deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-42628
Published: 2023-10-17
Description: Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628; https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628
CVE: CVE-2023-45004
Published: 2023-10-17
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wp3sixty Woo Custom Emails plugin <= 2.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-custom-emails/wordpress-woo-custom-emails-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-custom-emails/wordpress-woo-custom-emails-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45006
Published: 2023-10-17
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ByConsole WooODT Lite – WooCommerce Order Delivery or Pickup with Date Time Location plugin <= 2.4.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/byconsole-woo-order-delivery-time/wordpress-wooodt-lite-plugin-2-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/byconsole-woo-order-delivery-time/wordpress-wooodt-lite-plugin-2-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45007
Published: 2023-10-17
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fotomoto plugin <= 1.2.8 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/fotomoto/wordpress-fotomoto-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fotomoto/wordpress-fotomoto-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-3761
Published: 2023-10-17
Description: OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/; https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/; https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/
CVE: CVE-2023-42627
Published: 2023-10-17
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42627; https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42627
CVE: CVE-2023-43776
Published: 2023-10-17
Description: Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-261, CWE-326
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2023-1010.pdf; https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2023-1010.pdf
CVE: CVE-2023-43777
Published: 2023-10-17
Description: Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauthorized access. This password was being stored insecurely and could be retrieved by skilled adversaries. 
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-256, CWE-522
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2023-1011.pdf; https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2023-1011.pdf
CVE: CVE-2023-44824
Published: 2023-10-17
Description: An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://abstracted-howler-727.notion.site/CVE-2023-44824-ab76909b4a0e477b87aa8d0ca4aa4ca7; https://abstracted-howler-727.notion.site/Vulnerability-Description-ccc2e6489a0d43859c61a7982e649da1; https://gist.github.com/Muscial/e46c4e4031d25a3684cda124dfc45d96
CVE: CVE-2023-20598
Published: 2023-10-17
Description: 


An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over arbitrary hardware ports or physical addresses resulting in a potential arbitrary code execution.




CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-6009; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-6009
CVE: CVE-2023-43959
Published: 2023-10-17
Description: An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://hackmd.io/%40tahaafarooq/auth_rce_voip; https://www.exploit-db.com/exploits/50509; https://hackmd.io/%40tahaafarooq/auth_rce_voip
CVE: CVE-2023-45901
Published: 2023-10-17
Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin\/category\/add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20in%20the%20newly%20added%20column%20of%20column%20management.md; https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20in%20the%20newly%20added%20column%20of%20column%20management.md
CVE: CVE-2023-45902
Published: 2023-10-17
Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/attachment/delete.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20in%20the%20attachment%20management%20deletion%20function.md; https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20in%20the%20attachment%20management%20deletion%20function.md
CVE: CVE-2023-45903
Published: 2023-10-17
Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/label/delete.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20vulnerability%20in%20the%20label%20management%20deletion%20function.md; https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20vulnerability%20in%20the%20label%20management%20deletion%20function.md
CVE: CVE-2023-45904
Published: 2023-10-17
Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20vulnerability%20in%20the%20variable%20management%20modification%20function.md; https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20vulnerability%20in%20the%20variable%20management%20modification%20function.md
CVE: CVE-2023-45905
Published: 2023-10-17
Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20vulnerability%20in%20variable%20management%20with%20added%20functionality.md; https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20vulnerability%20in%20variable%20management%20with%20added%20functionality.md
CVE: CVE-2023-45906
Published: 2023-10-17
Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20in%20the%20user%20added%20function.md; https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20in%20the%20user%20added%20function.md
CVE: CVE-2023-45907
Published: 2023-10-17
Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20vulnerability%20in%20the%20variable%20management%20deletion%20function.md; https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20vulnerability%20in%20the%20variable%20management%20deletion%20function.md
CVE: CVE-2023-37537
Published: 2023-10-17
Description: An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges. 

CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108018; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108018
CVE: CVE-2023-27132
Published: 2023-10-17
Description: TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://packetstormsecurity.com/files/174271; https://packetstormsecurity.com/files/174271
CVE: CVE-2023-27133
Published: 2023-10-17
Description: TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%\TSplus-RemoteWork\Clients\www folder. This may enable privilege escalation if a different local user modifies a file. NOTE: CVE-2023-31067 and CVE-2023-31068 are only about the TSplus Remote Access product, not the TSplus Remote Work product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://packetstormsecurity.com/files/174272; https://packetstormsecurity.com/files/174272
CVE: CVE-2023-45803
Published: 2023-10-17
Description: urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-200
References: https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9; https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/
CVE: CVE-2023-45951
Published: 2023-10-17
Description: lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the $userip parameter at function.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LyLme/lylme_spage/issues/32; https://github.com/LyLme/lylme_spage/issues/32
CVE: CVE-2023-45952
Published: 2023-10-17
Description: An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/LyLme/lylme_spage/issues/33; https://github.com/LyLme/lylme_spage/issues/33
CVE: CVE-2023-4896
Published: 2023-10-17
Description: A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface. Successful exploitation allows the attacker to gain access to some data that could be further exploited to laterally access devices managed and monitored by the AirWave server.
CVSS Score: 6.8 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-015.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-015.txt
CVE: CVE-2023-43794
Published: 2023-10-17
Description: Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with creator access to query the underlying database. By supplying a specially crafted payload to the given an attacker can inject arbitrary SQL queries to be executed. Since this is a blind SQL injection, an attacker may need to use time-based payloads which would include a function to delay execution for a given number of seconds. The response time indicates, whether the result of the query execution was true or false. Depending on the result, the HTTP response will be returned after a given number of seconds, indicating TRUE, or immediately, indicating FALSE. In that way, an attacker can reveal the data present in the database. This vulnerability has been addressed in version 0.111.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-141`.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/nocodb/nocodb/security/advisories/GHSA-3m5q-q39v-xf8f; https://github.com/nocodb/nocodb/security/advisories/GHSA-3m5q-q39v-xf8f
CVE: CVE-2023-22015
Published: 2023-10-17
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 5.7.42 and prior and  8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuoct2023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-22019
Published: 2023-10-17
Description: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22025
Published: 2023-10-17
Description: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u381-perf, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 21.3.7 and  22.3.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVSS Score: 3.7 (LOW)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.debian.org/security/2023/dsa-5548; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22026
Published: 2023-10-17
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 5.7.42 and prior and  8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuoct2023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-22028
Published: 2023-10-17
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 5.7.43 and prior and  8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuoct2023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-22029
Published: 2023-10-17
Description: Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Workbench).   The supported version that is affected is 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Commerce Guided Search accessible data as well as  unauthorized read access to a subset of Oracle Commerce Guided Search accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 6.1 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22032
Published: 2023-10-17
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.34 and prior and  8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuoct2023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-22059
Published: 2023-10-17
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.34 and prior and  8.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 6.5 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuoct2023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/