deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-46255
Published: 2023-10-31
Description: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-532
References: https://github.com/authzed/spicedb/commit/ae50421b80f895e4c98d999b18e06b6f1e6f1cf8; https://github.com/authzed/spicedb/security/advisories/GHSA-jg7w-cxjv-98c2; https://github.com/authzed/spicedb/commit/ae50421b80f895e4c98d999b18e06b6f1e6f1cf8
CVE: CVE-2023-46256
Published: 2023-10-31
Description: PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the parser function due to the absence of `parserbuf_index` value checking. A malfunction of the sensor device can cause a heap buffer overflow with leading unexpected drone behavior. Malicious applications can exploit the vulnerability even if device sensor malfunction does not occur. Up to the maximum value of an `unsigned int`, bytes sized data can be written to the heap memory area. As of time of publication, no fixed version is available.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-120, CWE-122, CWE-787
References: https://github.com/PX4/PX4-Autopilot/blob/main/src/drivers/distance_sensor/lightware_laser_serial/parser.cpp#L87; https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-5hvv-q2r5-rppw; https://github.com/PX4/PX4-Autopilot/blob/main/src/drivers/distance_sensor/lightware_laser_serial/parser.cpp#L87
CVE: CVE-2023-46722
Published: 2023-10-31
Description: The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed[PII_REDACTED]de5ccdaa66d8b9; https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-jfxw-6c5v-c42f; https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c
CVE: CVE-2023-46723
Published: 2023-10-31
Description: lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNS(such as slack and zulip) URL and API key. As of time of publication, a patch is not yet available. As workarounds, avoid using `sendto.txt` or use `.htaccess` to block access to `sendto.txt`.
CVSS Score: 8.9 (HIGH)
CWE: CWE-538
References: https://github.com/paijp/lte-pic32-writer/security/advisories/GHSA-9qgg-ph2v-v4mh; https://github.com/paijp/lte-pic32-writer/security/advisories/GHSA-9qgg-ph2v-v4mh
CVE: CVE-2023-5739
Published: 2023-10-31
Description: Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to elevation of privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_8[PII_REDACTED]440-16; https://support.hp.com/us-en/document/ish_8[PII_REDACTED]440-16
CVE: CVE-2023-43796
Published: 2023-10-31
Description: Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458f; https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IDEEZMFJBDLTFHQUTZRJJNCOZGQ2ZVS/
CVE: CVE-2023-37831
Published: 2023-10-31
Description: An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://github.com/strik3r0x1/Vulns/blob/main/User%20enumeration%20-%20Elenos.md; https://github.com/strik3r0x1/Vulns/blob/main/User%20enumeration%20-%20Elenos.md
CVE: CVE-2023-37832
Published: 2023-10-31
Description: A lack of rate limiting in Elenos ETG150 FM transmitter v3.12 allows attackers to obtain user credentials via brute force and cause other unspecified impacts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://github.com/strik3r0x1/Vulns/blob/main/Lack%20of%20resources%20and%20rate%20limiting%20-%20Elenos.md; https://github.com/strik3r0x1/Vulns/blob/main/Lack%20of%20resources%20and%20rate%20limiting%20-%20Elenos.md
CVE: CVE-2023-45955
Published: 2023-10-31
Description: An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Nanoleaf%20Lightstrip%20Vulnerability%20Report.pdf; https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Nanoleaf%20Lightstrip%20Vulnerability%20Report.pdf
CVE: CVE-2023-41377
Published: 2023-10-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2023. Notes: none.
CVE: CVE-2023-20886
Published: 2023-10-31
Description: VMware Workspace ONE UEM console contains an open redirect vulnerability.


A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.


