deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-36480
Published: 2023-08-04
Description: The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/AsyncRead.java#L68; https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/NettyCommand.java#L1157; https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/NettyCommand.java#L489
CVE: CVE-2023-37470
Published: 2023-08-04
Description: Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, a vulnerability could potentially allow remote code execution on one's Metabase server. The core issue is that one of the supported data warehouses (an embedded in-memory database H2), exposes a number of ways for a connection string to include code that is then executed by the process running the embedded database. Because Metabase allows users to connect to databases, this means that a user supplied string can be used to inject executable code. Metabase allows users to validate their connection string before adding a database (including on setup), and this validation API was the primary vector used as it can be called without validation. Versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4 fix this issue by removing the ability of users to add H2 databases entirely. As a workaround, it is possible to block these vulnerabilities at the network level by blocking the endpoints `POST /api/database`, `PUT /api/database/:id`, and `POST /api/setup/validateuntil`. Those who use H2 as a file-based database should migrate to SQLite.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/metabase/metabase/security/advisories/GHSA-p7w3-9m58-rq83; https://github.com/metabase/metabase/security/advisories/GHSA-p7w3-9m58-rq83
CVE: CVE-2023-37896
Published: 2023-08-04
Description: Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code (SDK) running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payload loading in sandbox mode. There was a potential risk with payloads loading in sandbox mode. The issue occurred due to relative paths not being converted to absolute paths before doing the check for `sandbox` flag allowing arbitrary files to be read on the filesystem in certain cases when using Nuclei from `Go` SDK implementation. 

This issue has been fixed in version 2.9.9. The maintainers have also enabled sandbox by default for filesystem loading. This can be optionally disabled if required. The `-sandbox` option has been deprecated and is now divided into two new options: `-lfa` (allow local file access) which is enabled by default and `-lna` (restrict local network access) which can be enabled by users optionally. The `-lfa` allows file (payload) access anywhere on the system (disabling sandbox effectively), and `-lna` blocks connections to the local/private network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/projectdiscovery/nuclei/pull/3927; https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.9; https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-2xx4-jj5v-6mff
CVE: CVE-2023-38487
Published: 2023-08-04
Description: HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1 can be used to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by the new one.

When the freeURL feature is enabled (by setting the `allowFreeURL` config option or the `CMD_ALLOW_FREEURL` environment variable to `true`), any user with the appropriate permissions can create a note by making a POST request to the `/new/<ALIAS>` API endpoint. The `<ALIAS>` parameter can be set to the ID of an existing note. HedgeDoc did not verify whether the provided `<ALIAS>` value corresponds to a valid ID of an existing note and always allowed creation of the new note. When a visitor tried to access the existing note, HedgeDoc will first search for a note with a matching alias before it searches using the ID, therefore only the new note can be accessed.

Depending on the permission settings of the HedgeDoc instance, the issue can be exploited only by logged-in users or by all (including non-logged-in) users. The exploit requires knowledge of the ID of the target note. Attackers could use this issue to present a manipulated copy of the original note to the user, e.g. by replacing the links with malicious ones. Attackers can also use this issue to prevent access to the original note, causing a denial of service. No data is lost, as the original content of the affected notes is still present in the database.

