deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38722
Published: 2023-10-23
Description: IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  262174.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262174; https://www.ibm.com/support/pages/node/7057407; https://exchange.xforce.ibmcloud.com/vulnerabilities/262174
CVE: CVE-2023-43045
Published: 2023-10-23
Description: IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication.  IBM X-Force ID:  266896.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-288, CWE-306
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266896; https://www.ibm.com/support/pages/node/7057409; https://exchange.xforce.ibmcloud.com/vulnerabilities/266896
CVE: CVE-2023-46288
Published: 2023-10-23
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0.

Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set expose_config to non-sensitive-only configuration. This is a different error than CVE-2023-45348 which allows authenticated user to retrieve individual configuration values in 2.7.* by specially crafting their request (solved in 2.7.2).

Users are recommended to upgrade to version 2.7.2, which fixes the issue and additionally fixes CVE-2023-45348.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2024/04/17/10; https://github.com/apache/airflow/pull/32261; https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw
CVE: CVE-2022-22466
Published: 2023-10-23
Description: IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.  IBM X-Force ID:  225222.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225222; https://www.ibm.com/support/pages/node/7057377; https://exchange.xforce.ibmcloud.com/vulnerabilities/225222
CVE: CVE-2023-27148
Published: 2023-10-23
Description: A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-27148-osticket_xss/; https://www.esecforte.com/cve-2023-27148-osticket_xss/
CVE: CVE-2023-27149
Published: 2023-10-23
Description: A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a custom list.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-27149-osticket_xss/; https://www.esecforte.com/cve-2023-27149-osticket_xss/
CVE: CVE-2023-33837
Published: 2023-10-23
Description: IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission.  IBM X-Force ID:  256020.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-319, CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/256020; https://www.ibm.com/support/pages/node/7057377; https://exchange.xforce.ibmcloud.com/vulnerabilities/256020
CVE: CVE-2023-33839
Published: 2023-10-23
Description: IBM Security Verify Governance 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  IBM X-Force ID:  256036.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/256036; https://www.ibm.com/support/pages/node/7057377; https://exchange.xforce.ibmcloud.com/vulnerabilities/256036
CVE: CVE-2023-33840
Published: 2023-10-23
Description: IBM Security Verify Governance 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  256037.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/256037; https://www.ibm.com/support/pages/node/7057377; https://exchange.xforce.ibmcloud.com/vulnerabilities/256037
CVE: CVE-2023-46602
Published: 2023-10-23
Description: In International Color Consortium DemoIccMAX 79ecb74, there is a stack-based buffer overflow in the icFixXml function in IccXML/IccLibXML/IccUtilXml.cpp in libIccXML.a.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/InternationalColorConsortium/DemoIccMAX/pull/53; https://github.com/InternationalColorConsortium/DemoIccMAX/pull/53
CVE: CVE-2023-46603
Published: 2023-10-23
Description: In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function in IccProfLib/IccPrmg.cpp in libSampleICC.a.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/InternationalColorConsortium/DemoIccMAX/pull/53; https://github.com/InternationalColorConsortium/DemoIccMAX/pull/53
CVE: CVE-2023-27152
Published: 2023-10-23
Description: DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://www.esecforte.com/cve-2023-27152-opnsense-brute-force/; https://www.esecforte.com/cve-2023-27152-opnsense-brute-force/
CVE: CVE-2023-37635
Published: 2023-10-23
Description: UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://www.esecforte.com/cve-2023-37635-login-bruteforce/; https://www.esecforte.com/cve-2023-37635-login-bruteforce/
CVE: CVE-2023-37636
Published: 2023-10-23
Description: A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-37636-stored-cross-site-scripting/; https://www.esecforte.com/cve-2023-37636-stored-cross-site-scripting/
CVE: CVE-2023-45966
Published: 2023-10-23
Description: umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/jet-pentest/CVE-2023-45966; https://github.com/umputun/remark42/issues/1677; https://github.com/jet-pentest/CVE-2023-45966
CVE: CVE-2023-43358
Published: 2023-10-23
Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CMSmadesimple-Stored-XSS---News; https://github.com/sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News; https://github.com/sromanhu/CMSmadesimple-Stored-XSS---News
CVE: CVE-2023-44760
Published: 2023-10-23
Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also, the exploitation method claimed by "sromanhu" does not provide any access to a Concrete CMS session, because the Concrete CMS session cookie is configured as HttpOnly.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes/issues/1; https://github.com/sromanhu/ConcreteCMS-Stored-XSS---TrackingCodes; https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766
CVE: CVE-2023-45998
Published: 2023-10-23
Description: kodbox 1.44 is vulnerable to Cross Site Scripting (XSS). Customizing global HTML results in storing XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/fangjiuye/703fdb643db558640f23e4e7c9532348; https://gist.github.com/fangjiuye/703fdb643db558640f23e4e7c9532348
CVE: CVE-2023-5633
Published: 2023-10-23
Description: The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-911, CWE-416
References: https://access.redhat.com/errata/RHSA-2024:0113; https://access.redhat.com/errata/RHSA-2024:0134; https://access.redhat.com/errata/RHSA-2024:0461
CVE: CVE-2023-33517
Published: 2023-10-23
Description: carRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end System).
CVSS Score: 7.5 (HIGH)
CWE: CWE-552, CWE-552
References: https://gist.github.com/wushigudan/288ab32566615d8897c1da7ce7204838; https://gist.github.com/wushigudan/288ab32566615d8897c1da7ce7204838
CVE: CVE-2023-46058
Published: 2023-10-24
Description: Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the grp_desc parameter of the admin/group.php component.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/CrownZTX/vulnerabilities/blob/main/geeklog/Stored_XSS_in_group.php.md; https://github.com/CrownZTX/vulnerabilities/blob/main/geeklog/Stored_XSS_in_group.php.md
CVE: CVE-2023-46059
Published: 2023-10-24
Description: Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the Service, and website URL to Ping parameters of the admin/trackback.php component.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/CrownZTX/vulnerabilities/blob/main/geeklog/reflected_XSS_in_editservice.md; https://github.com/CrownZTX/vulnerabilities/blob/main/geeklog/reflected_XSS_in_editservice.md
CVE: CVE-2022-0353
Published: 2023-10-25
Description: 
A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 

