deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49943
Published: 2024-01-18
Description: Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://manageengine.com; https://www.manageengine.com/products/service-desk-msp/CVE-2023-49943.html; https://manageengine.com
CVE: CVE-2024-22212
Published: 2024-01-18
Description: Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector is upgraded to version 1.4.1, 2.1.2, 2.3.4 or 2.4.5. There are no known workarounds for this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-306
References: https://github.com/nextcloud/globalsiteselector/commit/ab5da57190d5bbc79079ce4109b6bcccccd893ee; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vj5q-f63m-wp77; https://hackerone.com/reports/2248689
CVE: CVE-2024-22419
Published: 2024-01-18
Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn't properly adhere to the API of copy functions (for `>=0.3.2` the `copy_bytes` function). A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don't occur. This issue has been addressed in 0.4.0.
CVSS Score: 7.3 (HIGH)
CWE: CWE-120, CWE-787
References: https://github.com/vyperlang/vyper/commit/55e18f6d128b2da8986adbbcccf1cd59a4b9ad6f; https://github.com/vyperlang/vyper/issues/3737; https://github.com/vyperlang/vyper/security/advisories/GHSA-2q8v-3gqq-4f8p
CVE: CVE-2024-22213
Published: 2024-01-18
Description: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the Nextcloud Deck is upgraded to version 1.9.5 or 1.11.2. There are no known workarounds for this vulnerability.
CVSS Score: 0.0 (NONE)
CWE: CWE-79, CWE-79
References: https://github.com/nextcloud/deck/commit/91f[PII_REDACTED]f8840f53151f176b80148650bcd; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mg7w-x9fm-9wwc; https://hackerone.com/reports/2058556
CVE: CVE-2024-22400
Published: 2024-01-18
Description: Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up on a uncontrolled thirdparty server. It is recommended that the User Saml app is upgraded to version 5.1.5, 5.2.5, or 6.0.1. There are no known workarounds for this issue.
CVSS Score: 3.1 (LOW)
CWE: CWE-601
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-622q-xhfr-xmv7; https://github.com/nextcloud/user_saml/commit/b184304a476deeba36e92b70562d5de7c2f85f8a; https://github.com/nextcloud/user_saml/pull/788
CVE: CVE-2024-22403
Published: 2024-01-18
Description: Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.
CVSS Score: 3.0 (LOW)
CWE: CWE-613
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36; https://github.com/nextcloud/server/pull/40766; https://hackerone.com/reports/1784162
CVE: CVE-2023-47092
Published: 2024-01-18
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-51217
Published: 2024-01-18
Description: An issue discovered in TenghuTOS TWS-200 firmware version:V4.0[PII_REDACTED]24 allows a remote attacker to execute arbitrary code via crafted command on the ping page component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/websafe2021/CVE/blob/main/TenghuTOS-TWS-200.md; https://github.com/websafe2021/CVE/blob/main/TenghuTOS-TWS-200.md
CVE: CVE-2023-51258
Published: 2024-01-18
Description: A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new_Token function in the modules/preprocs/nasm/nasm-pp:1512.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/hanxuer/crashes/blob/main/yasm/04/readme.md; https://github.com/hanxuer/crashes/blob/main/yasm/04/readme.md
CVE: CVE-2024-22401
Published: 2024-01-18
Description: Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-281
References: https://github.com/nextcloud/guests/pull/1082; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wr87-hx3w-29hh; https://hackerone.com/reports/2250398
CVE: CVE-2024-22402
Published: 2024-01-18
Description: Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-281
References: https://github.com/nextcloud/guests/pull/1082; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v3qw-7vgv-2fxj; https://hackerone.com/reports/2251074
CVE: CVE-2024-22404
Published: 2024-01-18
Description: Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-281
References: https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq; https://hackerone.com/reports/2247457
CVE: CVE-2024-22415
Published: 2024-01-18
Description: jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root directory. This issue has been patched in version 2.2.2 and all users are advised to upgrade. Users unable to upgrade should uninstall jupyter-lsp.
CVSS Score: 7.3 (HIGH)
CWE: CWE-23, CWE-284, CWE-306, CWE-22
References: https://github.com/jupyter-lsp/jupyterlab-lsp/commit/4ad12f204ad0b85580fc32137c647baaff044e95; https://github.com/jupyter-lsp/jupyterlab-lsp/security/advisories/GHSA-4qhp-652w-c22x; https://github.com/jupyter-lsp/jupyterlab-lsp/commit/4ad12f204ad0b85580fc32137c647baaff044e95
CVE: CVE-2024-22418
Published: 2024-01-18
Description: Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group Office. It allows an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For instance, using a filename such as “><img src=x onerror=prompt('XSS')>.jpg” triggers the vulnerability. When this file is uploaded, the JavaScript code within the filename is executed. This issue has been addressed in version 6.8.29. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/Intermesh/groupoffice/commit/2a52a5d42d080db6738d70eba30294bcd94ebd09; https://github.com/Intermesh/groupoffice/security/advisories/GHSA-p7w9-h6c3-wqpp; https://github.com/Intermesh/groupoffice/commit/2a52a5d42d080db6738d70eba30294bcd94ebd09
CVE: CVE-2023-43815
Published: 2024-01-18
Description: A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wScreenDESCTextLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution.

CVSS Score: 7.1 (HIGH)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wscreendesctextlen-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wscreendesctextlen-buffer-overflow-remote-code-execution/
CVE: CVE-2023-43816
Published: 2024-01-18
Description: A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wKPFStringLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution.

