deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-29401
Published: 2023-06-08
Description: The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat&quot;;x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-494
References: https://github.com/gin-gonic/gin/issues/3555; https://github.com/gin-gonic/gin/pull/3556; https://github.com/gin-gonic/gin/releases/tag/v1.9.1
CVE: CVE-2023-29402
Published: 2023-06-08
Description: The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://go.dev/cl/501226; https://go.dev/issue/60167; https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
CVE: CVE-2023-29403
Published: 2023-06-08
Description: On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://go.dev/cl/501223; https://go.dev/issue/60272; https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
CVE: CVE-2023-29404
Published: 2023-06-08
Description: The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://go.dev/cl/501225; https://go.dev/issue/60305; https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
CVE: CVE-2023-29405
Published: 2023-06-08
Description: The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://go.dev/cl/501224; https://go.dev/issue/60306; https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
CVE: CVE-2023-32750
Published: 2023-06-08
Description: Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "remote-download" can be used to cause the backend to send a HTTP GET request to a specified URL and save the response to a new file. The response file is then available in a user-specified folder in Pydio Cells.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.redteam-pentesting.de/advisories/rt-sa-2023-005/; https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses; https://www.redteam-pentesting.de/advisories/rt-sa-2023-005/
CVE: CVE-2023-32751
Published: 2023-06-08
Description: Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript [1]. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web application. Therefore, it is possible to generate valid signatures for arbitrary download URLs. By uploading an HTML file and modifying the download URL to serve the file inline instead of as an attachment, any included JavaScript code is executed when the URL is opened in a browser, leading to a cross-site scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.redteam-pentesting.de/advisories/rt-sa-2023-004/; https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses; https://www.redteam-pentesting.de/advisories/rt-sa-2023-004/
CVE: CVE-2023-34230
Published: 2023-06-08
Description: snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 2.0.18 fixes this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://github.com/snowflakedb/snowflake-connector-net/security/advisories/GHSA-223g-8w3x-98wr; https://github.com/snowflakedb/snowflake-connector-net/security/advisories/GHSA-223g-8w3x-98wr
CVE: CVE-2023-34232
Published: 2023-06-08
Description: snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions prior to 1.6.21. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 1.6.21 contains a patch for this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://community.snowflake.com/s/article/Node-js-Driver-Release-Notes; https://github.com/snowflakedb/snowflake-connector-nodejs/commit/0c9622ae12cd7d627df404b73a783b4a5f60728a; https://github.com/snowflakedb/snowflake-connector-nodejs/pull/465
CVE: CVE-2023-34233
Published: 2023-06-08
Description: The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Versions prior to 3.0.2 are vulnerable to command injection via single sign-on(SSO) browser URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 3.0.2 contains a patch for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://github.com/snowflakedb/snowflake-connector-python/commit/1cdbd3b1403c5ef520d7f4d9614fe35165e101ac; https://github.com/snowflakedb/snowflake-connector-python/pull/1480; https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-5w5m-pfw9-c8fp
CVE: CVE-2023-34243
Published: 2023-06-08
Description: TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200, CWE-307
References: https://github.com/tgstation/tgstation-server/pull/1526; https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph; https://github.com/tgstation/tgstation-server/pull/1526
CVE: CVE-2023-34112
Published: 2023-06-09
Description: JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message​` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: https://github.com/bytedeco/javacpp-presets/security/advisories/GHSA-36rx-hq22-jm5x; https://securitylab.github.com/research/github-actions-untrusted-input/; https://github.com/bytedeco/javacpp-presets/security/advisories/GHSA-36rx-hq22-jm5x
CVE: CVE-2023-3172
Published: 2023-06-09
Description: Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://github.com/froxlor/froxlor/commit/da810ea95393dfaec68a70e30b7c887c50563a7e; https://huntr.dev/bounties/e50966cd-9222-46b9-aedc-1feb3f2a0b0e; https://github.com/froxlor/froxlor/commit/da810ea95393dfaec68a70e30b7c887c50563a7e
CVE: CVE-2023-3173
Published: 2023-06-09
Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://github.com/froxlor/froxlor/commit/[PII_REDACTED]56efb35b4541c58e7016463dfbd9a6; https://huntr.dev/bounties/4d715f76-950d-4251-8139-3dffea798f14; https://github.com/froxlor/froxlor/commit/[PII_REDACTED]56efb35b4541c58e7016463dfbd9a6
