deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-42405
Published: 2023-09-14
Description: SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalService.list(), and switchService.list().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/fit2cloud/rackshift/issues/79; https://github.com/fit2cloud/rackshift/issues/79
CVE: CVE-2023-39639
Published: 2023-09-15
Description: LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/fr/2_community-developer?contributor=190902&id_category=3; https://security.friendsofpresta.org/modules/2023/08/31/leoblog.html; https://addons.prestashop.com/fr/2_community-developer?contributor=190902&id_category=3
CVE: CVE-2023-39641
Published: 2023-09-15
Description: Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/fr/referencement-payant-affiliation/26226-full-affiliates.html; https://security.friendsofpresta.org/modules/2023/08/31/psaffiliate.html; https://addons.prestashop.com/fr/referencement-payant-affiliation/26226-full-affiliates.html
CVE: CVE-2023-39642
Published: 2023-09-15
Description: Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/fr/remarketing-paniers-abandonnes/22077-carts-guru-marketing-automation-multicanal.html; https://security.friendsofpresta.org/modules/2023/08/29/cartsguru.html; https://addons.prestashop.com/fr/remarketing-paniers-abandonnes/22077-carts-guru-marketing-automation-multicanal.html
CVE: CVE-2023-40955
Published: 2023-09-15
Description: A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the select parameter in models/base_client.py component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/luvsn/OdZoo/tree/main/exploits/pdm/2; https://github.com/luvsn/OdZoo/tree/main/exploits/pdm/2
CVE: CVE-2023-40956
Published: 2023-09-15
Description: A SQL injection vulnerability in Cloudroits Website Job Search v.15.0 allows a remote authenticated attacker to execute arbitrary code via the name parameter in controllers/main.py component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/luvsn/OdZoo/tree/main/exploits/website_job_search; https://github.com/luvsn/OdZoo/tree/main/exploits/website_job_search
CVE: CVE-2023-40957
Published: 2023-09-15
Description: A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the request parameter in models/base_client.py component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/luvsn/OdZoo/tree/main/exploits/pdm/3; https://github.com/luvsn/OdZoo/tree/main/exploits/pdm/3
CVE: CVE-2023-40958
Published: 2023-09-15
Description: A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the query parameter in models/base_client.py component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/luvsn/OdZoo/tree/main/exploits/pdm/1; https://github.com/luvsn/OdZoo/tree/main/exploits/pdm/1
CVE: CVE-2023-4680
Published: 2023-09-15
Description: HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-323, CWE-20
References: https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249; https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249
CVE: CVE-2023-39643
Published: 2023-09-15
Description: Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/en/data-import-export/5732-xml-feeds-pro.html; https://security.friendsofpresta.org/modules/2023/08/29/xmlfeeds.html; https://addons.prestashop.com/en/data-import-export/5732-xml-feeds-pro.html
CVE: CVE-2023-40984
Published: 2023-09-15
Description: A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://webmin.com; https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40984; http://webmin.com
CVE: CVE-2023-40985
Published: 2023-09-15
Description: An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when any file is searched/replaced.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://webmin.com; https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40985; http://webmin.com
CVE: CVE-2023-40986
Published: 2023-09-15
Description: A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted payload injected into the Custom field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://webmin.com; https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40986; http://webmin.com
CVE: CVE-2023-4977
Published: 2023-09-15
Description:  Code Injection in GitHub repository librenms/librenms prior to 23.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: https://github.com/librenms/librenms/commit/1194934d31c795a3f6877a96ffaa34b1f475bdd0; https://huntr.dev/bounties/3db8a1a4-ca2d-45df-be18-a959ebf82fbc; https://github.com/librenms/librenms/commit/1194934d31c795a3f6877a96ffaa34b1f475bdd0
CVE: CVE-2023-4978
Published: 2023-09-15
Description: Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/e4c46a45364cb944b94abf9b83f0558b2c4c2fb7; https://huntr.dev/bounties/cefd9295-2053-4e6e-a130-7e1f845728f4; https://github.com/librenms/librenms/commit/e4c46a45364cb944b94abf9b83f0558b2c4c2fb7
CVE: CVE-2023-4979
Published: 2023-09-15
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/librenms/librenms/commit/49d66fa31b43acef02eaa09ee9af15fe7e16cd03; https://huntr.dev/bounties/e67f8f5d-4048-404f-9b86-cb6b8719b77f; https://github.com/librenms/librenms/commit/49d66fa31b43acef02eaa09ee9af15fe7e16cd03
CVE: CVE-2023-4980
Published: 2023-09-15
Description: Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/cfd642be6a1e988453bd63069d17db3664e7de97; https://huntr.dev/bounties/470b9b13-b7fe-4b3f-a186-fdc5dc193976; https://github.com/librenms/librenms/commit/cfd642be6a1e988453bd63069d17db3664e7de97
CVE: CVE-2023-4981
Published: 2023-09-15
Description: Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/03c4da62c8acde0a82acbb4a445ae866ebfdd3f7; https://huntr.dev/bounties/1f014494-49a9-4bf0-8d43-a675498b9609; https://github.com/librenms/librenms/commit/03c4da62c8acde0a82acbb4a445ae866ebfdd3f7
CVE: CVE-2023-4982
Published: 2023-09-15
Description: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/2c5960631c49f7414f61b6d4dcd305b07da05769; https://huntr.dev/bounties/d3c2dd8a-883c-400e-a1a7-326c3fd37b9e; https://github.com/librenms/librenms/commit/2c5960631c49f7414f61b6d4dcd305b07da05769
CVE: CVE-2023-4973
Published: 2023-09-15
Description: A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely. The identifier VDB-239749 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/174680/Academy-LMS-6.2-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.239749; https://vuldb.com/?id.239749
CVE: CVE-2022-20917
Published: 2023-09-15
Description: A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attacker to manipulate the content of XMPP messages that are used by the affected application.
 This vulnerability is due to the improper handling of nested XMPP messages within requests that are sent to the Cisco Jabber client software. An attacker could exploit this vulnerability by connecting to an XMPP messaging server and sending crafted XMPP messages to an affected Jabber client. A successful exploit could allow the attacker to manipulate the content of XMPP messages, possibly allowing the attacker to cause the Jabber client application to perform unsafe actions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM
CVE: CVE-2023-3891
Published: 2023-09-15
Description: Race condition in Lapce v0.2.8 allows an attacker to elevate privileges on the system
CVSS Score: 7.3 (HIGH)
CWE: CWE-367, CWE-367
References: https://fluidattacks.com/advisories/aerosmith; https://github.com/lapce/lapce/releases/tag/v0.3.0; https://lapce.dev
CVE: CVE-2023-40982
Published: 2023-09-15
Description: A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://webmin.com; https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40982; http://webmin.com
CVE: CVE-2023-4963
Published: 2023-09-15
Description: The WS Facebook Like Box Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ws-facebook-likebox/trunk/includes/shortcodes.php#L22; https://www.wordfence.com/threat-intel/vulnerabilities/id/8bebc229-9d15-439f-a8df-f68455bc5193?source=cve; https://plugins.trac.wordpress.org/browser/ws-facebook-likebox/trunk/includes/shortcodes.php#L22
CVE: CVE-2023-4974
Published: 2023-09-15
Description: A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument price_min/price_max leads to sql injection. The attack may be launched remotely. VDB-239750 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/174681/Academy-LMS-6.2-SQL-Injection.html; https://vuldb.com/?ctiid.239750; https://vuldb.com/?id.239750
CVE: CVE-2023-38039
Published: 2023-09-15
Description: When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API.

