deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-25262
Published: 2023-03-28
Description: Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather than the client. Therefore, the server causes outbound traffic and potentially imports data. An attacker may also leverage this behaviour to exfiltrate data of machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: http://stimulsoft.com; https://cloud-trustit.spp.at/s/HjEksN86SfsMaJM; https://cves.at/posts/cve-2023-25262/writeup/
CVE: CVE-2023-27700
Published: 2023-03-28
Description: MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /accessory/picdel.html.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/MuYuCMS/MuYuCMS/issues/8; https://github.com/MuYuCMS/MuYuCMS/issues/8
CVE: CVE-2022-45825
Published: 2023-03-28
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in iThemes WPComplete plugin <= 2.9.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpcomplete/wordpress-wpcomplete-plugin-2-9-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wpcomplete/wordpress-wpcomplete-plugin-2-9-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-45831
Published: 2023-03-28
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in biplob018 Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 2.8 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/image-hover-effects-with-carousel/wordpress-image-hover-effects-caption-hover-with-carousel-plugin-2-8-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/image-hover-effects-with-carousel/wordpress-image-hover-effects-caption-hover-with-carousel-plugin-2-8-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-46848
Published: 2023-03-28
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin <= 3.9.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/visualizer/wordpress-visualizer-tables-and-charts-manager-for-wordpress-plugin-3-9-2-auth-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/visualizer/wordpress-visualizer-tables-and-charts-manager-for-wordpress-plugin-3-9-2-auth-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-46855
Published: 2023-03-28
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP Darko Responsive Pricing Table plugin <= 5.1.6 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/dk-pricr-responsive-pricing-table/wordpress-responsive-pricing-table-plugin-5-1-6-auth-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dk-pricr-responsive-pricing-table/wordpress-responsive-pricing-table-plugin-5-1-6-auth-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-46863
Published: 2023-03-28
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.6.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/quick-event-manager/wordpress-quick-event-manager-plugin-9-6-4-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/quick-event-manager/wordpress-quick-event-manager-plugin-9-6-4-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-47170
Published: 2023-03-28
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.48 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/unlimited-elements-for-elementor/wordpress-unlimited-elements-for-elementor-plugin-1-5-48-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/unlimited-elements-for-elementor/wordpress-unlimited-elements-for-elementor-plugin-1-5-48-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25704
Published: 2023-03-28
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mehjabin Orthi Interactive SVG Image Map Builder plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/interactive-image-map-builder/wordpress-interactive-svg-image-map-builder-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/interactive-image-map-builder/wordpress-interactive-svg-image-map-builder-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-3682
Published: 2023-03-28
Description: A vulnerability exists in the SDM600 file permission validation. 
An attacker could exploit the vulnerability by gaining access to the system and uploading a specially crafted message to the system node, which could result in Arbitrary code Executing.



This issue affects: All SDM600 versions prior to version 1.2 FP3 HF4 (Build Nr. 1.2.23000.291)

 

List of CPEs:


  *  cpe:2.3:a:hitachienergy:sdm600:1.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.1:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.9002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.10002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.11002.149:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.12002.222:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.13002.72:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.44:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.92:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.108:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.182:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.342:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.447:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.481:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.506:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.566:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.20000.3174:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.291:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.931:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.105:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.23000.291:*:*:*:*:*:*:*





CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2023-25195
Published: 2023-03-28
Description: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract.
Authorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic. 

This issue affects Apache Fineract: from 1.4 through 1.8.3.


CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://lists.apache.org/thread/m58fdjmtkfp9h4c0r4l48rv995w3qhb6; https://lists.apache.org/thread/m58fdjmtkfp9h4c0r4l48rv995w3qhb6
CVE: CVE-2023-25196
Published: 2023-03-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache Fineract.
Authorized users may be able to change or add data in certain components.  

