deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1049
Published: 2023-06-14
Description: 
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that
could cause execution of malicious code when an unsuspicious user loads a project file from the
local filesystem into the HMI.


CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-01.pdf
CVE: CVE-2023-2569
Published: 2023-06-14
Description: 
A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service,
elevation of privilege, and potentially kernel execution when a malicious actor with local user
access crafts a script/program using an IOCTL call in the Foxboro.sys driver.


CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf
CVE: CVE-2023-2570
Published: 2023-06-14
Description: 


A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local
denial-of-service, and potentially kernel execution when a malicious actor with local user access
crafts a script/program using an unpredictable index to an IOCTL call in the Foxboro.sys driver.




CVSS Score: 7.0 (HIGH)
CWE: CWE-129
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf
CVE: CVE-2023-30631
Published: 2023-06-14
Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function.  However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.

8.x users should upgrade to 8.1.7 or later versions
9.x users should upgrade to 9.2.1 or later versions
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pobg9z2bvs; https://lists.debian.org/debian-lts-announce/2023/06/msg00037.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O/
CVE: CVE-2023-33933
Published: 2023-06-14
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.

8.x users should upgrade to 8.1.7 or later versions
9.x users should upgrade to 9.2.1 or later versions
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pobg9z2bvs; https://lists.debian.org/debian-lts-announce/2023/06/msg00037.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O/
CVE: CVE-2023-34000
Published: 2023-06-14
Description: Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin <= 7.4.0 versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://patchstack.com/articles/unauthenticated-idor-to-pii-disclosure-vulnerability-in-woocommerce-stripe-gateway-plugin?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-gateway-stripe/wordpress-woocommerce-stripe-payment-gateway-plugin-7-4-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/articles/unauthenticated-idor-to-pii-disclosure-vulnerability-in-woocommerce-stripe-gateway-plugin?_s_id=cve
CVE: CVE-2023-34149
Published: 2023-06-14
Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2023/06/14/2; https://cwiki.apache.org/confluence/display/WW/S2-063; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-34396
Published: 2023-06-14
Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2023/06/14/3; https://cwiki.apache.org/confluence/display/WW/S2-064; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-3001
Published: 2023-06-14
Description: 
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that
could cause an interpretation of malicious payload data, potentially leading to remote code
execution when an attacker gets the user to open a malicious file. 


CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-02.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-02.pdf
CVE: CVE-2023-3237
Published: 2023-06-14
Description: A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-259, CWE-798
References: https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md; https://vuldb.com/?ctiid.231508; https://vuldb.com/?id.231508
CVE: CVE-2023-3238
Published: 2023-06-14
Description: A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md; https://vuldb.com/?ctiid.231509; https://vuldb.com/?id.231509
CVE: CVE-2023-3239
Published: 2023-06-14
Description: A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-24
References: https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md; https://vuldb.com/?ctiid.231510; https://vuldb.com/?id.231510
CVE: CVE-2023-3240
Published: 2023-06-14
Description: A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.
CVSS Score: 3.5 (LOW)
CWE: CWE-24
References: https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md; https://vuldb.com/?ctiid.231511; https://vuldb.com/?id.231511
CVE: CVE-2023-3241
Published: 2023-06-14
Description: A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512.
CVSS Score: 3.5 (LOW)
CWE: CWE-22, CWE-22
References: https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md; https://vuldb.com/?ctiid.231512; https://vuldb.com/?id.231512
CVE: CVE-2023-3036
Published: 2023-06-14
Description: An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit  783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71  enabled a remote attacker to trigger a panic by sending an NTSAuthenticator packet with extension length longer than the packet contents.

CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-125, CWE-125
References: https://github.com/cloudflare/cfnts/security/advisories/GHSA-pwx6-gw47-96cp; https://github.com/cloudflare/cfnts/security/advisories/GHSA-pwx6-gw47-96cp
CVE: CVE-2023-3040
Published: 2023-06-14
Description: A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have allowed an attacker to launch a DoS if the function was used to parse untrusted input data. It is important to note that because this debug function was only used in tests and demos, it was not exploitable in a normal environment.

