deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-25202
Published: 2024-02-28
Description: Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attackers to run arbitrary code via the search bar.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://drive.google.com/file/d/1oMNcChsXPMP9pu9lIE2C11n8mzkmLhcY/view; https://github.com/Agampreet-Singh/CVE-2024-25202; https://medium.com/%40agampreetsingh_93704/cve-2024-25202-discover-by-agampreet-singh-cyber-security-expert-ff8e32f5cf52
CVE: CVE-2024-25435
Published: 2024-02-28
Description: A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Msg parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/machisri/CVEs-and-Vulnerabilities/blob/main/CVE-2024-25435%20-%3E%20Reflected%20XSS%20on%20md1patient%20login%20page; https://github.com/machisri/CVEs-and-Vulnerabilities/blob/main/CVE-2024-25435%20-%3E%20Reflected%20XSS%20on%20md1patient%20login%20page
CVE: CVE-2024-25859
Published: 2024-02-28
Description: A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://www.blesta.com/2024/02/08/security-advisory/; https://www.blesta.com/2024/02/08/security-advisory/
CVE: CVE-2024-27285
Published: 2024-02-28
Description: YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.  This vulnerability is fixed in 0.9.36.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa; https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be; https://github.com/lsegal/yard/pull/1538
CVE: CVE-2023-25922
Published: 2024-02-28
Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.  IBM X-Force ID:  247621.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247621; https://www.ibm.com/support/pages/node/6964516; https://exchange.xforce.ibmcloud.com/vulnerabilities/247621
CVE: CVE-2023-25925
Published: 2024-02-28
Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  IBM X-Force ID:  247632.
CVSS Score: 8.5 (HIGH)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247632; https://www.ibm.com/support/pages/node/6964516; https://exchange.xforce.ibmcloud.com/vulnerabilities/247632
CVE: CVE-2023-45859
Published: 2024-02-28
Description: In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
CVSS Score: 7.6 (HIGH)
CWE: CWE-922
References: https://github.com/hazelcast/hazelcast/pull/25509; https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66; https://github.com/hazelcast/hazelcast/pull/25509
CVE: CVE-2023-45873
Published: 2024-02-28
Description: An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2023-49338
Published: 2024-02-28
Description: Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2024-1972
Published: 2024-02-28
Description: A vulnerability was found in SourceCodester Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Employer/EditProfile.php. The manipulation of the argument Address leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255128.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://prnt.sc/gtk7Fj43Qwy9; https://vuldb.com/?ctiid.255128; https://vuldb.com/?id.255128
CVE: CVE-2024-22983
Published: 2024-02-28
Description: SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: http://projectworlds.com; http://visitor.com; https://github.com/keru6k/CVE-2024-22983/blob/main/CVE-2024-22983.md
CVE: CVE-2024-25350
Published: 2024-02-28
Description: SQL Injection vulnerability in /zms/admin/edit-ticket.php in PHPGurukul Zoo Management System 1.0 via tickettype and tprice parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/ZooManagementSystem-SQL_Injection_Edit_Ticket.md; https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/ZooManagementSystem-SQL_Injection_Edit_Ticket.md
CVE: CVE-2024-25351
Published: 2024-02-28
Description: SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL commands via the editid parameter.
CVSS Score: 3.8 (LOW)
CWE: CWE-89
References: https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/ZooManagementSystem-SQL_Injection_Change_Image.md; https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/ZooManagementSystem-SQL_Injection_Change_Image.md
CVE: CVE-2024-25866
Published: 2024-02-28
Description: A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email parameter in the index.php component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-SQL_Injection_Login.md; https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-SQL_Injection_Login.md
CVE: CVE-2024-25867
Published: 2024-02-28
Description: A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the membershipType and membershipAmount parameters in the add_type.php component.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-SQL_Injection_Add_Type.md; https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-SQL_Injection_Add_Type.md
CVE: CVE-2024-25868
Published: 2024-02-28
Description: A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via the membershipType parameter in the add_type.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-Stored_XSS_Add_Type.md; https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-Stored_XSS_Add_Type.md
CVE: CVE-2024-25869
Published: 2024-02-28
Description: An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload of a crafted php file in the settings.php component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-Unrestricted_Fileupload.md; https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-Unrestricted_Fileupload.md
CVE: CVE-2024-26450
Published: 2024-02-28
Description: An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forgery vulnerability to issue a Stored Cross Site Scripting payload stored within an Admin user's dashboard, executing remote JavaScript. This can be used to upload a new PHP file under an administrator and directly call that file from the victim's instance to connect back to a malicious listener.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://github.com/Piwigo/Piwigo/security/advisories/GHSA-p362-cfpj-q55f; https://github.com/Piwigo/Piwigo/security/advisories/GHSA-p362-cfpj-q55f
CVE: CVE-2024-26476
Published: 2024-02-28
Description: An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq_form.php component.
CVSS Score: 3.5 (LOW)
CWE: CWE-918
References: https://github.com/c4v4r0n/Research/blob/main/openemr_BlindSSRF/README.md; https://github.com/mpdf/mpdf/issues/867; https://github.com/c4v4r0n/Research/blob/main/openemr_BlindSSRF/README.md
CVE: CVE-2023-5617
Published: 2024-02-28
Description: 
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.