However, curl did not have a limit in how many or how large headers it would
accept in a response, allowing a malicious server to stream an endless series
of headers and eventually cause curl to run out of heap memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: http://seclists.org/fulldisclosure/2023/Oct/17; http://seclists.org/fulldisclosure/2024/Jan/34; http://seclists.org/fulldisclosure/2024/Jan/37
CVE: CVE-2023-40983
Published: 2023-09-15
Description: A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Find in Results file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://webmin.com; https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40983; http://webmin.com
CVE: CVE-2023-36658
Published: 2023-09-15
Description: An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://docs.opswat.com/mdkiosk; https://docs.opswat.com/mdkiosk/release-notes/cve-2023-36658; https://docs.opswat.com/mdkiosk
CVE: CVE-2023-36657
Published: 2023-09-15
Description: An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://docs.opswat.com/mdkiosk; https://docs.opswat.com/mdkiosk/release-notes/cve-2023-36657; https://docs.opswat.com/mdkiosk
CVE: CVE-2023-36659
Published: 2023-09-15
Description: An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://docs.opswat.com/mdkiosk; https://docs.opswat.com/mdkiosk/release-notes/cve-2023-36659; https://docs.opswat.com/mdkiosk
CVE: CVE-2023-3378
Published: 2023-09-15
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-4673
Published: 2023-09-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanalogy Turasistan allows SQL Injection.This issue affects Turasistan: before 20230911 .


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0528; https://www.usom.gov.tr/bildirim/tr-23-0528
CVE: CVE-2023-4830
Published: 2023-09-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tura Signalix allows SQL Injection.This issue affects Signalix: 7T_0228.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0529; https://www.usom.gov.tr/bildirim/tr-23-0529
CVE: CVE-2023-32461
Published: 2023-09-15
Description: 
Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability.  A local malicious user with high privileges could potentially exploit this vulnerability, leading to corrupt memory and potentially escalate privileges.  