CVSS Score: 3.7 (LOW)
CWE: CWE-125, CWE-125
References: https://github.com/cloudflare/lua-resty-json/pull/14; https://github.com/cloudflare/lua-resty-json/security/advisories/GHSA-h8rp-9622-83pg; https://github.com/cloudflare/lua-resty-json/pull/14
CVE: CVE-2023-35141
Published: 2023-06-14
Description: In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.openwall.com/lists/oss-security/2023/06/14/5; https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3135; http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE: CVE-2023-35142
Published: 2023-06-14
Description: Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: http://www.openwall.com/lists/oss-security/2023/06/14/5; https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2870; http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE: CVE-2023-35143
Published: 2023-06-14
Description: Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control maven project versions in `pom.xml`.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2023/06/14/5; https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3156; http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE: CVE-2023-35144
Published: 2023-06-14
Description: Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2023/06/14/5; https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2951; http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE: CVE-2023-35145
Published: 2023-06-14
Description: Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in a stored cross-site scripting vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2023/06/14/5; https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3155; http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE: CVE-2023-35146
Published: 2023-06-14
Description: Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template Workflow Job, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create jobs.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2023/06/14/5; https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3166; http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE: CVE-2023-35147
Published: 2023-06-14
Description: Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: http://www.openwall.com/lists/oss-security/2023/06/14/5; https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3099; http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE: CVE-2023-35148
Published: 2023-06-14
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.openwall.com/lists/oss-security/2023/06/14/5; https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2911; http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE: CVE-2023-35149
Published: 2023-06-14
Description: A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: http://www.openwall.com/lists/oss-security/2023/06/14/5; https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2911; http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE: CVE-2020-22402
Published: 2023-06-14
Description: Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reads an email containing malicious code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sogo.nu/bugs/view.php?id=4979; https://sogo.nu/bugs/view.php?id=4979
CVE: CVE-2021-31280
Published: 2023-06-14
Description: An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the keywords parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/fmsdwifull/tp5cms/issues/8; https://github.com/fmsdwifull/tp5cms/issues/8
CVE: CVE-2023-32465
Published: 2023-06-14
Description: 
Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. An attacker could potentially exploit this vulnerability, leading to unauthorized admin access to the Cyber Recovery application. Exploitation may lead to complete system takeover by an attacker.


CVSS Score: 8.8 (HIGH)
CWE: CWE-644
References: https://www.dell.com/support/kbdoc/en-us/000214943/dsa-2023-201-security-update-for-dell-powerprotect-cyber-recovery; https://www.dell.com/support/kbdoc/en-us/000214943/dsa-2023-201-security-update-for-dell-powerprotect-cyber-recovery
CVE: CVE-2023-34585
Published: 2023-06-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-34609
Published: 2023-06-14
Description: An issue was discovered flexjson thru 3.3 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://sourceforge.net/p/flexjson/bugs/48/; https://sourceforge.net/p/flexjson/bugs/49/; https://sourceforge.net/p/flexjson/bugs/50/
CVE: CVE-2023-34610
Published: 2023-06-14
Description: An issue was discovered json-io thru 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/jdereg/json-io/issues/169; https://github.com/jdereg/json-io/issues/169
CVE: CVE-2023-34611
Published: 2023-06-14
Description: An issue was discovered mjson thru 1.4.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/bolerio/mjson/issues/40; https://github.com/bolerio/mjson/issues/40
CVE: CVE-2023-34612
Published: 2023-06-14
Description: An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/phax/ph-commons/issues/35; https://github.com/phax/ph-commons/issues/35
CVE: CVE-2023-34613
Published: 2023-06-14
Description: An issue was discovered sojo thru 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/maddingo/sojo/issues/15; https://github.com/maddingo/sojo/issues/15
CVE: CVE-2023-34614
Published: 2023-06-14
Description: An issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://bitbucket.org/jmarsden/jsonij/issues/7/stack-overflow-error-caused-by-jsonij; https://bitbucket.org/jmarsden/jsonij/issues/7/stack-overflow-error-caused-by-jsonij
CVE: CVE-2023-34615
Published: 2023-06-14
Description: An issue was discovered JSONUtil thru 5.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/billdavidson/JSONUtil/issues/10; https://github.com/billdavidson/JSONUtil/issues/10
CVE: CVE-2023-34616
Published: 2023-06-14
Description: An issue was discovered pbjson thru 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/InductiveComputerScience/pbJson/issues/2; https://github.com/InductiveComputerScience/pbJson/issues/2
CVE: CVE-2023-34617
Published: 2023-06-14
Description: An issue was discovered genson thru 1.6 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/owlike/genson/issues/191; https://github.com/owlike/genson/issues/191
CVE: CVE-2023-34620
Published: 2023-06-14
Description: An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/hjson/hjson-java/issues/24; https://github.com/hjson/hjson-java/issues/24
CVE: CVE-2023-34623
Published: 2023-06-14
Description: An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/trajano/jtidy/issues/4; https://github.com/trajano/jtidy/issues/4
CVE: CVE-2023-34624
Published: 2023-06-14
Description: An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/amplafi/htmlcleaner/issues/13; https://lists.debian.org/debian-lts-announce/2023/08/msg00007.html; https://www.debian.org/security/2023/dsa-5471
CVE: CVE-2023-34747
Published: 2023-06-14
Description: File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/ujcms/ujcms/issues/4; https://github.com/ujcms/ujcms/issues/4
CVE: CVE-2023-34750
Published: 2023-06-14
Description: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=projects&action=edit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability; https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
CVE: CVE-2023-34751
Published: 2023-06-14
Description: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&action=edit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability; https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
CVE: CVE-2023-34752
Published: 2023-06-14
Description: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://bloofoxcms.com; https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability; https://www.bloofox.com/
CVE: CVE-2023-34753
Published: 2023-06-14
Description: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability; https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
CVE: CVE-2023-34754
Published: 2023-06-14
Description: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins&action=edit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability; https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability