deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-31116
Published: 2023-06-07
Description: An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. An incorrect default permission can cause unintended querying of RCS capability via a crafted application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276, CWE-276
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-33496
Published: 2023-06-07
Description: xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecode#decode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/edirc-wong/record/blob/main/deserialization_vulnerability_report.md; https://github.com/edirc-wong/record/blob/main/deserialization_vulnerability_report.md
CVE: CVE-2023-33556
Published: 2023-06-07
Description: TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Am1ngl/ttt/tree/main/37; https://github.com/Am1ngl/ttt/tree/main/37
CVE: CVE-2023-33848
Published: 2023-06-07
Description: IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could allow a privileged user to obtain highly sensitive information by enabling debug mode.  IBM X-Force ID:  257104.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257104; https://www.ibm.com/support/pages/node/7001647; https://www.ibm.com/support/pages/node/7001681
CVE: CVE-2023-24476
Published: 2023-06-07
Description: 
An attacker with local access to the machine could record the traffic, 
which could allow them to resend requests without the server 
authenticating that the user or session are valid.


CVSS Score: 1.8 (LOW)
CWE: CWE-285
References: https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
CVE: CVE-2023-27881
Published: 2023-06-07
Description: 


A user could use the “Upload Resource” functionality to upload files to any location on the disk.


CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
CVE: CVE-2023-29152
Published: 2023-06-07
Description: 

By changing the filename parameter in the request, an attacker could 
delete any file with the permissions of the Vuforia server account.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-285
References: https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
CVE: CVE-2023-29168
Published: 2023-06-07
Description: The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.


CVSS Score: 3.7 (LOW)
CWE: CWE-522
References: https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
CVE: CVE-2023-29502
Published: 2023-06-07
Description: 



Before importing a project into Vuforia, a user could modify the 
“resourceDirectory” attribute in the appConfig.json file to be a 
different path.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22
References: https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
CVE: CVE-2023-2904
Published: 2023-06-07
Description: The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmable interface (API). An attacker could log in using account credentials available through a request generated by an internal user and then manipulate the visitor-id within the web API to access the personal data of other users. There is no limit on the number of requests that can be made to the HID SAFE Web Server, so an attacker could also exploit this vulnerability to create a denial-of-service condition.


CVSS Score: 7.3 (HIGH)
CWE: CWE-471
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-02
CVE: CVE-2023-31200
Published: 2023-06-07
Description: 




PTC Vuforia Studio does not require a token; this could allow an 
attacker with local access to perform a cross-site request forgery 
attack or a replay attack.


CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13; https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
CVE: CVE-2023-33849
Published: 2023-06-07
Description: IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could transmit sensitive information in query parameters that could be intercepted using man in the middle techniques.  IBM X-Force ID:  257105.
CVSS Score: 3.7 (LOW)
CWE: CWE-311, CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257105; https://www.ibm.com/support/pages/node/7001687; https://www.ibm.com/support/pages/node/7001695
CVE: CVE-2023-34238
Published: 2023-06-08
Description: Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the `__file-code-frame` and `__original-stack-frame` paths, exposed when running the Gatsby develop server (`gatsby develop`). Any file in scope of the development server could potentially be exposed. It should be noted that by default `gatsby develop` is only accessible via the localhost `127.0.0.1`, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as `--host 0.0.0.0`, `-H 0.0.0.0`, or the `GATSBY_HOST=0.0.0.0` environment variable. A patch has been introduced in `gatsby@5.9.1` and `gatsby@4.25.7` which mitigates the issue. Users are advised to upgrade. Users unable to upgrade should avoid exposing their development server to the internet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/gatsbyjs/gatsby/commit/ae5a654eb346b2e7a9d341b809b2f82d34c0f17c; https://github.com/gatsbyjs/gatsby/commit/fc22f4ba3ad7ca5fb3592f38f4f0ca8ae60b4bf7; https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-c6f8-8r25-c4gc
CVE: CVE-2023-34239
Published: 2023-06-08
Description: Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in version 3.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://github.com/gradio-app/gradio/pull/4370; https://github.com/gradio-app/gradio/pull/4406; https://github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695
CVE: CVE-2023-33846
Published: 2023-06-08
Description: IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  257100.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257100; https://www.ibm.com/support/pages/node/7001601; https://www.ibm.com/support/pages/node/7001629
CVE: CVE-2023-33847
Published: 2023-06-08
Description: 
IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 257102.


