deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-20268
Published: 2023-09-27
Description: A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resources on an affected device.&nbsp;

This vulnerability is due to insufficient management of resources when handling certain types of traffic. An attacker could exploit this vulnerability by sending a series of specific wireless packets to an affected device. A successful exploit could allow the attacker to consume resources on an affected device. A sustained attack could lead to the disruption of the Control and Provisioning of Wireless Access Points (CAPWAP) tunnel and intermittent loss of wireless client traffic.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-dos-capwap-DDMCZS4m; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-dos-capwap-DDMCZS4m
CVE: CVE-2023-42822
Published: 2023-09-27
Description: xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/neutrinolabs/xrdp/commit/73acbe1f7957c65122b00de4d6f57a8d0d257c40; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2hjx-rm4f-r9hw; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FPGA4M7IYCP7OILDF2ZJEVSXUOFEFQ6/
CVE: CVE-2023-5184
Published: 2023-09-27
Description: Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.
CVSS Score: 7.0 (HIGH)
CWE: CWE-120, CWE-195, CWE-120, CWE-681
References: http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html; http://seclists.org/fulldisclosure/2023/Nov/1; http://www.openwall.com/lists/oss-security/2023/11/07/1
CVE: CVE-2023-33972
Published: 2023-09-27
Description: Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://github.com/scylladb/scylladb/security/advisories/GHSA-ww5v-p45p-3vhq; https://github.com/scylladb/scylladb/security/advisories/GHSA-ww5v-p45p-3vhq
CVE: CVE-2023-43650
Published: 2023-09-27
Description: JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code, ranging from 000000 to 999999, to facilitate the password reset. Although the code is only available in 1 minute, this window potentially allows for up to 1,000,000 validation attempts. This issue has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-640, CWE-640
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-mwx4-8fwc-2xvw; https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-mwx4-8fwc-2xvw
CVE: CVE-2023-43652
Published: 2023-09-27
Description: JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and should not used as an authentication secret alone. JumpServer provides an API for the KoKo component to validate user private key logins. This API does not verify the source of requests and will generate a personal authentication token. Given that public keys can be easily leaked, an attacker can exploit the leaked public key and username to authenticate, subsequently gaining access to the current user's information and authorized actions. This issue has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862, CWE-862
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-fr8h-xh5x-r8g9; https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-fr8h-xh5x-r8g9
CVE: CVE-2023-4523
Published: 2023-09-27
Description: 
Real Time Automation 460 Series products with versions prior to v8.9.8 are vulnerable to cross-site scripting, which could allow an attacker to run any JavaScript reference from the URL string. If this were to occur, the gateway's HTTP interface would redirect to the main page, which is index.htm.


CVSS Score: 9.4 (CRITICAL)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-01
CVE: CVE-2023-44047
Published: 2023-09-27
Description: Sourcecodester Toll Tax Management System v1 is vulnerable to SQL Injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/xcodeOn1/SQLI-TollTax/blob/main/README.md; https://github.com/xcodeOn1/xcode0x-CVEs/blob/main/CVE/CVE-2023-44047.md; https://github.com/xcodeOn1/SQLI-TollTax/blob/main/README.md
CVE: CVE-2023-44048
Published: 2023-09-27
Description: Sourcecodester Expense Tracker App v1 is vulnerable to Cross Site Scripting (XSS) via add category.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/xcodeOn1/XSS-Stored-Expense-Tracker-App/tree/main; https://github.com/xcodeOn1/xcode0x-CVEs/blob/main/CVE/CVE-2023-44048.md; https://github.com/xcodeOn1/XSS-Stored-Expense-Tracker-App/tree/main
CVE: CVE-2023-40026
Published: 2023-09-27
