deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22061
Published: 2023-07-18
Description: Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer).   The supported version that is affected is 6.4.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2023.html; https://www.oracle.com/security-alerts/cpujul2023.html
CVE: CVE-2023-22062
Published: 2023-07-18
Description: Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository).   The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting.  While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
CVSS Score: 8.5 (HIGH)
References: https://www.oracle.com/security-alerts/cpujul2023.html; https://www.oracle.com/security-alerts/cpujul2023.html
CVE: CVE-2023-22505
Published: 2023-07-18
Description: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server.

This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction.

Atlassian recommends that you upgrade your instance to latest version. If you're unable to upgrade to latest, upgrade to one of these fixed versions: 8.3.2, 8.4.0. See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html).|https://confluence.atlassian.com/doc/confluence-release-notes-327.html).]  You can download the latest version of Confluence Data Center & Server from the download center ([https://www.atlassian.com/software/confluence/download-archives).|https://www.atlassian.com/software/confluence/download-archives).] 

This vulnerability was discovered by a private user and reported via our Bug Bounty program.
CVSS Score: 8.8 (HIGH)
References: https://jira.atlassian.com/browse/CONFSERVER-88265; https://jira.atlassian.com/browse/CONFSERVER-88265
CVE: CVE-2023-37897
Published: 2023-07-18
Description: Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.


CVSS Score: 7.2 (HIGH)
CWE: CWE-74, CWE-393
References: https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b; https://github.com/getgrav/grav/commit/b4c62101a43051fc7f5349c7d0a5b6085375c1d7; https://github.com/getgrav/grav/security/advisories/GHSA-9436-3gmp-4f53
CVE: CVE-2023-3527
Published: 2023-07-18
Description: A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software 

such as Microsoft Excel.

 


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1236, CWE-1236
References: https://download.avaya.com/css/public/documents/101086364; https://download.avaya.com/css/public/documents/101086364
CVE: CVE-2023-22508
Published: 2023-07-18
Description: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that you upgrade your instance to avoid this bug using the following options: * Upgrade to a Confluence feature release greater than or equal to 8.2.0 (ie: 8.2, 8.2, 8.4, etc...) * Upgrade to a Confluence 7.19 LTS bugfix release greater than or equal to 7.19.8 (ie: 7.19.8, 7.19.9, 7.19.10, 7.19.11, etc...) * Upgrade to a Confluence 7.13 LTS bugfix release greater than or equal to 7.13.20 (Release available early August) See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html ). You can download the latest version of Data Center & Server from the download center (https://www.atlassian.com/software/confluence/download-archives ). If you are unable to upgrade your instance please use the following guide to workaround the issue https://confluence.atlassian.com/confkb/how-to-disable-the-jmx-network-port-for-cve-2023-22[PII_REDACTED]550.html This vulnerability was discovered by a private user and reported via our Bug Bounty program.
CVSS Score: 8.8 (HIGH)
References: https://jira.atlassian.com/browse/CONFSERVER-88221; https://jira.atlassian.com/browse/CONFSERVER-88221
CVE: CVE-2023-22506
Published: 2023-07-19
Description: This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center.
 

This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to
modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction.
 
 
Atlassian recommends that you upgrade your instance to latest version. If you're unable to upgrade to latest, upgrade to one of these fixed versions: 9.2.3 and 9.3.1. See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes[PII_REDACTED].html|https://confluence.atlassian.com/bambooreleases/bamboo-release-notes[PII_REDACTED].html]). You can download the latest version of Bamboo Data Center and Bamboo Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives|https://www.atlassian.com/software/bamboo/download-archives]).
 