This issue was fixed in version 1.9.9. As a workaround, disabling freeURL mode prevents the exploitation of this issue. The impact can be limited by restricting freeURL note creation to trusted, logged-in users by enabling `requireFreeURLAuthentication`/`CMD_REQUIRE_FREEURL_AUTHENTICATION`.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-289
References: https://github.com/hedgedoc/hedgedoc/pull/4476/commits/781263ab84255885e1fe60c7e92e2f8d611664d2; https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-7494-7hcf-vxpg; https://github.com/hedgedoc/hedgedoc/pull/4476/commits/781263ab84255885e1fe60c7e92e2f8d611664d2
CVE: CVE-2023-38494
Published: 2023-08-04
Description: MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://github.com/metersphere/metersphere/commit/a23f75d93b666901fd148d834df9384f6f24cf28; https://github.com/metersphere/metersphere/security/advisories/GHSA-fjp5-95pv-5253; https://github.com/metersphere/metersphere/commit/a23f75d93b666901fd148d834df9384f6f24cf28
CVE: CVE-2023-38497
Published: 2023-08-04
Description: Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.
CVSS Score: 7.9 (HIGH)
CWE: CWE-278, CWE-732
References: https://en.wikipedia.org/wiki/Umask; https://github.com/rust-lang/cargo/commit/d78bbf4bde3c6b95caca7512f537c6f9721426ff; https://github.com/rust-lang/cargo/pull/12443
CVE: CVE-2023-38686
Published: 2023-08-04
Description: Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes  Sydent's emails vulnerable to interception via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network can intercept room invitations and address confirmation emails. This is patched in Sydent 2.5.6. When patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. Those who use self-signed certificates should make sure to copy their Certification Authority certificate, or their self signed certificate if using only one, to the trust store of your operating system. As a workaround, one can ensure Sydent's emails fail to send by setting the configured SMTP server to a loopback or non-routable address under one's control which does not have a listening SMTP server.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-295
References: https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations; https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261; https://github.com/matrix-org/sydent/pull/574
CVE: CVE-2023-38964
Published: 2023-08-04
Description: Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://vida03.gitbook.io/redteam/web/cve-2023-38964; https://vida03.gitbook.io/redteam/web/cve-2023-38964
CVE: CVE-2022-41401
Published: 2023-08-04
Description: OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/OpenRefine/OpenRefine/blob/30d6edb7b6586623bda09456c797c35983fb80ff/main/tests/server/src/com/google/refine/importing/ImportingUtilitiesTests.java#L180; https://github.com/OpenRefine/OpenRefine/blob/cb55cdfdf6f9ca916839778dc847cce803688998/main/src/com/google/refine/importing/ImportingUtilities.java#L103; https://github.com/ixSly/CVE-2022-41401
CVE: CVE-2023-38688
Published: 2023-08-04
Description: twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23; https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a; https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx
CVE: CVE-2023-38689
Published: 2023-08-04
Description: Logistics Pipes is a modification (a.k.a. mod) for the computer game Minecraft Java Edition. The mod used Java's `ObjectInputStream#readObject` on untrusted data coming from clients or servers over the network resulting in possible remote code execution when sending specifically crafted network packets after connecting. The affected versions were released between 2013 and 2016 and the issue (back then unknown) was fixed in 2016 by a refactoring of the network IO code.  
The issue is present in all Logistics Pipes versions ranged from 0.7.0.91 prior to 0.10.0.71, which were downloaded from different platforms summing up to multi-million downloads. For Minecraft version 1.7.10 the issue was fixed in build 0.10.0.71. Everybody on Minecraft 1.7.10 should check their version number of Logistics Pipes in their modlist and update, if the version number is smaller than 0.10.0.71. Any newer supported Minecraft version (like 1.12.2) never had a Logistics Pipes version with vulnerable code. The best available workaround for vulnerable versions is to play in singleplayer only or update to newer Minecraft versions and modpacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://github.com/RS485/LogisticsPipes/commit/39a90b8f2d1a2bcc512ec68c3e139f1dac07aa56; https://github.com/RS485/LogisticsPipes/commit/527c4f4fb028e9afab29d4e639935010ad7be9e7; https://github.com/RS485/LogisticsPipes/security/advisories/GHSA-mcp7-xf3v-25x3
CVE: CVE-2023-38690
Published: 2023-08-04
Description: matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-77
References: https://github.com/matrix-org/matrix-appservice-irc/commit/0afb064635d37e039067b5b3d6423448b93026d3; https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1; https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-3pmj-jqqp-2mj3
CVE: CVE-2023-38691
Published: 2023-08-04
Description: matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library does not check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests. Versions 8.1.2 and 9.0.1 contain a patch. As a workaround, disable the provisioning API.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://github.com/matrix-org/matrix-appservice-bridge/commit/4c6723a5e7beda65cdf1ae5dbb882e8beaac8552; https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-vc7j-h8xg-fv5x; https://github.com/matrix-org/matrix-appservice-bridge/commit/4c6723a5e7beda65cdf1ae5dbb882e8beaac8552