Description: Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 (starting at least in v0.1.0, but likely in any version using Helm before 2.3), using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was possible because Helm paths were predictable. The vulnerability worked by adding a Helm chart that referenced Helm resources from predictable paths. Because the paths of Helm charts were predictable and available on an instance of repo-server, it was possible to reference and then render the values and resources from other existing Helm charts regardless of permissions. While generally, secrets are not stored in these files, it was nevertheless possible to reference any values from these charts. This issue was fixed in Argo CD 2.3 and subsequent versions by randomizing Helm paths. User's still using Argo CD 2.3 or below are advised to update to a supported version. If this is not possible, disabling Helm chart rendering, or using an additional repo-server for each Helm chart would prevent possible exploitation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://argo-cd.readthedocs.io/en/stable/operator-manual/installation/#supported-versions; https://github.com/argoproj/argo-cd/security/advisories/GHSA-6jqw-jwf5-rp8h; https://argo-cd.readthedocs.io/en/stable/operator-manual/installation/#supported-versions
CVE: CVE-2023-42818
Published: 2023-09-27
Description: JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287, CWE-307
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-jv3c-27cv-w8jv; https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-jv3c-27cv-w8jv
CVE: CVE-2023-43651
Published: 2023-09-27
Description: JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands. This vulnerability has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-4r5x-x283-wm96; https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-4r5x-x283-wm96
CVE: CVE-2023-43656
Published: 2023-09-27
Description: matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have `generic.allowJsTransformationFunctions` in their config), may be vulnerable to an attack where it is possible to break out of the `vm2` sandbox and as a result Hookshot will be vulnerable to this. This problem is only likely to affect users who have allowed untrusted users to apply their own transformation functions. If you have only enabled a limited set of trusted users, this threat is reduced (though not eliminated). Version 4.5.0 and above of hookshot include a new sandbox library which should better protect users. Users are advised to upgrade. Users unable to upgrade should disable `generic.allowJsTransformationFunctions` in the config.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-74
References: https://github.com/matrix-org/matrix-hookshot/commit/dc126afa6af86d66aefcd23a825326f405bcc894; https://github.com/matrix-org/matrix-hookshot/security/advisories/GHSA-fr97-pv6w-4cj6; https://github.com/matrix-org/matrix-hookshot/commit/dc126afa6af86d66aefcd23a825326f405bcc894
CVE: CVE-2023-4066
Published: 2023-09-27
Description: A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-313, CWE-312
References: https://access.redhat.com/errata/RHSA-2023:4720; https://access.redhat.com/security/cve/CVE-2023-4066; https://bugzilla.redhat.com/show_bug.cgi?id=2224677
CVE: CVE-2023-43192
Published: 2023-09-27
Description: SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL statements. Attackers can use this vulnerability to execute any SQL statement.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/etn0tw/cve_sql/blob/main/jfinalcms_sql.md; https://github.com/etn0tw/cve_sql/blob/main/springbootcms_sql.md; https://github.com/etn0tw/cve_sql/blob/main/jfinalcms_sql.md
CVE: CVE-2023-43660
Published: 2023-09-27
Description: Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287, CWE-347
References: https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63; https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8; https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63
CVE: CVE-2023-44080
Published: 2023-09-27
Description: An issue in PGYER codefever v.2023.8.14-2ce4006 allows a remote attacker to execute arbitrary code via a crafted request to the branchList component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://gist.github.com/one-pyy/330548f740415dff49f59d56e14b4219; https://github.com/advisories/GHSA-cjp8-pj2w-v99h; https://gist.github.com/one-pyy/330548f740415dff49f59d56e14b4219
CVE: CVE-2023-41445
Published: 2023-09-27
Description: Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the index.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://ajaxnewsticker.com; http://phpkobo.com; https://gist.github.com/RNPG/84cac1b949bab0e4c587a668385b052d
CVE: CVE-2023-41448
Published: 2023-09-27
Description: Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the ID parameter in the index.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://ajaxnewsticker.com; http://phpkobo.com; https://gist.github.com/RNPG/458e17f24ebf7d8af3c5c4d7073347a0
CVE: CVE-2023-41449
Published: 2023-09-27
Description: An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: http://ajaxnewsticker.com; http://phpkobo.com; https://gist.github.com/RNPG/c1ae240f2acec138132aa64ce3faa2e0
CVE: CVE-2023-41451
Published: 2023-09-27
Description: Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://ajaxnewsticker.com; http://phpkobo.com; https://gist.github.com/RNPG/062cfca2e293a0e7d24f5d55f8db3fde
CVE: CVE-2023-41452
Published: 2023-09-27
Description: Cross Site Request Forgery vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://ajaxnewsticker.com; http://phpkobo.com; https://gist.github.com/RNPG/32be1c4bae6f9378d4f382ba0c92b367