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-122
References: https://www.dell.com/support/kbdoc/en-us/000216543/dsa-2023-292-security-update-for-dell-poweredge-server-bios-vulnerability; https://www.dell.com/support/kbdoc/en-us/000216543/dsa-2023-292-security-update-for-dell-poweredge-server-bios-vulnerability
CVE: CVE-2023-4231
Published: 2023-09-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cevik Informatics Online Payment System allows SQL Injection.This issue affects Online Payment System: before 4.09.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0532; https://www.usom.gov.tr/bildirim/tr-23-0532
CVE: CVE-2023-4670
Published: 2023-09-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection.This issue affects Probbys: before 2.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0531; https://www.usom.gov.tr/bildirim/tr-23-0531
CVE: CVE-2023-4831
Published: 2023-09-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncode Ncep allows SQL Injection.This issue affects Ncep: before 20230914 .


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0529-2; https://www.usom.gov.tr/bildirim/tr-23-0529-2
CVE: CVE-2023-4661
Published: 2023-09-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection.This issue affects Saphira Connect: before 9.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0535; https://www.usom.gov.tr/bildirim/tr-23-0535
CVE: CVE-2023-4662
Published: 2023-09-15
Description: Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion.This issue affects Saphira Connect: before 9.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-250, CWE-269
References: https://www.usom.gov.tr/bildirim/tr-23-0535; https://www.usom.gov.tr/bildirim/tr-23-0535
CVE: CVE-2023-4663
Published: 2023-09-15
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS.This issue affects Saphira Connect: before 9.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0535; https://www.usom.gov.tr/bildirim/tr-23-0535
CVE: CVE-2023-4664
Published: 2023-09-15
Description: Incorrect Default Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation.This issue affects Saphira Connect: before 9.


CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://www.usom.gov.tr/bildirim/tr-23-0535; https://www.usom.gov.tr/bildirim/tr-23-0535
CVE: CVE-2023-4665
Published: 2023-09-15
Description: Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation.This issue affects Saphira Connect: before 9.


CVSS Score: 8.8 (HIGH)
CWE: CWE-279, CWE-732
References: https://www.usom.gov.tr/bildirim/tr-23-0535; https://www.usom.gov.tr/bildirim/tr-23-0535
CVE: CVE-2023-4833
Published: 2023-09-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Besttem Network Marketing Software allows SQL Injection.This issue affects Network Marketing Software: before 1.0.2309.6.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0533; https://www.usom.gov.tr/bildirim/tr-23-0533
CVE: CVE-2023-4835
Published: 2023-09-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CF Software Oil Management Software allows SQL Injection.This issue affects Oil Management Software: before 20230912 .


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0533; https://www.usom.gov.tr/bildirim/tr-23-0533
CVE: CVE-2023-4959
Published: 2023-09-15
Description: A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the victim’s browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance (including adding users with admin privileges).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://access.redhat.com/security/cve/CVE-2023-4959; https://bugzilla.redhat.com/show_bug.cgi?id=2238908; https://access.redhat.com/security/cve/CVE-2023-4959
CVE: CVE-2022-3466
Published: 2023-09-15
Description: The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details, see https://access.redhat.com/security/cve/CVE-2022-27652.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://access.redhat.com/errata/RHSA-2022:7398; https://access.redhat.com/security/cve/CVE-2022-3466; https://bugzilla.redhat.com/show_bug.cgi?id=2134063
CVE: CVE-2023-42270
Published: 2023-09-15
Description: Grocy <= 4.0.2 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/176958/Grocy-4.0.2-Cross-Site-Request-Forgery.html; http://xploit.sh/posts/cve-2023-xxxxx/; http://packetstormsecurity.com/files/176958/Grocy-4.0.2-Cross-Site-Request-Forgery.html
CVE: CVE-2023-4983
Published: 2023-09-15
Description: A vulnerability was found in app1pro Shopicial up to 20230830. It has been declared as problematic. This vulnerability affects unknown code of the file search. The manipulation of the argument from with the input comments</script>'"><img src=x onerror=alert(document.cookie)> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239794 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://vuldb.com/?ctiid.239794; https://vuldb.com/?id.239794; https://vuldb.com/?ctiid.239794
CVE: CVE-2023-4984
Published: 2023-09-15
Description: A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/admin/v3/security/user/1. The manipulation leads to unprotected storage of credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239795.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-256
References: https://github.com/didi/KnowSearch/files/12135597/ad1aa7b3-ecee-44b0-a22a-80917ca0fe71.pdf[PII_REDACTED]801712312.pdf; https://github.com/didi/KnowSearch/issues/86; https://vuldb.com/?ctiid.239795