1.3.1.2

 and 

Lenovo Diagnostics versions prior to 4.45

 that could allow a local user with administrative access to trigger a system crash.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-400
References: https://support.lenovo.com/us/en/product_security/LEN-102365; https://support.lenovo.com/us/en/product_security/LEN-94532; https://support.lenovo.com/us/en/product_security/LEN-102365
CVE: CVE-2022-38484
Published: 2023-10-25
Description: An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to version 0.1. A remote authenticated attacker could leverage this vulnerability to upload files to any location on the target operating system with web server privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://citadelo.com/download/CVE-2022-38484.pdf; https://citadelo.com/download/CVE-2022-38484.pdf
CVE: CVE-2022-38485
Published: 2023-10-25
Description: A directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. A remote authenticated attacker could leverage this vulnerability to read files from any location on the target operating system with web server privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://citadelo.com/download/CVE-2022-38485.pdf; https://citadelo.com/download/CVE-2022-38485.pdf
CVE: CVE-2022-3698
Published: 2023-10-25
Description: 
A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 

1.3.1.2

 and 

Lenovo Diagnostics versions prior to 4.45

 that could allow a local user with administrative access to trigger a system crash.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-400
References: https://support.lenovo.com/us/en/product_security/LEN-102365; https://support.lenovo.com/us/en/product_security/LEN-94532; https://support.lenovo.com/us/en/product_security/LEN-102365
CVE: CVE-2022-3699
Published: 2023-10-25
Description: 
A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45



 that could allow a local user to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.lenovo.com/us/en/product_security/LEN-102365; https://support.lenovo.com/us/en/product_security/LEN-94532; https://support.lenovo.com/us/en/product_security/LEN-102365
CVE: CVE-2023-1356
Published: 2023-10-25
Description: Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session by attackers who have convinced the said user to click on a malicious link.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.themissinglink.com.au/security-advisories/cve-2023-1356; https://www.themissinglink.com.au/security-advisories/cve-2023-1356
CVE: CVE-2023-20273
Published: 2023-10-25
Description: A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20273
CVE: CVE-2023-23767
Published: 2023-10-25
Description: Rejected reason: This CVE ID has been rejected or withdrawn by GitHub as it was issued in error.
CVE: CVE-2023-25032
Published: 2023-10-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Print, PDF, Email by PrintFriendly plugin <= 5.5.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/printfriendly/wordpress-print-pdf-email-by-printfriendly-plugin-5-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/printfriendly/wordpress-print-pdf-email-by-printfriendly-plugin-5-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26219
Published: 2023-10-25
Description: The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence Hawk RedTail, and TIBCO Runtime Agent contain a vulnerability that theoretically allows an attacker with access to the Hawk Console’s and Agent’s log to obtain credentials used to access associated EMS servers. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.2.2 and below, TIBCO Hawk Distribution for TIBCO Silver Fabric: versions 6.2.2 and below, TIBCO Operational Intelligence Hawk RedTail: versions 7.2.1 and below, and TIBCO Runtime Agent: versions 5.12.2 and below.