CVE: CVE-2023-0291
Published: 2023-06-09
Description: The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://packetstormsecurity.com/files/171011/wpqsm808-xsrf.txt; https://plugins.trac.wordpress.org/changeset/2834471/quiz-master-next; https://wordpress.org/plugins/quiz-master-next/
CVE: CVE-2023-0292
Published: 2023-06-09
Description: The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://packetstormsecurity.com/files/171011/wpqsm808-xsrf.txt; https://plugins.trac.wordpress.org/changeset/2834471/quiz-master-next; https://wordpress.org/plugins/quiz-master-next/
CVE: CVE-2023-0688
Published: 2023-06-09
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078; https://plugins.trac.wordpress.org/changeset/2910040/; https://www.wordfence.com/threat-intel/vulnerabilities/id/81fc41a4-9206-404c-bd5b-821c77ff3593?source=cve
CVE: CVE-2023-0691
Published: 2023-06-09
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, specifically the submitter's last name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078; https://plugins.trac.wordpress.org/changeset/2910040/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8fc4b815-dc05-4270-bf7a-3b01622739d7?source=cve
CVE: CVE-2023-0692
Published: 2023-06-09
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078; https://plugins.trac.wordpress.org/changeset/2910040/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd85ff2-6607-4ac8-b91c-88f6f2fa6c56?source=cve
CVE: CVE-2023-0693
Published: 2023-06-09
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of arbitrary form submissions that included payment.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078; https://plugins.trac.wordpress.org/changeset/2910040/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1f33a8db-7cd0-4a53-b2c1-cd5b7cd16214?source=cve
CVE: CVE-2023-0694
Published: 2023-06-09
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078; https://plugins.trac.wordpress.org/changeset/2910040/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1a8b194c-371f-4adc-98fa-8f4e47a38ee7?source=cve
CVE: CVE-2023-0695
Published: 2023-06-09
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a specific link. Note that getting the JavaScript to execute still requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c866d8d-399c-4bda-a3c9-17c7e5d2ffb8?source=cve; https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078
CVE: CVE-2023-0708
Published: 2023-06-09
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078; https://plugins.trac.wordpress.org/changeset/2907471/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ae7549db-9a4b-4dee-8023-d7863dc3b4c8?source=cve
CVE: CVE-2023-0709
Published: 2023-06-09
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078; https://plugins.trac.wordpress.org/changeset/2907471/; https://www.wordfence.com/threat-intel/vulnerabilities/id/25200656-a6a2-42f2-a607-26d4ff502cbf?source=cve
CVE: CVE-2023-0710
Published: 2023-06-09
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database. Additionally this requires successful payment, increasing the complexity.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078; https://www.wordfence.com/threat-intel/vulnerabilities/id/89a98053-33c7-4e75-87a1-0f483a990641?source=cve; https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078
CVE: CVE-2023-0721
Published: 2023-06-09
Description: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVSS Score: 8.3 (HIGH)
CWE: CWE-1236
References: https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078; https://plugins.trac.wordpress.org/changeset/2907471/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve
CVE: CVE-2023-0729
Published: 2023-06-09
Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_sort_order function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8dbf54-ea62-4901-b34f-079b708ca0b5?source=cve
CVE: CVE-2023-0831
Published: 2023-06-09
Description: The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the dismiss_notice function called via the admin_action_ucp_dismiss_notice action. This makes it possible for unauthenticated attackers to dismiss plugin notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/under-construction-page/trunk/under-construction.php?rev=2848705#L901; https://www.wordfence.com/threat-intel/vulnerabilities/id/031a1203-6b0d-453b-be8a-12e7f55cb401?source=cve; https://plugins.trac.wordpress.org/browser/under-construction-page/trunk/under-construction.php?rev=2848705#L901
CVE: CVE-2023-0832
Published: 2023-06-09
Description: The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the install_weglot function called via the admin_action_install_weglot action. This makes it possible for unauthenticated attackers to perform an unauthorized install of the Weglot Translate plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/under-construction-page/trunk/under-construction.php?rev=2848705#L2389; https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa84388-3597-4a54-9ae8-d6e04afe9061?source=cve; https://plugins.trac.wordpress.org/browser/under-construction-page/trunk/under-construction.php?rev=2848705#L2389