CVE: CVE-2023-41453
Published: 2023-09-27
Description: Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the cmd parameter in the index.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://ajaxnewsticker.com; http://phpkobo.com; https://gist.github.com/RNPG/be2ca92cb1f943d4c340c75fbfc9b783
CVE: CVE-2023-43191
Published: 2023-09-27
Description: SpringbootCMS 1.0 foreground message can be embedded malicious code saved in the database. When users browse the comments, these malicious codes embedded in the HTML will be executed, and the user's browser will be controlled by the attacker, so as to achieve the special purpose of the attacker, such as cookie theft
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/etn0tw/cmscve_test/blob/main/README.md; https://github.com/etn0tw/cmscve_test/blob/main/README.md
CVE: CVE-2023-43233
Published: 2023-09-27
Description: A stored cross-site scripting (XSS) vulnerability in the cms/content/edit component of YZNCMS v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yux1azhengye/mycve/blob/main/YZNCMS%201.3.0%20XSS.pdf; https://github.com/yux1azhengye/mycve/blob/main/YZNCMS%201.3.0%20XSS.pdf
CVE: CVE-2023-43314
Published: 2023-09-27
Description: ** UNSUPPORTED WHEN ASSIGNED **The buffer overflow vulnerability in the Zyxel PMG2005-T20B firmware version V1.00(ABNK.2)b11_C0 could allow an unauthenticated attacker to cause a denial of service condition via a crafted uid.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Rumble00/Rumble/issues/1; https://github.com/Rumble00/Rumble/issues/1
CVE: CVE-2023-43320
Published: 2023-09-27
Description: An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via bypassing the two-factor authentication component.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/176967/Proxmox-VE-7.4-1-TOTP-Brute-Force.html; https://bugzilla.proxmox.com/show_bug.cgi?id=4579; https://bugzilla.proxmox.com/show_bug.cgi?id=4584
CVE: CVE-2023-5244
Published: 2023-09-28
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/commit/1cb846f8f54ff6f5c668f3ae64dd81740a7e8968; https://huntr.dev/bounties/a3bd58ba-ca59-4cba-85d1-799f73a76470; https://github.com/microweber/microweber/commit/1cb846f8f54ff6f5c668f3ae64dd81740a7e8968
CVE: CVE-2023-41444
Published: 2023-09-28
Description: An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privileges via the fun_1400084d0 function in IREC.sys driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://blog.dru1d.ninja/windows-driver-exploit-development-irec-sys-a5eb45093945; https://gist.github.com/dru1d-foofus/1af21179f253879f101c3a8d4f718bf0; https://github.com/magicsword-io/LOLDrivers/blob/main/yaml/d74fdf19-b4b0-4ec2-9c29-4213b064138b.yml
CVE: CVE-2023-41446
Published: 2023-09-28
Description: Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted script to the title parameter in the index.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://ajaxnewsticker.com; http://phpkobo.com; https://gist.github.com/RNPG/4bb91170f8ee50b395427f26bc96a1f2
CVE: CVE-2023-41447
Published: 2023-09-28
Description: Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd parameter in the index.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://ajaxnewsticker.com; http://phpkobo.com; https://gist.github.com/RNPG/56b9fe4dcc3a248d4288bde5ffb3a5b3
CVE: CVE-2023-41450
Published: 2023-09-28
Description: An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://ajaxnewsticker.com; http://phpkobo.com; https://gist.github.com/RNPG/e11af10e1bd3606de8b568033d932589
CVE: CVE-2023-42222
Published: 2023-09-28
Description: WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-Execution-Code-Execution.html; https://github.com/itssixtyn3in/CVE-2023-42222; https://webcatalog.io/changelog/
CVE: CVE-2023-38870
Published: 2023-09-28
Description: A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38870; https://github.com/gugoan/economizzer; https://www.economizzer.org
CVE: CVE-2023-38871
Published: 2023-09-28
Description: The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38871; https://github.com/gugoan/economizzer; https://www.economizzer.org
CVE: CVE-2023-38872
Published: 2023-09-28
Description: An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.
CVSS Score: 3.7 (LOW)
CWE: CWE-639
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38872; https://github.com/gugoan/economizzer; https://www.economizzer.org
CVE: CVE-2023-38873
Published: 2023-09-28
Description: The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38873; https://github.com/gugoan/economizzer; https://www.economizzer.org
CVE: CVE-2023-38874
Published: 2023-09-28
Description: A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38874; https://github.com/gugoan/economizzer; https://www.economizzer.org
CVE: CVE-2023-38877
Published: 2023-09-28
Description: A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38877; https://github.com/gugoan/economizzer/; https://www.economizzer.org