This vulnerability was reported via our Penetration Testing program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://jira.atlassian.com/browse/BAM-22400; https://jira.atlassian.com/browse/BAM-22400
CVE: CVE-2023-3751
Published: 2023-07-19
Description: A vulnerability was found in Super Store Finder 3.6. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the component POST Parameter Handler. The manipulation of the argument products leads to sql injection. The attack can be launched remotely. The identifier VDB-234421 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234421; https://vuldb.com/?id.234421; https://vuldb.com/?ctiid.234421
CVE: CVE-2023-30433
Published: 2023-07-19
Description: IBM Security Verify Access 10.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.  IBM X-Force ID:  252186.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/252186; https://www.ibm.com/support/pages/node/7012613; https://exchange.xforce.ibmcloud.com/vulnerabilities/252186
CVE: CVE-2023-33832
Published: 2023-07-19
Description: IBM Spectrum Protect 8.1.0.0 through 8.1.17.0 could allow a local user to cause a denial of service due to due to improper time-of-check to time-of-use functionality.  IBM X-Force ID:  256012.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20, CWE-367
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/256012; https://www.ibm.com/support/pages/node/7011761; https://exchange.xforce.ibmcloud.com/vulnerabilities/256012
CVE: CVE-2023-35898
Published: 2023-07-19
Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information due to an insecure security configuration in InfoSphere Data Flow Designer.  IBM X-Force ID:  259352.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/259352; https://www.ibm.com/support/pages/node/7009205; https://exchange.xforce.ibmcloud.com/vulnerabilities/259352
CVE: CVE-2023-35900
Published: 2023-07-19
Description: IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may be used to determine software vulnerabilities at the operating system level.  IBM X-Force ID:  259368.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/259368; https://www.ibm.com/support/pages/node/7010895; https://exchange.xforce.ibmcloud.com/vulnerabilities/259368
CVE: CVE-2023-3765
Published: 2023-07-19
Description: Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-36
References: https://github.com/mlflow/mlflow/commit/6dde93758d42455cb90ef324407919ed67668b9b; https://huntr.dev/bounties/4be5fd63-8a0a-490d-9ee1-f33dc768ed76; https://github.com/mlflow/mlflow/commit/6dde93758d42455cb90ef324407919ed67668b9b
CVE: CVE-2021-38933
Published: 2023-07-19
Description: IBM Sterling Connect:Direct for UNIX 1.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  210574.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210574; https://www.ibm.com/support/pages/node/7010925; https://exchange.xforce.ibmcloud.com/vulnerabilities/210574
CVE: CVE-2022-43908
Published: 2023-07-19
Description: 
IBM Security Guardium 11.3 could allow an authenticated user to cause a denial of service due to improper input validation. IBM X-Force ID: 240903.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240903; https://www.ibm.com/support/pages/node/7007815; https://exchange.xforce.ibmcloud.com/vulnerabilities/240903
CVE: CVE-2023-26023
Published: 2023-07-19
Description: Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks.  IBM X-Force ID:  247896.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247896; https://www.ibm.com/support/pages/node/6999351; https://exchange.xforce.ibmcloud.com/vulnerabilities/247896
CVE: CVE-2023-26026
Published: 2023-07-19
Description: Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks.  IBM X-Force ID:  247896.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247896; https://www.ibm.com/support/pages/node/6999351; https://exchange.xforce.ibmcloud.com/vulnerabilities/247896
CVE: CVE-2023-27877
Published: 2023-07-19
Description: IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database.  IBM X-Force ID:  247905.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247905; https://www.ibm.com/support/pages/node/6999351; https://exchange.xforce.ibmcloud.com/vulnerabilities/247905
CVE: CVE-2023-28513
Published: 2023-07-19
Description: IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vulnerable to a denial of service attack caused by an error processing messages.  IBM X-Force ID:  250397.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/250397; https://www.ibm.com/support/pages/node/7007421; https://www.ibm.com/support/pages/node/7007731
CVE: CVE-2023-29259
Published: 2023-07-19
Description: IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute.  IBM X-Force ID:  252055.
CVSS Score: 3.7 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/252055; https://www.ibm.com/support/pages/node/7010921; https://exchange.xforce.ibmcloud.com/vulnerabilities/252055
CVE: CVE-2023-29260
Published: 2023-07-19
Description: IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.  IBM X-Force ID:  252135.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/252135; https://www.ibm.com/support/pages/node/7010923; https://exchange.xforce.ibmcloud.com/vulnerabilities/252135
CVE: CVE-2023-3752
Published: 2023-07-19
Description: A vulnerability was found in Creativeitem Academy LMS 5.15. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /home/courses. The manipulation of the argument sort_by leads to cross site scripting. The attack may be launched remotely. VDB-234422 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.234422; https://vuldb.com/?id.234422; https://vuldb.com/?ctiid.234422
CVE: CVE-2023-3753
Published: 2023-07-19
Description: A vulnerability classified as problematic has been found in Creativeitem Mastery LMS 1.2. This affects an unknown part of the file /browse. The manipulation of the argument search/featured/recommended/skill leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-234423. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.234423; https://vuldb.com/?id.234423; https://vuldb.com/?ctiid.234423
CVE: CVE-2022-43910
Published: 2023-07-19
Description: 
IBM Security Guardium 11.3 could allow a local user to escalate their privileges due to improper permission controls.  IBM X-Force ID:  240908.


