deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22950
Published: 2023-04-13
Description: An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permissions, can read sensitive data from arbitrary locations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-669, CWE-669
References: https://dev.tigergraph.com/forum/c/tg-community/announcements/35; https://neo4j.com/security/cve-2023-22950/; https://dev.tigergraph.com/forum/c/tg-community/announcements/35
CVE: CVE-2023-27772
Published: 2023-04-13
Description: libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at /client/client_control.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: https://github.com/mz-automation/libiec61850/commit/79a8eaf26070e02044afc4b2ffbfe777dfdf3e0b; https://github.com/mz-automation/libiec61850/issues/442; https://github.com/mz-automation/libiec61850/commit/79a8eaf26070e02044afc4b2ffbfe777dfdf3e0b
CVE: CVE-2022-2445
Published: 2023-04-13
Description: Rejected reason: Incorrectly assigned CVE. Not a valid issue.
CVE: CVE-2023-22948
Published: 2023-04-13
Description: An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs as the tigergraph user is able to read the SSH private key. With this, an attacker is granted password-less SSH access to all machines in the TigerGraph cluster.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://dev.tigergraph.com/forum/c/tg-community/announcements/35; https://neo4j.com/security/cve-2023-22948/; https://dev.tigergraph.com/forum/c/tg-community/announcements/35
CVE: CVE-2023-26263
Published: 2023-04-13
Description: All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoint of the remote harvesting server.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://talend.com; https://www.talend.com/security/incident-response/#CVE-2023-26264; https://talend.com
CVE: CVE-2023-26264
Published: 2023-04-13
Description: All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://talend.com; https://www.talend.com/security/incident-response/#CVE-2023-26264; https://talend.com
CVE: CVE-2023-29084
Published: 2023-04-13
Description: Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/172755/ManageEngine-ADManager-Plus-Command-Injection.html; https://manageengine.com; https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html
CVE: CVE-2023-1271
Published: 2023-04-13
Description: Rejected reason: Duplicate. Please use CVE-2023-24421.
CVE: CVE-2023-20863
Published: 2023-04-13
Description: In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-917, CWE-400
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://spring.io/security/cve-2023-20863; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-20866
Published: 2023-04-13
Description: In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://spring.io/security/cve-2023-20866; https://spring.io/security/cve-2023-20866
CVE: CVE-2023-22951
Published: 2023-04-13
Description: An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the configuration file. Using this token on the REST API provides an attacker with anonymous admin-level privileges on all REST API endpoints.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://dev.tigergraph.com/forum/c/tg-community/announcements/35; https://neo4j.com/security/cve-2023-22951/; https://dev.tigergraph.com/forum/c/tg-community/announcements/35
CVE: CVE-2023-24509
Published: 2023-04-13
Description: On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-269
References: https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082; https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082
CVE: CVE-2023-26398
Published: 2023-04-13
Description: Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html
CVE: CVE-2023-26409
Published: 2023-04-13
Description: Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html
CVE: CVE-2023-26410
Published: 2023-04-13
Description: Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html
CVE: CVE-2023-26411
Published: 2023-04-13
Description: Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html
CVE: CVE-2023-26412
Published: 2023-04-13
Description: Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html
CVE: CVE-2023-26413
Published: 2023-04-13
Description: Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html
CVE: CVE-2023-26414
Published: 2023-04-13
Description: Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html
CVE: CVE-2023-26415
Published: 2023-04-13
Description: Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html
CVE: CVE-2023-26416
Published: 2023-04-13
Description: Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-28.html
CVE: CVE-2023-27667
Published: 2023-04-13
Description: Auto Dealer Management System v1.0 was discovered to contain a SQL injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://auto.com; https://gist.github.com/Flower-fertilizer/9c615b0fe5f9589b0d41be1ece7cb28f; https://www.sourcecodester.com/php/15371/auto-dealer-management-system-phpoop-free-source-code.html