CVE: CVE-2023-39112
Published: 2023-08-04
Description: ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://github.com/Luci4n555/vul_report/blob/master/vul_1.md; https://vuldb.com/zh/?id.236164; https://github.com/Luci4n555/vul_report/blob/master/vul_1.md
CVE: CVE-2023-39143
Published: 2023-08-04
Description: PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/; https://www.papercut.com/kb/Main/securitybulletinjuly2023/; https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/
CVE: CVE-2023-0264
Published: 2023-08-04
Description: A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: https://access.redhat.com/security/cve/CVE-2023-0264; https://access.redhat.com/security/cve/CVE-2023-0264
CVE: CVE-2023-33372
Published: 2023-08-04
Description: Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacker who gained access to these credentials is able to connect to the MQTT broker and send messages on behalf of devices, impersonating them. in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33372; https://www.connectedio.com/products/routers; https://claroty.com/team82/disclosure-dashboard/cve-2023-33372
CVE: CVE-2023-33373
Published: 2023-08-04
Description: Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-312
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33373; https://www.connectedio.com/products/routers; https://claroty.com/team82/disclosure-dashboard/cve-2023-33373
CVE: CVE-2023-33374
Published: 2023-08-04
Description: Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices OS commands to execute, resulting in arbitrary remote command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33374; https://www.connectedio.com/products/routers; https://claroty.com/team82/disclosure-dashboard/cve-2023-33374
CVE: CVE-2023-33375
Published: 2023-08-04
Description: Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take control over devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33375; https://www.connectedio.com/products/routers; https://claroty.com/team82/disclosure-dashboard/cve-2023-33375
CVE: CVE-2023-33376
Published: 2023-08-04
Description: Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33376; https://www.connectedio.com/products/routers; https://claroty.com/team82/disclosure-dashboard/cve-2023-33376
CVE: CVE-2023-33377
Published: 2023-08-04
Description: Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers to execute arbitrary OS commands on devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33377; https://www.connectedio.com/products/routers; https://claroty.com/team82/disclosure-dashboard/cve-2023-33377
CVE: CVE-2023-33378
Published: 2023-08-04
Description: Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33378; https://www.connectedio.com/products/routers; https://claroty.com/team82/disclosure-dashboard/cve-2023-33378
CVE: CVE-2023-33379
Published: 2023-08-04
Description: Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's devices.
CVSS Score: 9.8 (CRITICAL)
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33379; https://www.connectedio.com/products/routers; https://claroty.com/team82/disclosure-dashboard/cve-2023-33379
CVE: CVE-2023-38332
Published: 2023-08-04
Description: Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure.
CVSS Score: 6.5 (MEDIUM)
References: https://manageengine.com; https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-38332.html; https://manageengine.com
CVE: CVE-2023-38692
Published: 2023-08-04
Description: CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installation function in module management. The vulnerability has been fixed in v1.3.1. There are no known workarounds aside from upgrading.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/blob/v1.3.0/framework/management-center/backend/src/main/java/com/fit2cloud/controller/ModuleManageController.java; https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/releases/tag/v1.3.1; https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-7wrc-f42m-9v5w
CVE: CVE-2023-38695
Published: 2023-08-04
Description: cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in version 8.0.2.



CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/simonsmith/cypress-image-snapshot/commit/ef49519795daf5183f4fac6f3136e194f20f39f4; https://github.com/simonsmith/cypress-image-snapshot/issues/15; https://github.com/simonsmith/cypress-image-snapshot/releases/tag/8.0.2
CVE: CVE-2023-38697
Published: 2023-08-04
Description: protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a string of hex digits and should split from chunk data using CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors while disobey the corresponding RFCs: accepting Content-Length header values that have `+` prefix, accepting Content-Length header values that written in hexadecimal with `0x` prefix, accepting `0x` and `+` prefixed chunk size, and accepting LF in chunk extension. This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. This issue is fixed in `protocol-http1` v0.15.1. There are no known workarounds.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-444
References: https://github.com/socketry/protocol-http1/commit/e11fc164fd2b36f7b7e785e69fa8859eb06bcedd; https://github.com/socketry/protocol-http1/pull/20; https://github.com/socketry/protocol-http1/security/advisories/GHSA-6jwc-qr2q-7xwj