CVSS Score: 3.7 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257102; https://www.ibm.com/support/pages/node/7001635; https://www.ibm.com/support/pages/node/7001641
CVE: CVE-2023-23480
Published: 2023-06-08
Description: IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  245885.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/245885; https://www.ibm.com/support/pages/node/7001563; https://exchange.xforce.ibmcloud.com/vulnerabilities/245885
CVE: CVE-2023-23481
Published: 2023-06-08
Description: IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  245889.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/245889; https://www.ibm.com/support/pages/node/7001561; https://exchange.xforce.ibmcloud.com/vulnerabilities/245889
CVE: CVE-2023-23482
Published: 2023-06-08
Description: IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.  IBM X-Force ID:  245891.
CVSS Score: 5.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/245891; https://www.ibm.com/support/pages/node/7001569; https://exchange.xforce.ibmcloud.com/vulnerabilities/245891
CVE: CVE-2023-2986
Published: 2023-06-08
Description: The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://github.com/Ayantaker/CVE-2023-2986; https://github.com/TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment[PII_REDACTED]; https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php#L1815
CVE: CVE-2023-34969
Published: 2023-06-08
Description: D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://gitlab.freedesktop.org/dbus/dbus/-/issues/457; https://lists.debian.org/debian-lts-announce/2023/10/msg00033.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZYCDRMD7B4XO4HF6C6YTLH4YUD7TANP/
CVE: CVE-2023-33658
Published: 2023-06-08
Description: A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_msg_get_pub_pid() in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/emqx/nanomq; https://github.com/emqx/nanomq/issues/1153; https://github.com/nanomq/NanoNNG/commit/657e6c81c474bdee0e6413483b990e90610030c1
CVE: CVE-2023-33660
Published: 2023-06-08
Description: A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function copyn_str() in the file mqtt_parser.c. An attacker could exploit this vulnerability to cause a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/emqx/nanomq; https://github.com/emqx/nanomq/issues/1155; https://github.com/nanomq/NanoNNG/pull/509/commits/6815c4036a2344865da393803ecdb7af27d8bde1
CVE: CVE-2023-33657
Published: 2023-06-08
Description: A use-after-free vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_mqtt_msg_get_publish_property() in the file mqtt_msg.c. This vulnerability is caused by improper data tracing, and an attacker could exploit it to cause a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/emqx/nanomq; https://github.com/emqx/nanomq/issues/1165#issue[PII_REDACTED]; https://github.com/emqx/nanomq/pull/1187
CVE: CVE-2023-33443
Published: 2023-06-08
Description: Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative commands via a crafted payload sent to the desired endpoints.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://gitlab.com/FallFur/exploiting-unprotected-admin-funcionalities-on-besder-ip-cameras/; https://gitlab.com/FallFur/exploiting-unprotected-admin-funcionalities-on-besder-ip-cameras/
CVE: CVE-2023-3163
Published: 2023-06-08
Description: A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of the argument value leads to resource consumption. VDB-231090 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-400, CWE-89
References: https://gitee.com/y_project/RuoYi/issues/I78DOR; https://vuldb.com/?ctiid.231090; https://vuldb.com/?id.231090
CVE: CVE-2023-34566
Published: 2023-06-08
Description: Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter time at /goform/saveParentControlInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/rk8hQf5rh; https://hackmd.io/%400dayResearch/rk8hQf5rh
CVE: CVE-2023-34567
Published: 2023-06-08
Description: Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/H1xUqzfHh; https://hackmd.io/%400dayResearch/H1xUqzfHh
CVE: CVE-2023-34568
Published: 2023-06-08
Description: Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/ryR8IzMH2; https://hackmd.io/%400dayResearch/ryR8IzMH2
CVE: CVE-2023-34569
Published: 2023-06-08