CVSS Score: 8.8 (HIGH)
CWE: CWE-601, CWE-601
References: https://www.vmware.com/security/advisories/VMSA-2023-0025.html; https://www.vmware.com/security/advisories/VMSA-2023-0025.html
CVE: CVE-2023-39610
Published: 2023-10-31
Description: An issue in TP-Link Tapo C100 v1.1.15 Build 211130 Rel.15378n(4555) and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted web request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/zn9988/publications/tree/main/1.TP-Link%20Tapo%20C100%20-%20HTTP%20Denial-Of-Service; https://github.com/zn9988/publications/tree/main/1.TP-Link%20Tapo%20C100%20-%20HTTP%20Denial-Of-Service
CVE: CVE-2023-3676
Published: 2023-10-31
Description: A security issue was discovered in Kubernetes where a user
 that can create pods on Windows nodes may be able to escalate to admin 
privileges on those nodes. Kubernetes clusters are only affected if they
 include Windows nodes.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/kubernetes/kubernetes/issues/119339; https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-3955
Published: 2023-10-31
Description: A security issue was discovered in Kubernetes where a user
 that can create pods on Windows nodes may be able to escalate to admin 
privileges on those nodes. Kubernetes clusters are only affected if they
 include Windows nodes.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/kubernetes/kubernetes/issues/119595; https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-43295
Published: 2023-10-31
Description: Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted request.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://www.clickstudios.com.au/security/advisories/; https://www.clickstudios.com.au/security/advisories/
CVE: CVE-2023-46484
Published: 2023-10-31
Description: An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://815yang.github.io/2023/10/29/x6000r/setLedCfg/TOTOlink%20X6000R%20setLedCfg%20e/; https://815yang.github.io/2023/10/29/x6000r/setLedCfg/TOTOlink%20X6000R%20setLedCfg%20e/
CVE: CVE-2023-46485
Published: 2023-10-31
Description: An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://815yang.github.io/2023/10/29/x6000r/TOTOlink%20X6000R%20V9.1.0cu.2350_B20230313-rsetTracerouteCfg/; https://815yang.github.io/2023/10/29/x6000r/TOTOlink%20X6000R%20V9.1.0cu.2350_B20230313-rsetTracerouteCfg/
CVE: CVE-2023-44484
Published: 2023-10-31
Description: Online Blood Donation Management System v1.0 is vulnerable to a Stored Cross-Site Scripting vulnerability. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fluidattacks.com/advisories/carpenter/; https://projectworlds.in/; https://fluidattacks.com/advisories/carpenter/
CVE: CVE-2023-44485
Published: 2023-10-31
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-44486
Published: 2023-10-31
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-5306
Published: 2023-10-31
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-37833
Published: 2023-10-31
Description: Improper access control in Elenos ETG150 FM transmitter v3.12 allows attackers to make arbitrary configuration edits that are only accessed by privileged users.
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://github.com/strik3r0x1/Vulns/blob/main/BAC%20leads%20to%20access%20Traps%20configurations.md; https://github.com/strik3r0x1/Vulns/blob/main/BAC%20leads%20to%20access%20Traps%20configurations.md
CVE: CVE-2023-39695
Published: 2023-10-31
Description: Insufficient session expiration in Elenos ETG150 FM Transmitter v3.12 allows attackers to arbitrarily change transmitter configuration and data after logging out.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613
References: https://github.com/strik3r0x1/Vulns/blob/35fe4fb3d5945b5df2a87aab0cf9ec6137bcf976/Insufficient%20Session%20Expiration%20-%20Elenos.md; https://github.com/strik3r0x1/Vulns/blob/35fe4fb3d5945b5df2a87aab0cf9ec6137bcf976/Insufficient%20Session%20Expiration%20-%20Elenos.md
CVE: CVE-2023-46378
Published: 2023-10-31
Description: Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Num-Nine/CVE/wiki/Minicms1.1.1-Exists-storage-xss; https://github.com/Num-Nine/CVE/wiki/Minicms1.1.1-Exists-storage-xss
CVE: CVE-2023-46278