CVSS Score: 5.3 (MEDIUM)
CWE: CWE-550, CWE-209
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]4861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]4861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617
CVE: CVE-2024-21798
Published: 2024-02-28
Description: ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affected product with specially crafted content. When another administrative user logs in and operates the product, an arbitrary script may be executed on the web browser. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B".
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN44166658/; https://www.elecom.co.jp/news/security/20240220-01/; https://jvn.jp/en/jp/JVN44166658/
CVE: CVE-2024-22532
Published: 2024-02-28
Description: Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers to cause a denial of service via crafted xwd file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122
References: https://github.com/pwndorei/CVE-2024-22532; https://github.com/pwndorei/CVE-2024-22532
CVE: CVE-2024-23910
Published: 2024-02-28
Description: Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the authentication of administrators and to perform unintended operations to the affected product. Note that WMC-X1800GST-B and WSC-X1800GS-B are also included in e-Mesh Starter Kit "WMC-2LX-B".
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN44166658/; https://www.elecom.co.jp/news/security/20240220-01/; https://jvn.jp/en/jp/JVN44166658/
CVE: CVE-2024-25422
Published: 2024-02-28
Description: SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMCMS_Menu.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/tzyyyyyyy/semcms; https://github.com/tzyyyyyyy/semcms
CVE: CVE-2024-25579
Published: 2024-02-28
Description: OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B".
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU99444194/; https://www.elecom.co.jp/news/security/20240220-01/; https://jvn.jp/en/vu/JVNVU99444194/
CVE: CVE-2024-26559
Published: 2024-02-28
Description: An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-922
References: https://syst1m.cn/2024/01/22/U%E9%AA%8C%E8%AF%81%E7%BD%91%E7%BB%9C%E7%94%A8%E6%88%B7%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/; https://syst1m.cn/2024/01/22/U%E9%AA%8C%E8%AF%81%E7%BD%91%E7%BB%9C%E7%94%A8%E6%88%B7%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/
CVE: CVE-2024-25126
Published: 2024-02-29
Description: Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941; https://github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462; https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49
CVE: CVE-2024-26141
Published: 2024-02-29
Description: Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-400
References: https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944; https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9; https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48b
CVE: CVE-2024-26146
Published: 2024-02-29
Description: Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942; https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716; https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582
CVE: CVE-2022-34269
Published: 2024-02-29
Description: An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/load_dtd?system_id= blind SSRF attack to deploy JSP code to the Apache Axis service running on the localhost interface, leading to command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://www.rws.com/localization/products/trados-enterprise/worldserver/; https://www.triskelelabs.com/vulnerabilities-in-rws-worldserver; https://www.rws.com/localization/products/trados-enterprise/worldserver/
CVE: CVE-2022-34270
Published: 2024-02-29
Description: An issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the Administrator role via UserWSUserManager.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.rws.com/localization/products/trados-enterprise/worldserver/; https://www.triskelelabs.com/vulnerabilities-in-rws-worldserver; https://www.rws.com/localization/products/trados-enterprise/worldserver/
CVE: CVE-2022-36677
Published: 2024-02-29
Description: Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/JoJenH/Note4SelfVul/blob/main/obsidian-mind-map.md; https://github.com/lynchjames/obsidian-mind-map/issues/87; https://github.com/JoJenH/Note4SelfVul/blob/main/obsidian-mind-map.md
CVE: CVE-2023-25921
Published: 2024-02-29
Description: 
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247620.


