deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3615
Published: 2024-04-19
Description: The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 8.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3072498%40media-library-plus&new=3072498%40media-library-plus&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5f550bac-b047-4276-bde5-c15bfd4ceb49?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3072498%40media-library-plus&new=3072498%40media-library-plus&sfp_email=&sfph_mail=
CVE: CVE-2024-3731
Published: 2024-04-19
Description: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.47.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3072688/customer-reviews-woocommerce/trunk/includes/reminders/class-cr-reminders-log-table.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/c3[PII_REDACTED]-4080-b802-5733afab5de8?source=cve; https://plugins.trac.wordpress.org/changeset/3072688/customer-reviews-woocommerce/trunk/includes/reminders/class-cr-reminders-log-table.php
CVE: CVE-2024-3818
Published: 2024-04-19
Description: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "Social Icons" block in all versions up to, and including, 4.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3072932/essential-blocks/tags/4.5.10/blocks/social/src/components/depricated-social-links-1.js; https://www.wordfence.com/threat-intel/vulnerabilities/id/6b[PII_REDACTED]-4f7e-9415-dc3c83f2fd27?source=cve; https://plugins.trac.wordpress.org/changeset/3072932/essential-blocks/tags/4.5.10/blocks/social/src/components/depricated-social-links-1.js
CVE: CVE-2024-29957
Published: 2024-04-19
Description: When Brocade SANnav before v2.3.1 and v2.3.0a servers are configured in Disaster Recovery mode, the encryption key is stored in the DR log files. This could provide attackers with an additional, less-protected path to acquiring the encryption key.

CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23241; https://support.broadcom.com/external/content/SecurityAdvisories/0/23241
CVE: CVE-2024-29958
Published: 2024-04-19
Description: A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the encryption key in the console when a privileged user executes the script to replace the Brocade SANnav Management Portal standby node. This could provide attackers an additional, less protected path to acquiring the encryption key.

CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23242; https://support.broadcom.com/external/content/SecurityAdvisories/0/23242
CVE: CVE-2024-29959
Published: 2024-04-19
Description: A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save.


CVSS Score: 8.6 (HIGH)
CWE: CWE-532, CWE-532
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23243; https://support.broadcom.com/external/content/SecurityAdvisories/0/23243
CVE: CVE-2024-29960
Published: 2024-04-19
Description: 
In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnnav VM based on the official OVA images is vulnerable to MITM over SSH. An attacker can decrypt and compromise the SSH traffic to the SANnav.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23244; https://support.broadcom.com/external/content/SecurityAdvisories/0/23244
CVE: CVE-2024-29961
Published: 2024-04-19
Description: A vulnerability affects Brocade SANnav before v2.3.1 and v2.3.0a. It allows a Brocade SANnav service to send ping commands in the background at regular intervals to gridgain.com to check if updates are available for the Component. This could make an unauthenticated, remote attacker aware of the behavior and launch a supply-chain attack against a Brocade SANnav appliance.

CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23246; https://support.broadcom.com/external/content/SecurityAdvisories/0/23246
CVE: CVE-2024-29963
Published: 2024-04-19
Description: 
Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries.


CVSS Score: 1.9 (LOW)
CWE: CWE-798, CWE-798
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23247; https://support.broadcom.com/external/content/SecurityAdvisories/0/23247
CVE: CVE-2024-29962
Published: 2024-04-19
Description: Brocade SANnav OVA before v2.3.1 and v2.3.0a have an insecure file permission setting that makes files world-readable. This could allow a local user without the required privileges to access sensitive information or a Java binary.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23248; https://support.broadcom.com/external/content/SecurityAdvisories/0/23248
CVE: CVE-2024-29964
Published: 2024-04-19
Description: Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23249; https://support.broadcom.com/external/content/SecurityAdvisories/0/23249
CVE: CVE-2024-29965
Published: 2024-04-19
Description: 
In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The resulting backups are world-readable. A local attacker can recover backup files, restore them to a new malicious appliance, and retrieve the passwords of all the switches.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23250; https://support.broadcom.com/external/content/SecurityAdvisories/0/23250
CVE: CVE-2024-29966
Published: 2024-04-19
Description: Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appliance.


CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23255; https://support.broadcom.com/external/content/SecurityAdvisories/0/23255
CVE: CVE-2024-29967
Published: 2024-04-19
Description: In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing reading and writing access to sensitive files. The vulnerability could allow a sudo privileged user on the host OS to read and write access to these files. 


