deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4861
Published: 2023-10-16
Description: The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/7fa03f00-25c7-4e40-8592-bb4001ce019d; https://wpscan.com/vulnerability/7fa03f00-25c7-4e40-8592-bb4001ce019d
CVE: CVE-2023-4862
Published: 2023-10-16
Description: The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/81821bf5-69e1-4005-b3eb-d541490909cc; https://wpscan.com/vulnerability/81821bf5-69e1-4005-b3eb-d541490909cc
CVE: CVE-2023-4933
Published: 2023-10-16
Description: The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://wpscan.com/vulnerability/882f6c36-44c6-4273-81cd-2eaaf5e81fa7; https://wpscan.com/vulnerability/882f6c36-44c6-4273-81cd-2eaaf5e81fa7
CVE: CVE-2023-4950
Published: 2023-10-16
Description: The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/73db1ee8-06a2-41b6-b287-44e25f5f2e58; https://wpscan.com/vulnerability/73db1ee8-06a2-41b6-b287-44e25f5f2e58
CVE: CVE-2023-4971
Published: 2023-10-16
Description: The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import  a malicious file and a suitable gadget chain is present on the blog.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://wpscan.com/vulnerability/421194e1-6c3f-4972-8f3c-de1b9d2bcb13; https://wpscan.com/vulnerability/421194e1-6c3f-4972-8f3c-de1b9d2bcb13
CVE: CVE-2023-5003
Published: 2023-10-16
Description: The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/91f4e500-71f3-4ef6-9cc7-24a7c12a5748; https://wpscan.com/vulnerability/91f4e500-71f3-4ef6-9cc7-24a7c12a5748
CVE: CVE-2023-5057
Published: 2023-10-16
Description: The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/58a63507-f0fd-46f1-a80c-6b1c41dddcf5; https://wpscan.com/vulnerability/58a63507-f0fd-46f1-a80c-6b1c41dddcf5
CVE: CVE-2023-5087
Published: 2023-10-16
Description: The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/3b45cc0b-7378-49f3-900e-d0e18cd4b878; https://wpscan.com/vulnerability/3b45cc0b-7378-49f3-900e-d0e18cd4b878
CVE: CVE-2023-5089
Published: 2023-10-16
Description: The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d; https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms; https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d
CVE: CVE-2023-5133
Published: 2023-10-16
Description: This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/36c30e54-75e4-4df1-b01a-60c51c0e76a3; https://wpscan.com/vulnerability/36c30e54-75e4-4df1-b01a-60c51c0e76a3
CVE: CVE-2023-5167
Published: 2023-10-16
Description: The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/78ea6fe0-5fac-4923-949c-023c85fe2437; https://wpscan.com/vulnerability/78ea6fe0-5fac-4923-949c-023c85fe2437
CVE: CVE-2023-5177
Published: 2023-10-16
Description: The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/a67b9c21-a35a-4cdb-9627-a5932334e5f0; https://wpscan.com/vulnerability/a67b9c21-a35a-4cdb-9627-a5932334e5f0
CVE: CVE-2023-5561
Published: 2023-10-16
Description: WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
CVSS Score: 5.3 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html; https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/; https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441
CVE: CVE-2023-30987
Published: 2023-10-16
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain databases.  IBM X-Force ID:  253440.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/253440; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7047560
CVE: CVE-2023-38720
Published: 2023-10-16
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE statement.  IBM X-Force ID:  261616.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/261616; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7047489
CVE: CVE-2023-40851
Published: 2023-10-16
Description: Cross Site Scripting (XSS) vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to run arbitrary code via fname, lname, email, and contact fields of the user registration page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/51694; https://www.exploit-db.com/exploits/51694
CVE: CVE-2023-40852
Published: 2023-10-16
Description: SQL Injection vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to obtain sensitive information via crafted string in the admin user name field on the admin log in page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/51695; https://www.exploit-db.com/exploits/51695
CVE: CVE-2023-42459
Published: 2023-10-16
Description: Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-415, CWE-416, CWE-590, CWE-415
References: https://github.com/eProsima/Fast-DDS/issues/3207; https://github.com/eProsima/Fast-DDS/pull/3824; https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm
CVE: CVE-2023-45128
Published: 2023-10-16
Description: Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This issue has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes as defense in depth measures. There are no known workarounds for this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20, CWE-352, CWE-565, CWE-807
References: https://github.com/gofiber/fiber/commit/8c3916dbf4ad2ed427d02c6eb63ae8b2fa8f019a; https://github.com/gofiber/fiber/security/advisories/GHSA-94w9-97p3-p368; https://github.com/gofiber/fiber/commit/8c3916dbf4ad2ed427d02c6eb63ae8b2fa8f019a
CVE: CVE-2023-45141
Published: 2023-10-16
Description: Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.
