deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2036
Published: 2023-04-14
Description: A vulnerability was found in Campcodes Video Sharing Website 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file upload.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-225914 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Video%20Sharing%20Website/Video%20Sharing%20Website%20vuln%204.pdf; https://vuldb.com/?ctiid.225914; https://vuldb.com/?id.225914
CVE: CVE-2023-2037
Published: 2023-04-14
Description: A vulnerability was found in Campcodes Video Sharing Website 1.0. It has been classified as critical. This affects an unknown part of the file watch.php. The manipulation of the argument code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225915.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Video%20Sharing%20Website/Video%20Sharing%20Website%20vuln%201.pdf; https://vuldb.com/?ctiid.225915; https://vuldb.com/?id.225915
CVE: CVE-2023-2038
Published: 2023-04-14
Description: A vulnerability was found in Campcodes Video Sharing Website 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin_class.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225916.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Video%20Sharing%20Website/Video%20Sharing%20Website%20vuln%202.pdf; https://vuldb.com/?ctiid.225916; https://vuldb.com/?id.225916
CVE: CVE-2023-2039
Published: 2023-04-14
Description: A vulnerability was found in novel-plus 3.6.2. It has been rated as critical. This issue affects some unknown processing of the file /author/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225917 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yece688/yece/blob/main/Novel-Plus%20Code%20audit2.0.pdf; https://vuldb.com/?ctiid.225917; https://vuldb.com/?id.225917
CVE: CVE-2023-1863
Published: 2023-04-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eskom Water Metering Software allows Command Line Execution through SQL Injection.This issue affects Water Metering Software: before 23.04.06.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0225; https://www.usom.gov.tr/bildirim/tr-23-0225
CVE: CVE-2023-2040
Published: 2023-04-14
Description: A vulnerability classified as critical has been found in novel-plus 3.6.2. Affected is an unknown function of the file /news/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225918 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/morty-py/morty/blob/main/Novel-Plus3.6.2%20sqli.pdf; https://vuldb.com/?ctiid.225918; https://vuldb.com/?id.225918
CVE: CVE-2023-2041
Published: 2023-04-14
Description: A vulnerability classified as critical was found in novel-plus 3.6.2. Affected by this vulnerability is an unknown functionality of the file /category/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/langove/llov/blob/main/Novel-Plus%20code%20audit.pdf; https://vuldb.com/?ctiid.225919; https://vuldb.com/?id.225919
CVE: CVE-2023-2042
Published: 2023-04-14
Description: A vulnerability, which was classified as problematic, has been found in DataGear up to 4.7.0/5.1.0. Affected by this issue is some unknown functionality of the component JDBC Server Handler. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/yangyanglo/ForCVE/blob/main/2023-0x06.md; https://vuldb.com/?ctiid.225920; https://vuldb.com/?id.225920
CVE: CVE-2023-2043
Published: 2023-04-14
Description: A vulnerability, which was classified as problematic, was found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/customerdb/operator.svc/a of the component Edit Handler. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-225921 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.225921; https://vuldb.com/?id.225921; https://vuldb.com/?ctiid.225921
CVE: CVE-2023-2044
Published: 2023-04-14
Description: A vulnerability has been found in Control iD iDSecure 4.7.29.1 and classified as problematic. This vulnerability affects unknown code of the component Dispositivos Page. The manipulation of the argument IP-DNS leads to cross site scripting. The attack can be initiated remotely. VDB-225922 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.225922; https://vuldb.com/?id.225922; https://vuldb.com/?ctiid.225922
CVE: CVE-2023-2047
Published: 2023-04-14
Description: A vulnerability was found in Campcodes Advanced Online Voting System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument voter leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225932.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.225932; https://vuldb.com/?id.225932
CVE: CVE-2023-2048
Published: 2023-04-14
Description: A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/voters_row.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225933 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.225933; https://vuldb.com/?id.225933
CVE: CVE-2023-2049
Published: 2023-04-14
Description: A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ballot_up.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-225934 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.225934; https://vuldb.com/?id.225934
CVE: CVE-2022-47027
Published: 2023-04-14
Description: Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnerability and achieve arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://corporate.timmystudios.com/; https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2022-47027/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.jb.gokeyboard.theme.timssfasttypingkeyboard
CVE: CVE-2023-1617
Published: 2023-04-14
Description: Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules).  This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.