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23254; https://support.broadcom.com/external/content/SecurityAdvisories/0/23254
CVE: CVE-2024-2761
Published: 2024-04-19
Description: The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e092ccdc-7ea1-4937-97b7-4cdbff5e74e5/; https://wpscan.com/vulnerability/e092ccdc-7ea1-4937-97b7-4cdbff5e74e5/
CVE: CVE-2024-29968
Published: 2024-04-19
Description: An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access the database structure and its contents.
CVSS Score: 7.7 (HIGH)
CWE: CWE-922, CWE-922
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23253; https://support.broadcom.com/external/content/SecurityAdvisories/0/23253
CVE: CVE-2024-29969
Published: 2024-04-19
Description: When a Brocade SANnav installation is upgraded from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, TLS/SSL weak message authentication code ciphers are added by default for port 18082. 


CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-326
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23251; https://support.broadcom.com/external/content/SecurityAdvisories/0/23251
CVE: CVE-2024-0671
Published: 2024-04-19
Description: Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Midgard GPU Kernel Driver: from r19p0 through r32p0; Bifrost GPU Kernel Driver: from r7p0 through r48p0; Valhall GPU Kernel Driver: from r19p0 through r48p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r48p0.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-1065
Published: 2024-04-19
Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r45p0 through r48p0; Valhall GPU Kernel Driver: from r45p0 through r48p0; Arm 5th Gen GPU Architecture Kernel Driver: from r45p0 through r48p0.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-32683
Published: 2024-04-19
Description: Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/wp-ultimate-review/wordpress-wp-ultimate-review-plugin-2-2-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-ultimate-review/wordpress-wp-ultimate-review-plugin-2-2-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-31744
Published: 2024-04-19
Description: In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jasper-software/jasper/commit/6d084c53a77762f41bb5310713a5f1872fef55f5; https://github.com/jasper-software/jasper/issues/381; https://github.com/jasper-software/jasper/commit/6d084c53a77762f41bb5310713a5f1872fef55f5
CVE: CVE-2024-31745
Published: 2024-04-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-2002. Reason: This candidate is a duplicate of CVE-2024-2002. Notes: All CVE users should reference CVE-2024-2002 instead of this candidate.
CVE: CVE-2024-3654
Published: 2024-04-19
Description: An XSS vulnerability has been found in Teimas Global's Teixo, version 1.42.42-stable. This vulnerability could allow an attacker to send a specially crafted JavaScript payload via the "seconds" parameter in the program's URL, resulting in a possible takeover of a registered user's session.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-teixo-teimas-global; https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-teixo-teimas-global
CVE: CVE-2023-37400
Published: 2024-04-19
Description: IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to insecure credential storage.  IBM X-Force ID:  259677.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/259677; https://www.ibm.com/support/pages/node/7148631; https://exchange.xforce.ibmcloud.com/vulnerabilities/259677
CVE: CVE-2024-32166
Published: 2024-04-19
Description: Webid v1.2.1 suffers from an Insecure Direct Object Reference (IDOR) - Broken Access Control vulnerability, allowing attackers to buy now an auction that is suspended (horizontal privilege escalation).
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://github.com/Fewword/Poc/blob/main/webid/webid-poc14.md; https://github.com/Fewword/Poc/blob/main/webid/webid-poc14.md
CVE: CVE-2023-49275
Published: 2024-04-19
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. A NULL pointer dereference was detected during fuzzing of the analysis engine, allowing malicious clients to DoS the analysis engine. The bug occurs when `analysisd` receives a syscollector message with the `hotfix` `msg_type` but lacking a `timestamp`. It uses `cJSON_GetObjectItem()` to get the `timestamp` object item and dereferences it without checking for a `NULL` value. A malicious client can DoS the analysis engine. This vulnerability is fixed in 4.7.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/wazuh/wazuh/blob/e1d5231b31b68a75f3b8b33f833155b362411078/src/analysisd/decoders/syscollector.c#L1573; https://github.com/wazuh/wazuh/blob/e1d5231b31b68a75f3b8b33f833155b362411078/src/analysisd/decoders/syscollector.c#L1578; https://github.com/wazuh/wazuh/security/advisories/GHSA-4mq7-w9r6-9975
CVE: CVE-2023-50260
Published: 2024-04-19
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the `host_deny` script allows to write any string in the `hosts.deny` file, which can end in an arbitrary command execution on the target system. This vulnerability is part of the active response feature, which can automatically triggers actions in response to alerts. By default, active responses are limited to a set of pre defined executables. This is enforced by only allowing executables stored under `/var/ossec/active-response/bin` to be run as an active response. However, the `/var/ossec/active-response/bin/host_deny` can be exploited. `host_deny` is used to add IP address to the `/etc/hosts.deny` file to block incoming connections on a service level by using TCP wrappers. Attacker can inject arbitrary command into the `/etc/hosts.deny` file and execute arbitrary command by using the spawn directive. The active response can be triggered by writing events either to the local `execd` queue on server or to the `ar` queue which forwards the events to agents. So, it can leads to LPE on server as root and RCE on agent as root. This vulnerability is fixed in 4.7.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw; https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw
CVE: CVE-2024-29028
Published: 2024-04-19
Description: memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://github.com/usememos/memos/commit/6ffc09d86a1302c384ef085aa70c7bddb3ce7ba9; https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos; https://github.com/usememos/memos/commit/6ffc09d86a1302c384ef085aa70c7bddb3ce7ba9
CVE: CVE-2024-29030
Published: 2024-04-19
Description: memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://github.com/usememos/memos/blob/06dbd[PII_REDACTED]444f4b50f4f9ed267f7c3cf63/api/v1/resource.go#L83; https://github.com/usememos/memos/commit/bbd206e8930281eb040cc8c[PII_REDACTED]92b9eb5; https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/
CVE: CVE-2024-32038
Published: 2024-04-19
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. There is a buffer overflow hazard in wazuh-analysisd when handling Unicode characters from Windows Eventchannel messages. It impacts Wazuh Manager 3.8.0 and above. This vulnerability is fixed in Wazuh Manager 4.7.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327; https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327
CVE: CVE-2024-32478
Published: 2024-04-19
Description: Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0.