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wkpfstringlen-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wkpfstringlen-buffer-overflow-remote-code-execution/
CVE: CVE-2023-43817
Published: 2024-01-18
Description: A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wMailContentLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution.


CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wmailcontentlen-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wmailcontentlen-buffer-overflow-remote-code-execution/
CVE: CVE-2023-43818
Published: 2024-01-18
Description: A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.

CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wtextlen-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wtextlen-buffer-overflow-remote-code-execution/
CVE: CVE-2023-43819
Published: 2024-01-18
Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the InitialMacroLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.

CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-initialmacrolen-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-initialmacrolen-buffer-overflow-remote-code-execution/
CVE: CVE-2023-43820
Published: 2024-01-18
Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wlogtitlesprevvaluelen-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wlogtitlesprevvaluelen-buffer-overflow-remote-code-execution/
CVE: CVE-2023-43821
Published: 2024-01-18
Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesActionLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.

CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wlogtitlesactionlen-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wlogtitlesactionlen-buffer-overflow-remote-code-execution/
CVE: CVE-2023-43822
Published: 2024-01-18
Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesTimeLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.

CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wlogtitlestimelen-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wlogtitlestimelen-buffer-overflow-remote-code-execution/
CVE: CVE-2023-43823
Published: 2024-01-18
Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wttitlelen-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wttitlelen-buffer-overflow-remote-code-execution/
CVE: CVE-2023-43824
Published: 2024-01-18
Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wtitletextlen-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wtitletextlen-buffer-overflow-remote-code-execution/
CVE: CVE-2023-50614
Published: 2024-01-18
Description: An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://github.com/cvdyfbwa/Password-plaintext-output/blob/main/README.md; https://github.com/cvdyfbwa/Password-plaintext-output/blob/main/README.md
CVE: CVE-2023-5130
Published: 2024-01-18
Description: A buffer overflow vulnerability exists in Delta Electronics WPLSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.

CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-wplsoft-buffer-overflow/; https://blog.exodusintel.com/2024/01/18/delta-electronics-wplsoft-buffer-overflow/
CVE: CVE-2023-5131
Published: 2024-01-18
Description: A heap buffer-overflow exists in Delta Electronics ISPSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.

CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-787
References: https://blog.exodusintel.com/2024/01/18/delta-electronics-ispsoft-heap-buffer-overflow/; https://blog.exodusintel.com/2024/01/18/delta-electronics-ispsoft-heap-buffer-overflow/
CVE: CVE-2024-0693
Published: 2024-01-18
Description: A vulnerability classified as problematic was found in EFS Easy File Sharing FTP 2.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251479. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://0day.today/exploit/description/39218; https://packetstormsecurity.com/files/176377/Easy-File-Sharing-FTP-Server-2.0-Denial-Of-Service.html; https://vuldb.com/?ctiid.251479
CVE: CVE-2024-0695
Published: 2024-01-18
Description: A vulnerability, which was classified as problematic, has been found in EFS Easy Chat Server 3.1. Affected by this issue is some unknown functionality of the component HTTP GET Request Handler. The manipulation of the argument USERNAME leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251480. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://packetstormsecurity.com/files/176381/Easy-Chat-Server-3.1-Denial-Of-Service.html; https://vuldb.com/?ctiid.251480; https://vuldb.com/?id.251480
CVE: CVE-2024-0696
Published: 2024-01-18
Description: A vulnerability, which was classified as problematic, was found in AtroCore AtroPIM 1.8.4. This affects an unknown part of the file /#ProductSerie/view/ of the component Product Series Overview. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251481 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://pasteboard.co/wsTTLjp5UEPq.png; https://vuldb.com/?ctiid.251481; https://vuldb.com/?id.251481
CVE: CVE-2023-35020
Published: 2024-01-19
Description: IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  257874.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257874; https://www.ibm.com/support/pages/node/7107788; https://exchange.xforce.ibmcloud.com/vulnerabilities/257874
CVE: CVE-2023-38738
Published: 2024-01-19
Description: 
IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is using Native authentication an attacker with access to the OpenPages database could through a series of specially crafted steps could exploit this weakness and gain unauthorized access to other OpenPages accounts. IBM X-Force ID: 262594.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-257
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262594; https://www.ibm.com/support/pages/node/7107775; https://exchange.xforce.ibmcloud.com/vulnerabilities/262594
CVE: CVE-2023-40683
Published: 2024-01-19
Description: IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticating as an OpenPages user and using non-public APIs, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrative access to the application.  IBM X-Force ID:  264005.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/264005; https://www.ibm.com/support/pages/node/7107774; https://exchange.xforce.ibmcloud.com/vulnerabilities/264005
CVE: CVE-2024-22422
Published: 2024-01-19
Description: AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting. In versions prior to commit `08d33cfd8` an unauthenticated API route (file export) can allow attacker to crash the server resulting in a denial of service attack. The “data-export” endpoint is used to export files using the filename parameter as user input. The endpoint takes the user input, filters it to avoid directory traversal attacks, fetches the file from the server, and afterwards deletes it. An attacker can trick the input filter mechanism to point to the current directory, and while attempting to delete it the server will crash as there is no error-handling wrapper around it. Moreover, the endpoint is public and does not require any form of authentication, resulting in an unauthenticated Denial of Service issue, which crashes the instance using a single HTTP packet. This issue has been addressed in commit `08d33cfd8`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://github.com/Mintplex-Labs/anything-llm/commit/08d33cfd8fc47c5052b6ea29597c964a9da641e2; https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-xmj6-g32r-fc5q; https://github.com/Mintplex-Labs/anything-llm/commit/08d33cfd8fc47c5052b6ea29597c964a9da641e2