CVE: CVE-2023-27746
Published: 2023-04-13
Description: BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is intercepted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://blackvue.com; https://github.com/eyJhb/blackvue-cve-2022; https://github.com/eyJhb/blackvue-cve-2023
CVE: CVE-2023-27747
Published: 2023-04-13
Description: BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authentication in its web server. This vulnerability allows attackers to access sensitive information such as configurations and recordings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://blackvue.com; https://github.com/eyJhb/blackvue-cve-2022; https://github.com/eyJhb/blackvue-cve-2023
CVE: CVE-2023-27748
Published: 2023-04-13
Description: BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware. This can allow attackers to upload crafted firmware which contains backdoors and enables arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345, CWE-345
References: https://blackvue.com; https://github.com/eyJhb/blackvue-cve-2022; https://github.com/eyJhb/blackvue-cve-2023
CVE: CVE-2023-29573
Published: 2023-04-13
Description: Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/axiomatic-systems/Bento4/issues/840; https://github.com/z1r00/fuzz_vuln/blob/main/Bento4/mp4info/readme.md; https://github.com/axiomatic-systems/Bento4/issues/840
CVE: CVE-2022-48468
Published: 2023-04-13
Description: protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/protobuf-c/protobuf-c/commit/ec3d900001a13ccdaa8aef996b34c61159c76217; https://github.com/protobuf-c/protobuf-c/issues/499; https://github.com/protobuf-c/protobuf-c/pull/513
CVE: CVE-2023-1326
Published: 2023-04-13
Description: A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate privilege. It is extremely unlikely that a system administrator would configure sudo to allow unprivileged users to perform this class of exploit.
CVSS Score: 7.7 (HIGH)
CWE: CWE-269, CWE-269
References: https://github.com/canonical/apport/commit/e5f78cc89f1f5888b6a56b785dddcb0364c48ecb; https://ubuntu.com/security/notices/USN-6018-1; https://github.com/canonical/apport/commit/e5f78cc89f1f5888b6a56b785dddcb0364c48ecb
CVE: CVE-2023-30635
Published: 2023-04-13
Description: TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error) upon an attempt to get a timestamp from the Placement Driver.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/tikv/tikv/issues/14516; https://github.com/tikv/tikv/issues/14516
CVE: CVE-2023-30636
Published: 2023-04-13
Description: TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error, with RpcStatus UNAVAILABLE for "not leader") upon an attempt to start a node in a situation where the context deadline is exceeded
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/tikv/tikv/issues/14517; https://github.com/tikv/tikv/issues/14517
CVE: CVE-2023-30637
Published: 2023-04-13
Description: Baidu braft 1.1.2 has a memory leak related to use of the new operator in example/atomic/atomic_server. NOTE: installations with brpc-0.14.0 and later are unaffected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://github.com/baidu/braft/issues/393; https://github.com/baidu/braft/issues/393
CVE: CVE-2023-26918
Published: 2023-04-14
Description: Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSystem. This occurs because %ProgramFiles%\FileReplicationPro allows Everyone:(F) access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276, CWE-276
References: http://packetstormsecurity.com/files/171879/File-Replication-Pro-7.5.0-Insecure-Permissions-Privilege-Escalation.html; https://www.filereplicationpro.com; http://packetstormsecurity.com/files/171879/File-Replication-Pro-7.5.0-Insecure-Permissions-Privilege-Escalation.html
CVE: CVE-2023-30638
Published: 2023-04-14
Description: Atos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote authenticated admins to inject commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-94
References: https://networks.unify.com/security/advisories/OBSO-2303-02.pdf; https://www.news.de/technik/856818957/unify-openscape-sbc-und-openscape-branch-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/; https://networks.unify.com/security/advisories/OBSO-2303-02.pdf
CVE: CVE-2023-27890
Published: 2023-04-14
Description: The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/171421/MyBB-Export-User-2.0-Cross-Site-Scripting.html; https://community.mybb.com/mods.php?action=view&pid=1408; https://community.mybb.com/user-121250.html
CVE: CVE-2023-29132
Published: 2023-04-14