Description: Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/HymuzffSh; https://hackmd.io/%400dayResearch/HymuzffSh
CVE: CVE-2023-34570
Published: 2023-06-08
Description: Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter devName at /goform/SetOnlineDevName.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/S1eI91_l2; https://hackmd.io/%400dayResearch/S1eI91_l2
CVE: CVE-2023-34571
Published: 2023-06-08
Description: Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter shareSpeed at /goform/WifiGuestSet.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/S1GcUxzSn; https://hackmd.io/%400dayResearch/S1GcUxzSn
CVE: CVE-2023-3165
Published: 2023-06-08
Description: A vulnerability was found in SourceCodester Life Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file insertNominee.php of the component POST Parameter Handler. The manipulation of the argument nominee_id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231109 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Hanwengao/CVERequests/blob/main/XSS.md; https://vuldb.com/?ctiid.231109; https://vuldb.com/?id.231109
CVE: CVE-2023-34096
Published: 2023-06-08
Description: Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/172822/Thruk-Monitoring-Web-Interface-3.06-Path-Traversal.html; https://galogetlatorre.blogspot.com/2023/06/cve-2023-34096-path-traversal-thruk.html; https://github.com/galoget/Thruk-CVE-2023-34096
CVE: CVE-2023-34958
Published: 2023-06-08
Description: Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/chamilo/chamilo-lms/commit/0c1c29db18856a6f25e21d0405dda2c20b35ff3a; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-109-2023-04-15-Moderate-impact-Moderate-risk-IDOR-in-workstudent-publication; https://github.com/chamilo/chamilo-lms/commit/0c1c29db18856a6f25e21d0405dda2c20b35ff3a
CVE: CVE-2023-34959
Published: 2023-06-08
Description: An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on the server via crafted requests in the social and links tools.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/chamilo/chamilo-lms/commit/cc278f01864948b1fb160e03f0a3dc0875d5f81f; https://github.com/chamilo/chamilo-lms/commit/ea5791ff8ce6ea45148a171b0da5348a7c415e6f; https://github.com/chamilo/chamilo-lms/commit/ed946908fef23e8aa4cefc28f745f3cd6710099f
CVE: CVE-2023-34961
Published: 2023-06-08
Description: Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/80d1a8c9063a20f286b0195ef537c84a1a11875a; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-105-2023-04-15-Low-impact-Moderate-risk-XSS-in-student-work-comments; https://github.com/chamilo/chamilo-lms/commit/80d1a8c9063a20f286b0195ef537c84a1a11875a
CVE: CVE-2023-34962
Published: 2023-06-08
Description: Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes.
CVSS Score: 8.1 (HIGH)
References: https://github.com/chamilo/chamilo-lms/commit/19af444d2da9e5a60f02b4ebe7755cdff36709cd; https://github.com/chamilo/chamilo-lms/commit/f9a17bfaf05994383bca5f4b65eb6897acc60d41; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-106-2023-04-15-Moderate-impact-Moderate-risk-A-student-can-access-and-modify-another-students-personal-notes
CVE: CVE-2023-32749
Published: 2023-06-08
Description: Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: http://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2023/May/18; https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
CVE: CVE-2023-34231
Published: 2023-06-08
Description: gosnowflake is th Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on (SSO) browser URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. A patch is available in version 1.6.19.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/snowflakedb/gosnowflake/commit/e11a2a555f1b9f7adc1f01fb7b5e7f38fbbb2a1c; https://github.com/snowflakedb/gosnowflake/pull/757; https://github.com/snowflakedb/gosnowflake/security/advisories/GHSA-fwv2-65wh-2w8c
CVE: CVE-2023-0954
Published: 2023-06-08
Description: A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attack.
CVSS Score: 8.3 (HIGH)
CWE: CWE-489
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-159-02; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-23-159-02
CVE: CVE-2023-24535
Published: 2023-06-08
Description: Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/golang/protobuf/issues/1530; https://go.dev/cl/475995; https://pkg.go.dev/vuln/GO-2023-1631