CVSS Score: 8.5 (HIGH)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247620; https://www.ibm.com/support/pages/node/6964516; https://exchange.xforce.ibmcloud.com/vulnerabilities/247620
CVE: CVE-2023-25926
Published: 2024-02-29
Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  247599.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247599; https://www.ibm.com/support/pages/node/6964516; https://exchange.xforce.ibmcloud.com/vulnerabilities/247599
CVE: CVE-2023-27151
Published: 2024-02-29
Description: openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) via the Name, Description, or Activity Number field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cve-2023-27151-html-injection-activity-tracker/; https://www.opencrx.org/; https://www.esecforte.com/cve-2023-27151-html-injection-activity-tracker/
CVE: CVE-2023-34198
Published: 2024-02-29
Description: In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot results in the usage of an object of the :any" type, which may have unexpected results for access control.
CVSS Score: 7.3 (HIGH)
References: https://advisories.stormshield.eu/2023-019; https://advisories.stormshield.eu/2023-019
CVE: CVE-2023-37495
Published: 2024-02-29
Description: Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administrator are secured using a cryptographically weak hash algorithm.  This could enable attackers with access to the hashed value to determine a user's password, e.g. using a brute force attack.  This issue does not impact Person documents created through  user registration https://help.hcltechsw.com/domino/10.0.1/admin/conf_userregistration_c.html . 

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-306
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107585; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107585
CVE: CVE-2023-37529
Published: 2024-02-29
Description: A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information.  This is not the same vulnerability as identified in CVE-2023-37530.

CVSS Score: 3.0 (LOW)
CWE: CWE-79, CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209
CVE: CVE-2023-37530
Published: 2024-02-29
Description: A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information.  

CVSS Score: 3.0 (LOW)
CWE: CWE-79, CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209
CVE: CVE-2023-37531
Published: 2024-02-29
Description: A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form field of a webpage by a user with privileged access. 

CVSS Score: 3.3 (LOW)
CWE: CWE-79, CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209
CVE: CVE-2023-38372
Published: 2024-02-29
Description: An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user.  IBM X-Force ID:  261201.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/261201; https://www.ibm.com/support/pages/node/7020635; https://exchange.xforce.ibmcloud.com/vulnerabilities/261201
CVE: CVE-2023-41165
Published: 2024-02-29
Description: An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9. An administrator with write access to the SNS firewall can configure a login disclaimer with malicious JavaScript elements that can result in data theft.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://advisories.stormshield.eu/2023-020/; https://advisories.stormshield.eu/2023-020/
CVE: CVE-2023-43769
Published: 2024-02-29
Description: An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics.
CVSS Score: 6.3 (MEDIUM)
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2023-44341
Published: 2024-02-29
Description: Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/indesign/apsb23-55.html; https://helpx.adobe.com/security/products/indesign/apsb23-55.html
CVE: CVE-2023-44342
Published: 2024-02-29
Description: Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/indesign/apsb23-55.html; https://helpx.adobe.com/security/products/indesign/apsb23-55.html