CVSS Score: 8.6 (HIGH)
CWE: CWE-352, CWE-565
References: https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p; https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p
CVE: CVE-2023-45144
Published: 2023-10-16
Description: com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/xwikisas/identity-oauth/blob/master/ui/src/main/resources/IdentityOAuth/LoginUIExtension.vm#L58; https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6; https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6#diff-2ab2e0716443d790d7d798320e4a45151661f4eca5440331f4a227b29c87c188
CVE: CVE-2023-45147
Published: 2023-10-16
Description: Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation with the default plugins, this vulnerability has no impact. The problem has been patched in the latest version of Discourse. Users are advised to update to version 3.1.1 if they are on the stable branch or 3.2.0.beta2 if they are on the beta branch. Users unable to upgrade should disable any plugins that access topic custom fields.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse/security/advisories/GHSA-wm89-m359-f9qv; https://github.com/discourse/discourse/security/advisories/GHSA-wm89-m359-f9qv
CVE: CVE-2023-45542
Published: 2023-10-16
Description: Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a crafted script to the q parameter in the Search function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ahrixia/CVE-2023-45542; https://github.com/ahrixia/CVE-2023-45542
CVE: CVE-2023-38728
Published: 2023-10-16
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted XML query statement.  IBM X-Force ID:  262258.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262258; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7047489
CVE: CVE-2023-38740
Published: 2023-10-16
Description: IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL statement.  IBM X-Force ID:  262613.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262613; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7047489
CVE: CVE-2023-43658
Published: 2023-10-16
Description: dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP disabled. Having CSP disabled is a non-default configuration, so the vast majority of sites are unaffected. This problem is resolved in the latest version of the discourse-calendar plugin. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP; https://github.com/discourse/discourse-calendar/commit/[PII_REDACTED]febb36822d6823d14f1059c39644de; https://github.com/discourse/discourse-calendar/security/advisories/GHSA-3fwj-f6ww-7hr6
CVE: CVE-2023-43659
Published: 2023-10-16
Description: Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.

CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP; https://github.com/discourse/discourse/security/advisories/GHSA-g4qg-5q2h-m8ph; https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
CVE: CVE-2023-43814
Published: 2023-10-16
Description: Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll participants. This impacts private polls where the results were intended to only be viewable by authorized users. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. There is no workaround for this issue apart from upgrading to the fixed version.

CVSS Score: 3.7 (LOW)
CWE: CWE-200, CWE-284
References: https://github.com/discourse/discourse/security/advisories/GHSA-3x57-846g-7qcw; https://github.com/discourse/discourse/security/advisories/GHSA-3x57-846g-7qcw
CVE: CVE-2023-44388
Published: 2023-10-16
Description: Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to temporarily work around this problem by reducing the `client_max_body_size nginx directive`. `client_max_body_size` will limit the size of uploads that can be uploaded directly to the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size; https://github.com/discourse/discourse/security/advisories/GHSA-89h3-g746-xmwq; http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
CVE: CVE-2023-44391
Published: 2023-10-16
Description: Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is enabled. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse/security/advisories/GHSA-7px5-fqcf-7mfr; https://github.com/discourse/discourse/security/advisories/GHSA-7px5-fqcf-7mfr
CVE: CVE-2023-44394
Published: 2023-10-16
Description: MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit `65c44883f` which has been included in release `2.25.8`. Users are advised to upgrade. Users unable to upgrade should disable wiki integration ( `$g_wiki_enable = OFF;`).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://github.com/mantisbt/mantisbt/commit/65c44883f9d24f3ccef066fb523c93d8fdd7afc1; https://github.com/mantisbt/mantisbt/security/advisories/GHSA-v642-mh27-8j6m; https://mantisbt.org/bugs/view.php?id=32981
CVE: CVE-2023-45131
Published: 2023-10-16
Description: Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/discourse/discourse/security/advisories/GHSA-84gf-hhrc-9pw6; https://github.com/discourse/discourse/security/advisories/GHSA-84gf-hhrc-9pw6
CVE: CVE-2023-45540
Published: 2023-10-16
Description: An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://github.com/soundarkutty/HTML-Injection/blob/main/POC.md; https://github.com/soundarkutty/HTML-Injection/blob/main/POC.md
CVE: CVE-2023-45807
Published: 2023-10-16
Description: OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-281
References: https://github.com/opensearch-project/security/security/advisories/GHSA-72q2-gwwf-6hrv; https://github.com/opensearch-project/security/security/advisories/GHSA-72q2-gwwf-6hrv
CVE: CVE-2023-30991
Published: 2023-10-16
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query.  IBM X-Force ID:  254037.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254037; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7047499
CVE: CVE-2023-40374
Published: 2023-10-16
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement.  IBM X-Force ID:  263575.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/263575; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7047261
CVE: CVE-2011-10004
Published: 2023-10-17
Description: A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress. It has been rated as critical. This issue affects some unknown processing of the file uploadImage.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The identifier of the patch is e3ff616dc08d3aadff9253f1085e13f677d0c676. It is recommended to upgrade the affected component. The identifier VDB-242189 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/wp-plugins/reciply/commit/e3ff616dc08d3aadff9253f1085e13f677d0c676; https://vuldb.com/?ctiid.242189; https://vuldb.com/?id.242189
CVE: CVE-2012-10016
Published: 2023-10-17
Description: A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of the file simple-download-button_dl.php of the component Download Handler. The manipulation of the argument file leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.1 is able to address this issue. The patch is identified as e648a[PII_REDACTED]cf02a665ae0bae1c069dea5f1. It is recommended to upgrade the affected component. VDB-242190 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/wp-plugins/simple-download-button-shortcode/commit/e648a[PII_REDACTED]cf02a665ae0bae1c069dea5f1; https://vuldb.com/?ctiid.242190; https://vuldb.com/?id.242190
CVE: CVE-2023-38719
Published: 2023-10-17
Description: IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during database deactivation on DPF.  IBM X-Force ID:  261607.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/261607; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7047558