284
References: https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980; https://github.com/micronaut-projects/micronaut-security/security/advisories/GHSA-qw22-8w9r-864h; https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980