Description: Irssi 1.3.x and 1.4.x before 1.4.4 has a use-after-free because of use of a stale special collector reference. This occurs when printing of a non-formatted line is concurrent with printing of a formatted line.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://irssi.org/security/irssi_sa_2023_03.txt; https://www.openwall.com/lists/oss-security/2023/03/30/5; https://irssi.org/security/irssi_sa_2023_03.txt
CVE: CVE-2023-29491
Published: 2023-04-14
Description: ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://ncurses.scripts.mit.edu/?p=ncurses.git%3Ba=commit%3Bh=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56; http://www.openwall.com/lists/oss-security/2023/04/19/10; http://www.openwall.com/lists/oss-security/2023/04/19/11
CVE: CVE-2023-2034
Published: 2023-04-14
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/froxlor/froxlor/commit/f36bc61fc74c85a21c8d31448198b11f96eb3bc6; https://huntr.dev/bounties/aba6beaa-570e-4523-8128-da4d8e374ef6; https://github.com/froxlor/froxlor/commit/f36bc61fc74c85a21c8d31448198b11f96eb3bc6
CVE: CVE-2023-26969
Published: 2023-04-14
Description: Atropim 1.5.26 is vulnerable to Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/atrocore/atrocore-1.5.26; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/atrocore/atrocore-1.5.26
CVE: CVE-2023-29621
Published: 2023-04-14
Description: Purchase Order Management v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://brightsec.com/blog/file-inclusion-vulnerabilities/; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Purchase-Order-Management-1.0; https://brightsec.com/blog/file-inclusion-vulnerabilities/
CVE: CVE-2023-29622
Published: 2023-04-14
Description: Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchase_order/admin/login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Purchase-Order-Management-1.0/SQLi; https://portswigger.net/web-security/sql-injection; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Purchase-Order-Management-1.0/SQLi
CVE: CVE-2023-29623
Published: 2023-04-14
Description: Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the password parameter at /purchase_order/classes/login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Purchase-Order-Management-1.0/XSS-Reflected; https://portswigger.net/web-security/cross-site-scripting/reflected; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Purchase-Order-Management-1.0/XSS-Reflected
CVE: CVE-2023-29625
Published: 2023-04-14
Description: Employee Performance Evaluation System v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Employee-Performance-Evaluation-1.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Employee-Performance-Evaluation-1.0
CVE: CVE-2023-29626
Published: 2023-04-14
Description: Yoga Class Registration System 1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at /admin/login.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Yoga-Class-Registration%20-1.0-2023%20-%20Multiple-SQLi; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Yoga-Class-Registration%20-1.0-2023%20-%20Multiple-SQLi
CVE: CVE-2023-29627
Published: 2023-04-14
Description: Online Pizza Ordering v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-Pizza-Ordering-1.0; https://portswigger.net/web-security/file-upload; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-Pizza-Ordering-1.0
CVE: CVE-2023-1285
Published: 2023-04-14
Description: Signal Handler Race Condition vulnerability in Mitsubishi Electric India GC-ENET-COM whose first 2 digits of 11-digit serial number of unit are "16" allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in Ethernet communication by sending a large number of specially crafted packets to any UDP port when GC-ENET-COM is configured as a Modbus TCP Server. The communication resumes only when the power of the main unit is turned off and on or when the GC-ENET-COM is hot-swapped from the main unit.

CVSS Score: 7.5 (HIGH)
CWE: CWE-364, CWE-362
References: https://mitsubishielectric.in/fa/cnc-pdf/DoS_in_Ethernet_Communication_Extension_Unit_GC_ENET_COM_of_GOC35_Series.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-15; https://mitsubishielectric.in/fa/cnc-pdf/DoS_in_Ethernet_Communication_Extension_Unit_GC_ENET_COM_of_GOC35_Series.pdf
CVE: CVE-2023-26123
Published: 2023-04-14
Description: Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function.**Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a[PII_REDACTED]d959d; https://github.com/raysan5/raylib/issues/2954; https://github.com/raysan5/raylib/releases/tag/4.5.0
CVE: CVE-2023-2035
Published: 2023-04-14
Description: A vulnerability has been found in Campcodes Video Sharing Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file signup.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225913 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Video%20Sharing%20Website/Video%20Sharing%20Website%20vuln%203.pdf; https://vuldb.com/?ctiid.225913; https://vuldb.com/?id.225913