CVSS Score: 6.9 (MEDIUM)
CWE: CWE-732
References: https://github.com/git-ecosystem/git-credential-manager/commit/d9ac33c5b[PII_REDACTED]b4425f5ecf875a62efba9; https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-3c3g-h9rx-f7vq; https://github.com/git-ecosystem/git-credential-manager/commit/d9ac33c5b[PII_REDACTED]b4425f5ecf875a62efba9
CVE: CVE-2024-32644
Published: 2024-04-19
Description: Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit is based on the fact that to sync the Cosmos SDK state and the EVM one, we rely on the `stateDB.Commit()` method. When we call this method, we iterate though all the `dirtyStorage` and, **if and only if** it is different than the `originStorage`, we set the new state. Setting the new state means we update the Cosmos SDK KVStore.  If a contract storage state that is the same before and after a transaction, but is changed during the transaction and can call an external contract after the change, it can be exploited to make the transaction similar to non-atomic. The vulnerability is **critical** since this could lead to drain of funds through creative SC interactions.  The issue has been patched in versions >=V17.0.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-662
References: https://github.com/evmos/evmos/blob/b196a522ba4951890b40992e9f97aa610f8b5f9c/x/evm/statedb/statedb.go#L460-L465; https://github.com/evmos/evmos/commit/08982b5ee726b97bc50eaf58d[PII_REDACTED]b6a5f; https://github.com/evmos/evmos/security/advisories/GHSA-3fp5-2xwh-fxm6
CVE: CVE-2024-3470
Published: 2024-04-19
Description: An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaining to an organization to bypass an organization ruleset. An attacker would require access to a valid deploy key for a repository in the organization as well as repository administrator access. This vulnerability affected versions of GitHub Enterprise Server 3.11 to 3.12 and was fixed in versions 3.11.8 and 3.12.2. This vulnerability was reported via the GitHub Bug Bounty program.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-269
References: https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8
CVE: CVE-2024-3646
Published: 2024-04-19
Description: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the instance when configuring the chat integration. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.12.2, 3.11.8, 3.10.10, and 3.9.13. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Score: 8.0 (HIGH)
CWE: CWE-20
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2
CVE: CVE-2024-3684
Published: 2024-04-19
Description: A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin access to the appliance when configuring the Artifacts & Logs and Migrations Storage. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.12.2, 3.11.8, 3.10.10, and 3.9.13. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Score: 8.0 (HIGH)
CWE: CWE-88
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2
CVE: CVE-2023-22869
Published: 2024-04-19
Description: IBM Aspera Faspex 5.0.0 through 5.0.7 stores potentially sensitive information in log files that could be read by a local user.  IBM X-Force ID:  244119.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244119; https://www.ibm.com/support/pages/node/7148632; https://exchange.xforce.ibmcloud.com/vulnerabilities/244119