This issue affects Apache Fineract: from 1.4 through 1.8.2.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://lists.apache.org/thread/m9x3vpn3bry4fympkzxnnz4qx0oc0w8m; https://lists.apache.org/thread/m9x3vpn3bry4fympkzxnnz4qx0oc0w8m
CVE: CVE-2023-25197
Published: 2023-03-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation apache fineract.
Authorized users may be able to exploit this for limited impact on components.  

This issue affects apache fineract: from 1.4 through 1.8.2.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://lists.apache.org/thread/v0q9x86sx6f6l2nzr1z0nwm3y9qlng04; https://lists.apache.org/thread/v0q9x86sx6f6l2nzr1z0nwm3y9qlng04
CVE: CVE-2022-3683
Published: 2023-03-28
Description: A vulnerability exists in the SDM600 API web services authorization validation implementation. 
An attacker who successfully exploits the vulnerability could read data directly from a data store that is not restricted, or insufficiently protected, having access to sensitive data.



This issue affects: All SDM600 versions prior to version 1.2 FP3 HF4 (Build Nr. 1.2.23000.291)

 

List of CPEs:


  *  cpe:2.3:a:hitachienergy:sdm600:1.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.1:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.9002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.10002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.11002.149:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.12002.222:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.13002.72:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.44:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.92:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.108:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.182:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.342:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.447:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.481:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.506:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.566:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.20000.3174:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.291:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.931:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.105:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.23000.291:*:*:*:*:*:*:*





CVSS Score: 7.7 (HIGH)
CWE: CWE-285
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2022-3684
Published: 2023-03-28
Description: A vulnerability exists in a SDM600 endpoint.
An attacker could exploit this vulnerability by running multiple parallel requests, the SDM600 web services become busy rendering the application unresponsive.
This issue affects: All SDM600 versions prior to version 1.2 FP3 HF4 (Build Nr. 1.2.23000.291)

 

List of CPEs:


  *  cpe:2.3:a:hitachienergy:sdm600:1.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.1:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.9002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.10002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.11002.149:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.12002.222:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.13002.72:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.44:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.92:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.108:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.182:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.342:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.447:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.481:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.506:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.566:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.20000.3174:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.291:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.931:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.105:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.23000.291:*:*:*:*:*:*:*



CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-404
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2022-3686
Published: 2023-03-28
Description: A vulnerability exists in a SDM600 endpoint.
An attacker could exploit this vulnerability by running multiple parallel requests, the SDM600 web services become busy rendering the application unresponsive.
This issue affects: All SDM600 versions prior to version 1.2 FP3 HF4 (Build Nr. 1.2.23000.291)

 

List of CPEs:


  *  cpe:2.3:a:hitachienergy:sdm600:1.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.1:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.9002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.10002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.11002.149:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.12002.222:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.13002.72:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.44:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.92:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.108:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.182:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.342:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.447:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.481:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.506:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.566:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.20000.3174:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.291:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.931:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.105:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.23000.291:*:*:*:*:*:*:*



CVSS Score: 4.8 (MEDIUM)
CWE: CWE-285
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2022-47529
Published: 2023-03-28
Description: Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.
CVSS Score: 6.7 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Mar/26; http://seclists.org/fulldisclosure/2024/Apr/17; https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935
CVE: CVE-2023-28326
Published: 2023-03-28
Description: Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0

Description: Attacker can elevate their privileges in any room



CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://lists.apache.org/thread/r9vn12dp5yofn1h3wd5x4h7c3vmmr5d9; https://lists.apache.org/thread/r9vn12dp5yofn1h3wd5x4h7c3vmmr5d9
CVE: CVE-2022-3685
Published: 2023-03-28
Description: 
A vulnerability exists in the SDM600 software. The software operates at a privilege level that is higher than the minimum level required. An attacker who successfully exploits this vulnerability can escalate privileges.



This issue affects: All SDM600 versions prior to version 1.3.0.