CVSS Score: 8.4 (HIGH)
CWE: CWE-281
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240908; https://www.ibm.com/support/pages/node/7007815; https://exchange.xforce.ibmcloud.com/vulnerabilities/240908
CVE: CVE-2023-3754
Published: 2023-07-19
Description: A vulnerability, which was classified as problematic, was found in Creativeitem Ekushey Project Manager CRM 5.0. Affected is an unknown function of the file /index.php/client/message/message_read/xxxxxxxx[random-msg-hash]. The manipulation of the argument message leads to cross site scripting. It is possible to launch the attack remotely. VDB-234426 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.234426; https://vuldb.com/?id.234426; https://vuldb.com/?ctiid.234426
CVE: CVE-2023-3755
Published: 2023-07-19
Description: A vulnerability has been found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /home/filter_listings. The manipulation of the argument price-range leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-234427. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.234427; https://vuldb.com/?id.234427; https://vuldb.com/?ctiid.234427
CVE: CVE-2023-3756
Published: 2023-07-19
Description: A vulnerability was found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this issue is some unknown functionality of the file /home/search. The manipulation of the argument search_string leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-234428. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?ctiid.234428; https://vuldb.com/?id.234428; https://vuldb.com/?ctiid.234428
CVE: CVE-2023-3757
Published: 2023-07-19
Description: A vulnerability classified as problematic has been found in GZ Scripts Car Rental Script 1.8. Affected is an unknown function of the file /EventBookingCalendar/load.php?controller=GzFront/action=checkout/cid=1/layout=calendar/show_header=T/local=3. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234432. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.234432; https://vuldb.com/?id.234432; https://vuldb.com/?ctiid.234432
CVE: CVE-2023-3759
Published: 2023-07-19
Description: A vulnerability, which was classified as critical, was found in Intergard SGS 8.7.0. Affected is an unknown function. The manipulation leads to permission issues. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-234444. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-275
References: https://vuldb.com/?ctiid.234444; https://vuldb.com/?id.234444; https://youtu.be/yW4tRnjDjhM
CVE: CVE-2023-32635
Published: 2023-07-19
Description: XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://jvn.jp/en/jp/JVN44726469/; https://submit2.edinet-fsa.go.jp/; https://jvn.jp/en/jp/JVN44726469/
CVE: CVE-2023-3760
Published: 2023-07-19
Description: A vulnerability has been found in Intergard SGS 8.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Change Password Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-234445 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://vuldb.com/?ctiid.234445; https://vuldb.com/?id.234445; https://youtu.be/CtOFB-L1rOg
CVE: CVE-2023-3761
Published: 2023-07-19
Description: A vulnerability was found in Intergard SGS 8.7.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Password Change Handler. The manipulation leads to cleartext transmission of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-234446 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-319
References: https://vuldb.com/?ctiid.234446; https://vuldb.com/?id.234446; https://youtu.be/bMJwSCps0Lc
CVE: CVE-2023-3762
Published: 2023-07-19
Description: A vulnerability was found in Intergard SGS 8.7.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to cleartext storage of sensitive information in memory. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-234447. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-316, CWE-312
References: https://vuldb.com/?ctiid.234447; https://vuldb.com/?id.234447; https://youtu.be/Ee2KU-T_0pI
CVE: CVE-2023-3763
Published: 2023-07-19
Description: A vulnerability was found in Intergard SGS 8.7.0. It has been declared as problematic. This vulnerability affects unknown code of the component SQL Query Handler. The manipulation leads to cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-234448. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-319, CWE-319
References: https://vuldb.com/?ctiid.234448; https://vuldb.com/?id.234448; https://youtu.be/XlRVwWXpv4w