deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-5033
Published: 2023-09-18
Description: A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /admin/category/cate-edit-run.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239877 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yhy217/rapidcms-vul/issues/3; https://vuldb.com/?ctiid.239877; https://vuldb.com/?id.239877
CVE: CVE-2023-5034
Published: 2023-09-18
Description: A vulnerability classified as problematic was found in SourceCodester My Food Recipe 1.0. This vulnerability affects unknown code of the file index.php of the component Image Upload Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239878 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://uploaddeimagens.com.br/imagens/bLNdiUE; https://vuldb.com/?ctiid.239878; https://vuldb.com/?id.239878
CVE: CVE-2023-42520
Published: 2023-09-18
Description: Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/support/security-advisories
CVE: CVE-2023-42526
Published: 2023-09-18
Description: Certain WithSecure products allow a remote crash of a scanning engine via decompression of crafted data files. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/support/security-advisories
CVE: CVE-2023-5036
Published: 2023-09-18
Description: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/usememos/memos/commit/97b434722cf0abe3cfcad5ac9e3d520233bf1536; https://huntr.dev/bounties/46881df7-eb41-4ce2-a78f-82de9bc4fc2d; https://github.com/usememos/memos/commit/97b434722cf0abe3cfcad5ac9e3d520233bf1536
CVE: CVE-2023-42521
Published: 2023-09-18
Description: Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/support/security-advisories
CVE: CVE-2023-42522
Published: 2023-09-18
Description: Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/support/security-advisories
CVE: CVE-2023-42523
Published: 2023-09-18
Description: Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/support/security-advisories
CVE: CVE-2023-42524
Published: 2023-09-18
Description: Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/support/security-advisories
CVE: CVE-2023-42525
Published: 2023-09-18
Description: Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/support/security-advisories
CVE: CVE-2023-43114
Published: 2023-09-18
Description: An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks.
CVSS Score: 5.5 (MEDIUM)
References: https://codereview.qt-project.org/c/qt/qtbase/+/503026; https://codereview.qt-project.org/c/qt/qtbase/+/503026
CVE: CVE-2023-43115
Published: 2023-09-18
Description: In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).
CVSS Score: 8.8 (HIGH)
References: https://bugs.ghostscript.com/show_bug.cgi?id=707051; https://ghostscript.com/; https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=e59216049cac290fb437a04c4f41ea46826cfba5
CVE: CVE-2020-36766
Published: 2023-09-18
Description: An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct.
CVSS Score: 3.3 (LOW)
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.6; https://github.com/torvalds/linux/commit/6c42227c3467549ddc65efe99c869021d2f4a570; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.6
CVE: CVE-2023-34999
Published: 2023-09-18
Description: A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitrary code execution via the admin web interface.
CVSS Score: 8.4 (HIGH)
CWE: CWE-94, CWE-77
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-893251-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-893251-BT.html
CVE: CVE-2023-41929
Published: 2023-09-18
Description: A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow a local attacker to escalate privileges. (An attacker must already have user privileges on Windows to exploit this vulnerability.)
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-42253
Published: 2023-09-18
Description: Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in Add Accounts via Invoice No, To, and Mammul.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://code-projects.org/vehicle-management-in-php-with-source-code/; https://gist.github.com/Arajawat007/e37a131fd7b5f90148fa091a42de8f9d#file-cve-2023-42253; https://code-projects.org/vehicle-management-in-php-with-source-code/
CVE: CVE-2023-42359
Published: 2023-09-18
Description: SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username parameter in /index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://upbeat-washer-def.notion.site/Exam-Form-Submission-In-PHP-SQL-Injection-in-index-php-bd71962db[PII_REDACTED]19d531ab2f6f2?pvs=4; https://upbeat-washer-def.notion.site/Exam-Form-Submission-In-PHP-SQL-Injection-in-index-php-bd71962db[PII_REDACTED]19d531ab2f6f2?pvs=4
CVE: CVE-2023-32187
Published: 2023-09-18
Description: An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service.
This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0 before v1.26.8+k3s1, from sev1.27.0 before v1.27.5+k3s1, from v1.28.0 before v1.28.1+k3s1.


CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32187https://; https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32187https://
CVE: CVE-2023-34195
Published: 2023-09-18
Description: An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses this value as a function pointer. This variable is wiped out by the same module near the end of the function. By setting this UEFI variable from the OS to point into custom code, an attacker could achieve arbitrary code execution in the DXE phase, before several chipset locks are set.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2023052; https://www.insyde.com/security-pledge
CVE: CVE-2023-42371
Published: 2023-09-18
Description: Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via a crafted script to the insert link function in the editor component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://hacker.soarescorp.com/cve/2023-42371/; https://summernote.org/; https://hacker.soarescorp.com/cve/2023-42371/
CVE: CVE-2023-42387
Published: 2023-09-18
Description: An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function in install.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/ranhn/TDSQL; https://github.com/ranhn/TDSQL.git; https://github.com/ranhn/TDSQL
CVE: CVE-2023-41595
Published: 2023-09-18
Description: An issue in xui-xray v1.8.3 allows attackers to obtain sensitive information via default password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://xui-xray.com; https://github.com/dubin12345/xui-xary/blob/main/README.md; https://github.com/vaxilu/x-ui
CVE: CVE-2023-42320
Published: 2023-09-18
Description: Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter in the GetParentControlInfo function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/aixiao0621/Tenda/blob/main/AC10/0.md; https://github.com/aixiao0621/Tenda/blob/main/AC10/0.md
CVE: CVE-2023-42328
Published: 2023-09-18
Description: An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://blockomat2100.github.io/posts/2023-09-04-damn-vulnerable-ticket-system/; https://github.com/Peppermint-Lab/peppermint/blob/446a20b870bc68157eaafcb7275c289d76bfb29e/apps/client/pages/api/auth/%5B...nextauth%5D.js#L65; https://peppermint.sh/
CVE: CVE-2023-4527
Published: 2023-09-18
Description: A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-125
References: https://access.redhat.com/errata/RHSA-2023:5453; https://access.redhat.com/errata/RHSA-2023:5455; https://access.redhat.com/security/cve/CVE-2023-4527
CVE: CVE-2023-4806
Published: 2023-09-18
Description: A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/errata/RHBA-2024:2413; https://access.redhat.com/errata/RHSA-2023:5453; https://access.redhat.com/errata/RHSA-2023:5455
CVE: CVE-2023-41030
Published: 2023-09-18
Description: Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as the 'user' user.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-259, CWE-798
References: https://blog.exodusintel.com/2023/09/18/juplink-rx4-1500-hard-coded-credential-vulnerability/; https://blog.exodusintel.com/2023/09/18/juplink-rx4-1500-hard-coded-credential-vulnerability/
CVE: CVE-2023-33831
Published: 2023-09-18
Description: A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831; https://youtu.be/Xxa6yRB2Fpw; https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831
CVE: CVE-2023-40221
Published: 2023-09-18
Description: 












The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information is displayed. Injection can be done on parameter MAIL_RCV. When a legitimate user attempts to review NOTIFICATION/MAIL SERVER, the injected code will be executed.














CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE: CVE-2023-41084
Published: 2023-09-18
Description: 










Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.












CVSS Score: 10.0 (CRITICAL)
CWE: CWE-565
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE: CVE-2023-41965
Published: 2023-09-18
Description: Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-921, CWE-922
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE: CVE-2023-38255
Published: 2023-09-18
Description: 
















A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new device configuration that could affect the intended function of the device.


















CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE: CVE-2023-38582
Published: 2023-09-18
Description: 








Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAIL_RCV. When a legitimate user attempts to access to the vulnerable page of the web application, the XSS payload will be executed.










CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE: CVE-2023-39039
Published: 2023-09-18
Description: An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: http://camp.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39039.md; http://camp.com
CVE: CVE-2023-39040
Published: 2023-09-18
Description: An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668, CWE-668
References: http://cheese.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39040.md; http://cheese.com
CVE: CVE-2023-39043
Published: 2023-09-18
Description: An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: http://tokushimaawayokocho.com; http://ykc.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39043.md
CVE: CVE-2023-39058
Published: 2023-09-18
Description: An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: http://thebmembers.com; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39058.md; http://thebmembers.com
CVE: CVE-2023-39446
Published: 2023-09-18
Description: 






Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application.








CVSS Score: 8.9 (HIGH)
CWE: CWE-352
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE: CVE-2023-39452
Published: 2023-09-18
Description: 














The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.
















CVSS Score: 7.5 (HIGH)
CWE: CWE-256
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE: CVE-2023-42441
Published: 2023-09-18
Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-833, CWE-667
References: https://github.com/vyperlang/vyper/commit/0b740280c1e3c5528a20d47b29831948ddcc6d83; https://github.com/vyperlang/vyper/pull/3605; https://github.com/vyperlang/vyper/security/advisories/GHSA-3hg2-r75x-g69m
CVE: CVE-2023-42443
Published: 2023-09-18
Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context. For `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.

Each builtin has conditions that must be fulfilled for the corruption to happen. For `raw_call`, the `data` argument of the builtin must be `msg.data` and the `value` or `gas` passed to the builtin must be some complex expression that results in writing to the memory. For `create_copy_of`, the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. For `create_from_blueprint`, either no constructor parameters should be passed to the builtin or `raw_args` should be set to True, and the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory.

As of time of publication, no patched version exists. The issue is still being investigated, and there might be other cases where the corruption might happen. When the builtin is being called from an `internal` function `F`, the issue is not present provided that the function calling `F` wrote to memory before calling `F`. As a workaround, the complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://github.com/vyperlang/vyper/issues/3609; https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w; https://github.com/vyperlang/vyper/issues/3609
CVE: CVE-2023-37611
Published: 2023-09-18
Description: Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/management/media component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/neos/neos-development-collection/pull/4812; https://rodelllemit.medium.com/stored-xss-in-neo-cms-8-3-3-9bd1cb973c5b; https://github.com/neos/neos-development-collection/pull/4812