 

List of CPEs:


  *  cpe:2.3:a:hitachienergy:sdm600:1.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.1:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.9002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.10002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.11002.149:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.12002.222:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.13002.72:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.44:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.92:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.108:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.182:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.257:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.342:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.447:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.481:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.506:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.14002.566:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.20000.3174:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.291:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.931:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.21000.105:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.2.23000.291:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:sdm600:1.3.0.1339:*:*:*:*:*:*:*





CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2023-25260
Published: 2023-03-28
Description: Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: http://stimulsoft.com; https://cloud-trustit.spp.at/s/K9ZXWzEmftaxa3C; https://cves.at/posts/cve-2023-25260/writeup/
CVE: CVE-2023-27701
Published: 2023-03-28
Description: MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /database/sqldel.html.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://github.com/MuYuCMS/MuYuCMS/issues/9; https://github.com/MuYuCMS/MuYuCMS/issues/9
CVE: CVE-2023-0465
Published: 2023-03-28
Description: Applications that use a non-default option when verifying certificates may be
vulnerable to an attack from a malicious CA to circumvent certain checks.

Invalid certificate policies in leaf certificates are silently ignored by
OpenSSL and other certificate policy checks are skipped for that certificate.
A malicious CA could use this to deliberately assert invalid certificate policies
in order to circumvent policy checking on the certificate altogether.

Policy processing is disabled by default but can be enabled by passing
the `-policy' argument to the command line utilities or by calling the
`X509_VERIFY_PARAM_set1_policies()' function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95
CVE: CVE-2023-0466
Published: 2023-03-28
Description: The function X509_VERIFY_PARAM_add0_policy() is documented to
implicitly enable the certificate policy check when doing certificate
verification. However the implementation of the function does not
enable the check which allows certificates with invalid or incorrect
policies to pass the certificate verification.

As suddenly enabling the policy check could break existing deployments it was
decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()
function.

Instead the applications that require OpenSSL to perform certificate
policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly
enable the policy check by calling X509_VERIFY_PARAM_set_flags() with
the X509_V_FLAG_POLICY_CHECK flag argument.

Certificate policy checks are disabled by default in OpenSSL and are not
commonly used by applications.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2023/09/28/4; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908
CVE: CVE-2023-26923
Published: 2023-03-28
Description: Musescore 3.0 to 4.0.1 has a stack buffer overflow vulnerability that occurs when reading misconfigured midi files. If attacker can additional information, attacker can execute arbitrary code.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/musescore/MuseScore/issues/16346; https://github.com/musescore/MuseScore/issues/16346
CVE: CVE-2023-27008
Published: 2023-03-28
Description: A Cross-site scripting (XSS) vulnerability in the function encrypt_password() in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plantplants213607121.wordpress.com/2023/02/16/atutor-2-2-1-cross-site-scripting-via-the-token-body-parameter/; https://plantplants213607121.wordpress.com/2023/02/16/atutor-2-2-1-cross-site-scripting-via-the-token-body-parameter/
CVE: CVE-2023-0775
Published: 2023-03-28
Description: An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent connection requests, resulting in a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/SiliconLabs/gecko_sdk; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000SMMyGQAX?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk
CVE: CVE-2023-27821
Published: 2023-03-28
Description: Databasir v1.0.7 was discovered to contain a remote code execution (RCE) vulnerability via the mockDataScript parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917, CWE-917
References: https://github.com/luelueking/Databasir-1.0.7-vuln-poc; https://github.com/vran-dev/databasir/issues/269; https://github.com/luelueking/Databasir-1.0.7-vuln-poc
CVE: CVE-2023-27246
Published: 2023-03-28
Description: An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted .htaccess file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/IntruderLabs/2023-05-25-ziroudei/blob/main/README.md; https://github.com/IntruderLabs/2023-05-25-ziroudei/blob/main/README.md
CVE: CVE-2023-27247
Published: 2023-03-28
Description: Cynet Client Agent v4.6.0.8010 allows attackers with Administrator rights to disable the EDR functions by disabling process privilege tokens.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-250
References: https://github.com/NF-Security-Team/CVEs/blob/main/CVE-Cynet/Readme.md; https://github.com/advisories/GHSA-hmjw-7429-p2vc; https://github.com/NF-Security-Team/CVEs/blob/main/CVE-Cynet/Readme.md