This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]70-en-original-1.0.pdf; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]70-en-original-1.0.pdf
CVE: CVE-2023-26756
Published: 2023-04-14
Description: The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits and password-quality features.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: http://seclists.org/fulldisclosure/2024/Apr/27; https://googleinformationsworld.blogspot.com/2023/04/revive-adserver-541-vulnerable-to-brute.html; https://www.esecforte.com/login-page-brute-force-attack/
CVE: CVE-2023-27193
Published: 2023-04-14
Description: An issue found in DUALSPACE v.1.1.3 allows a local attacker to gain privileges via the key_ad_new_user_avoid_time field.
CVSS Score: 7.8 (HIGH)
References: http://www.dualspace.com/pc/en/products.html; https://apkpure.com/cn/space-clean-super-cleaner/com.ludashi.xsuperclean; https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27193/CVE%20detail.md
CVE: CVE-2023-27643
Published: 2023-04-14
Description: An issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button in Queue and Select Folders button in Library
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27643/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.maxmpz.audioplayer; https://powerampapp.com/
CVE: CVE-2023-27648
Published: 2023-04-14
Description: Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary code via the dex file in the internal storage.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://corporate.timmystudios.com/; https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27648/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.jb.gokeyboard.theme.twchangecolorofkeypad
CVE: CVE-2023-27649
Published: 2023-04-14
Description: SQL injection vulnerability found in Trusted Tools Free Music v.2.1.0.47, v.2.0.0.46, v.1.9.1.45, v.1.8.2.43 allows a remote attacker to cause a denial of service via the search history table
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://bestools.group/; https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27649/CVE%20detail.md; https://play.google.com/store/apps/details?id=freemusic.download.musicplayer.mp3player
CVE: CVE-2023-27651
Published: 2023-04-14
Description: An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.egostudiogroup.com/; https://apkpure.com/cn/super-clean-phone-cleaner/com.egostudio.clean/download; https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27651/CVE%20detail.md
CVE: CVE-2023-27653
Published: 2023-04-14
Description: An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a denial of service via the SharedPreference files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27653/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.scorp.who; https://www.whoapp.live/
CVE: CVE-2023-27666
Published: 2023-04-14
Description: Auto Dealer Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the name parameter at /classes/SystemSettings.php?f=update_settings.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://auto.com; https://gist.github.com/Flower-fertilizer/a1fb260c02353906f2d2808656dd1559; https://www.sourcecodester.com/php/15371/auto-dealer-management-system-phpoop-free-source-code.html
CVE: CVE-2023-29569
Published: 2023-04-14
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/cesanta/mjs/issues/239; https://github.com/z1r00/fuzz_vuln/blob/main/mjs/SEGV/mjs_ffi/readme.md; https://github.com/cesanta/mjs/issues/239
CVE: CVE-2023-29584
Published: 2023-04-14
Description: mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the MP4GetVideoProfileLevel function at /src/mp4.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/enzo1982/mp4v2/issues/30; https://github.com/z1r00/fuzz_vuln/blob/main/mp4v2/heap-buffer-overflow/MP4GetVideoProfileLevel/readme.md; https://github.com/enzo1982/mp4v2/issues/30
CVE: CVE-2023-2050
Published: 2023-04-14
Description: A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/positions_add.php. The manipulation of the argument description leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225935.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.225935; https://vuldb.com/?id.225935
CVE: CVE-2023-2051
Published: 2023-04-14
Description: A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Affected is an unknown function of the file /admin/positions_row.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225936.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.225936; https://vuldb.com/?id.225936
CVE: CVE-2023-2052
Published: 2023-04-14
Description: A vulnerability classified as critical was found in Campcodes Advanced Online Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ballot_down.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225937 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.225937; https://vuldb.com/?id.225937
CVE: CVE-2023-26559
Published: 2023-04-14