Published: 2023-11-01
Description: Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huge storage space or cause significantly delayed communication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://cs.cybozu.co.jp/2023/010657.html; https://jvn.jp/en/jp/JVN94132951/; https://cs.cybozu.co.jp/2023/010657.html
CVE: CVE-2023-47094
Published: 2023-11-01
Description: A Stored Cross-Site Scripting (XSS) vulnerability in the Account Plans tab of System Settings in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Plan name field while editing Account plan details.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47094; https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47094
CVE: CVE-2023-47095
Published: 2023-11-01
Description: A Stored Cross-Site Scripting (XSS) vulnerability in the Custom fields of Edit Virtual Server under System Customization in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Batch Label field while details of Virtual Server.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47095; https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47095
CVE: CVE-2023-47096
Published: 2023-11-01
Description: A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Cloudmin services master field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47096; https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47096
CVE: CVE-2023-47097
Published: 2023-11-01
Description: A Stored Cross-Site Scripting (XSS) vulnerability in the Server Template under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Template name field while creating server templates.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47097; https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47097
CVE: CVE-2023-47098
Published: 2023-11-01
Description: A Stored Cross-Site Scripting (XSS) vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the real name or description field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47098; https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47098
CVE: CVE-2023-47099
Published: 2023-11-01
Description: A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via Description field while creating the Virtual server.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47099; https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47099
CVE: CVE-2023-5889
Published: 2023-11-01
Description: Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 8.2 (HIGH)
CWE: CWE-613, CWE-613
References: https://github.com/pkp/pkp-lib/commit/32d071ef2090fc336bc17d56a86d1dff90c26f0b; https://huntr.com/bounties/fba2991a-1b8a-4c89-9689-d708526928e1; https://github.com/pkp/pkp-lib/commit/32d071ef2090fc336bc17d56a86d1dff90c26f0b
CVE: CVE-2023-5890
Published: 2023-11-01
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pkp/pkp-lib/commit/a868f1cdd98a4f1255a70fd6d8320511e0083f38; https://huntr.com/bounties/b60e6e1f-e44d-4b11-acf8-b0548b915686; https://github.com/pkp/pkp-lib/commit/a868f1cdd98a4f1255a70fd6d8320511e0083f38
CVE: CVE-2023-5891
Published: 2023-11-01
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pkp/pkp-lib/commit/d4111c4d0eef783f1ed2e55654a5b83d9d527d97; https://huntr.com/bounties/ce4956e4-9ef5-4e0e-bfb2-481ec5cfb0a5; https://github.com/pkp/pkp-lib/commit/d4111c4d0eef783f1ed2e55654a5b83d9d527d97
CVE: CVE-2023-5892
Published: 2023-11-01
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pkp/pkp-lib/commit/a0485a5c7410821e0432c079ca676ee6026bffb9; https://huntr.com/bounties/16719252-d88d-43cc-853a-24ff75a067d8; https://github.com/pkp/pkp-lib/commit/a0485a5c7410821e0432c079ca676ee6026bffb9
CVE: CVE-2023-5893
Published: 2023-11-01
Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/pkp/pkp-lib/commit/992ca674e9fb705751b1cbf929a1856ebe29b30a; https://huntr.com/bounties/a965aa16-79ce-4185-8f58-3d3b0d74a71e; https://github.com/pkp/pkp-lib/commit/992ca674e9fb705751b1cbf929a1856ebe29b30a
CVE: CVE-2023-5894
Published: 2023-11-01
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pkp/ojs/commit/66927de1a82e3a3004db9741d1505ddac0980e63; https://huntr.com/bounties/aba3ba5b-aa6b-4076-b663-4237b4a0761d; https://github.com/pkp/ojs/commit/66927de1a82e3a3004db9741d1505ddac0980e63