CVSS Score: 7.4 (HIGH)
CWE: CWE-798
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2023-26568
Published: 2023-10-25
Description: Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26568; https://www.themissinglink.com.au/security-advisories/cve-2023-26568
CVE: CVE-2023-26569
Published: 2023-10-25
Description: Unauthenticated SQL injection in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.  
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26569; https://www.themissinglink.com.au/security-advisories/cve-2023-26569
CVE: CVE-2023-26570
Published: 2023-10-25
Description: Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26570; https://www.themissinglink.com.au/security-advisories/cve-2023-26570
CVE: CVE-2023-26571
Published: 2023-10-25
Description: Missing authentication in the SetStudentNotes  method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26571; https://www.themissinglink.com.au/security-advisories/cve-2023-26571
CVE: CVE-2023-26572
Published: 2023-10-25
Description: Unauthenticated SQL injection in the GetExcursionList method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.  
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26572; https://www.themissinglink.com.au/security-advisories/cve-2023-26572
CVE: CVE-2023-26573
Published: 2023-10-25
Description: Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials.
CVSS Score: 8.2 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26573; https://www.themissinglink.com.au/security-advisories/cve-2023-26573
CVE: CVE-2023-26574
Published: 2023-10-25
Description: Missing authentication in the SearchStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26574; https://www.themissinglink.com.au/security-advisories/cve-2023-26574
CVE: CVE-2023-26575
Published: 2023-10-25
Description: Missing authentication in the SearchStudentsStaff  method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student and teacher data by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26575; https://www.themissinglink.com.au/security-advisories/cve-2023-26575
CVE: CVE-2023-26576
Published: 2023-10-25
Description: Missing authentication in the SearchStudentsRFID   method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26576; https://www.themissinglink.com.au/security-advisories/cve-2023-26576
CVE: CVE-2023-26577
Published: 2023-10-25
Description: Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack the browsing session of the logged in user.  
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26577; https://www.themissinglink.com.au/security-advisories/cve-2023-26577
CVE: CVE-2023-26578
Published: 2023-10-25
Description: Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server.  
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434, CWE-434
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26578; https://www.themissinglink.com.au/security-advisories/cve-2023-26578
CVE: CVE-2023-26579
Published: 2023-10-25
Description: Missing authentication in the DeleteStaff method in IDAttend’s IDWeb application 3.1.013 allows deletion of staff information by unauthenticated attackers.  
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26579; https://www.themissinglink.com.au/security-advisories/cve-2023-26579
CVE: CVE-2023-26580
Published: 2023-10-25
Description: Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated attackers.  
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-552, CWE-306, CWE-552
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26580; https://www.themissinglink.com.au/security-advisories/cve-2023-26580
CVE: CVE-2023-26581
Published: 2023-10-25
Description: Unauthenticated SQL injection in the GetVisitors  method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.  
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26581; https://www.themissinglink.com.au/security-advisories/cve-2023-26581
CVE: CVE-2023-26582
Published: 2023-10-25
Description: Unauthenticated SQL injection in the GetExcursionDetails   method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.  
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26582; https://www.themissinglink.com.au/security-advisories/cve-2023-26582
CVE: CVE-2023-26583
Published: 2023-10-25
Description: Unauthenticated SQL injection in the GetCurrentPeriod    method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.  
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26583; https://www.themissinglink.com.au/security-advisories/cve-2023-26583
CVE: CVE-2023-26584
Published: 2023-10-25
Description: Unauthenticated SQL injection in the GetStudentInconsistencies     method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.  
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.themissinglink.com.au/security-advisories/cve-2023-26584; https://www.themissinglink.com.au/security-advisories/cve-2023-26584