Description: A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build[PII_REDACTED] and Oxygen Content Fusion before 5.0.3 build[PII_REDACTED] allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build[PII_REDACTED] and 23.1.1.4 build[PII_REDACTED] are also fixed versions.)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://oxygenxml.com; https://www.oxygenxml.com/security/advisory/SYNC-2023-042301.html; https://oxygenxml.com
CVE: CVE-2023-26980
Published: 2023-04-14
Description: PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher will be loaded before any user applications.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://docs.google.com/document/d/189b1494s8RF8ksaOijKhKb-3B8gj3pLUmgn0dqg-jqs/edit; https://drive.google.com/drive/u/0/folders/14X-XTYhkiaIVBS3zf68VigG4-imbKEuV; https://uploads.strikinglycdn.com/files/f1d54bf4-3803-480c-b4d3-0943f7dac76e/A920_EN_20200605.pdf?id=237392
CVE: CVE-2023-2053
Published: 2023-04-14
Description: A vulnerability, which was classified as critical, has been found in Campcodes Advanced Online Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/candidates_row.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-225938 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%207.pdf; https://vuldb.com/?ctiid.225938; https://vuldb.com/?id.225938
CVE: CVE-2023-2054
Published: 2023-04-14
Description: A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. This affects an unknown part of the file /admin/positions_delete.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225939.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%208.pdf; https://vuldb.com/?ctiid.225939; https://vuldb.com/?id.225939
CVE: CVE-2023-2055
Published: 2023-04-14
Description: A vulnerability has been found in Campcodes Advanced Online Voting System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/config_save.php. The manipulation of the argument title leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225940.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%209.pdf; https://vuldb.com/?ctiid.225940; https://vuldb.com/?id.225940
CVE: CVE-2022-45170
Published: 2023-04-14
Description: An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malicious user, logged into a victim's account, is able to decipher a file without knowing the key set by the user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-45173
Published: 2023-04-14
Description: An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /api/v1/vdeskintegration/challenge endpoint. Because only the client-side verifies whether a check was successful, an attacker can modify the response, and fool the application into concluding that the TOTP was correct.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-45174
Published: 2023-04-14
Description: An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/challenge endpoint. The correctness of the TOTP is not checked properly, and can be bypassed by passing any string as the backup code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-45175
Published: 2023-04-14
Description: An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/{ID-FILE]/c/{N]/{C]/websocket endpoint. A malicious unauthenticated user can access cached files in the OnlyOffice backend of other users by guessing the file ID of a target file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-45178
Published: 2023-04-14
Description: An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate endpoint, the /settings/guest-settings endpoint, the /settings/samlusers-settings endpoint, and the /settings/users-settings endpoint. A malicious user (already logged in as a SAML User) is able to achieve privilege escalation from a low-privilege user (FGM user) to an administrative user (GGU user), including the administrator, or create new users even without an admin role.
CVSS Score: 8.8 (HIGH)
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-45180
Published: 2023-04-14
Description: An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdesk_{DOMAIN]/export endpoint. A malicious user, authenticated to the product without any specific privilege, can use the API for exporting information about all users of the system (an operation intended to only be available to the system administrator).
CVSS Score: 6.5 (MEDIUM)
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2023-1803
Published: 2023-04-14
Description: Authentication Bypass by Alternate Name vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass.This issue affects Redline Router: before 7.17.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-289, CWE-287
References: https://www.usom.gov.tr/bildirim/tr-23-0227; https://www.usom.gov.tr/bildirim/tr-23-0227
CVE: CVE-2023-1833
Published: 2023-04-14
Description: Authentication Bypass by Primary Weakness vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass.This issue affects Redline Router: before 7.17.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305, CWE-287
References: https://www.usom.gov.tr/bildirim/tr-23-0227; https://www.usom.gov.tr/bildirim/tr-23-0227