CVE: CVE-2023-5895
Published: 2023-11-01
Description: Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pkp/pkp-lib/commit/83fa560d6fb54458b312addd23a91ee6520dbe63; https://huntr.com/bounties/2cc80417-32b2-4024-bbcd-d95a039c11ae; https://github.com/pkp/pkp-lib/commit/83fa560d6fb54458b312addd23a91ee6520dbe63
CVE: CVE-2023-5896
Published: 2023-11-01
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pkp/pkp-lib/commit/18b318f83105ffa7fa214179f8e20507b0754236; https://huntr.com/bounties/a1f05be5-24ed-4ec5-9858-fce4233f7bb1; https://github.com/pkp/pkp-lib/commit/18b318f83105ffa7fa214179f8e20507b0754236
CVE: CVE-2023-5897
Published: 2023-11-01
Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/pkp/customLocale/commit/407ba30f12f78efe79122591c1d85709c10b6831; https://huntr.com/bounties/7c215b8e-63f6-4146-b8e3-8482c731876f; https://github.com/pkp/customLocale/commit/407ba30f12f78efe79122591c1d85709c10b6831
CVE: CVE-2023-5898
Published: 2023-11-01
Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/pkp/pkp-lib/commit/01feef7a9392d314bf75b97a7e099cf0a307acd9; https://huntr.com/bounties/19801d12-b8ad-45e7-86e1-8f0230667c9e; https://github.com/pkp/pkp-lib/commit/01feef7a9392d314bf75b97a7e099cf0a307acd9
CVE: CVE-2023-5899
Published: 2023-11-01
Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/pkp/pkp-lib/commit/04e0e0eaeacd5d754b2f39c42148b31f646113c5; https://huntr.com/bounties/0c7f1981-3bba-4508-a07e-4cb9a2553216; https://github.com/pkp/pkp-lib/commit/04e0e0eaeacd5d754b2f39c42148b31f646113c5
CVE: CVE-2023-2621
Published: 2023-11-01
Description: 
The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer
system. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client can
exploit this vulnerability by uploading a crafted ZIP archive via the
network to McFeeder’s service endpoint.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true
CVE: CVE-2023-2622
Published: 2023-11-01
Description: 
Authenticated clients can read arbitrary files on the MAIN Computer
system using the remote procedure call (RPC) of the InspectSetup
service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read.


CVSS Score: 2.7 (LOW)
CWE: CWE-668
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true
CVE: CVE-2023-5514
Published: 2023-11-01
Description: 
The response messages received from the eSOMS report generation using certain parameter queries with full file path can be
abused for enumerating the local file system structure.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true
CVE: CVE-2023-5515
Published: 2023-11-01
Description: 
The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the application and to further plot attacks against
web servers and deployed web applications.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true
CVE: CVE-2023-5516
Published: 2023-11-01
Description: 
Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing
information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical details like version Info, endpoints,
backend server, Internal IP. etc., which can potentially expose additional attack surface containing other interesting vulnerabilities. 


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true
CVE: CVE-2023-4197
Published: 2023-11-01
Description: Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-74
References: https://github.com/Dolibarr/dolibarr/commit/0ed6a63fb06be88be5a4f8bcdee83185eee4087e; https://starlabs.sg/advisories/23/23-4197; https://github.com/Dolibarr/dolibarr/commit/0ed6a63fb06be88be5a4f8bcdee83185eee4087e
CVE: CVE-2023-4198
Published: 2023-11-01
Description: Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/Dolibarr/dolibarr/commit/3065b9ca6ade988e8d7a8a8550415c0abb56b9cb#diff-7d68365a708c954051853ade884c7e97c6ff13150ee92657d6ffc8603e0f947b; https://starlabs.sg/advisories/23/23-4198; https://github.com/Dolibarr/dolibarr/commit/3065b9ca6ade988e8d7a8a8550415c0abb56b9cb#diff-7d68365a708c954051853ade884c7e97c6ff13150ee92657d6ffc8603e0f947b
CVE: CVE-2022-48454
Published: 2023-11-01
Description: In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]46777857; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]46777857