deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-45134
Published: 2023-10-25
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in version 3.1-milestone-1 and prior to 13.4-rc-1, `org.xwiki.platform:xwiki-platform-web-templates` prior to versions 14.10.2 and 15.5-rc-1, and `org.xwiki.platform:xwiki-web-standard` starting in version 2.4-milestone-2 and prior to version 3.1-milestone-1 are vulnerable to cross-site scripting. An attacker can create a template provider on any document that is part of the wiki (could be the attacker's user profile) that contains malicious code. This code is executed when this template provider is selected during document creation which can be triggered by sending the user to a URL. For the attacker, the only requirement is to have an account as by default the own user profile is editable. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation. This has been patched in `org.xwiki.platform:xwiki-platform-web` 13.4-rc-1, `org.xwiki.platform:xwiki-platform-web-templates` 14.10.2 and 15.5-rc-1, and `org.xwiki.platform:xwiki-web-standard` 3.1-milestone-1 by adding the appropriate escaping. The vulnerable template file createinline.vm is part of XWiki's WAR and can be patched by manually applying the changes from the fix.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/ba56fda175156dd35035f2b8c86cbd8ef1f90c2e; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gr82-8fj2-ggc3; https://jira.xwiki.org/browse/XWIKI-20962
CVE: CVE-2023-45135
Published: 2023-10-25
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In `org.xwiki.platform:xwiki-platform-web` versions 7.2-milestone-2 until 14.10.12 and `org.xwiki.platform:xwiki-platform-web-templates` prior to versions 14.10.12 and 15.5-rc-1, it is possible to pass a title to the page creation action that isn't displayed at first but then executed in the second step. This can be used by an attacker to trick a victim to execute code, allowing script execution if the victim has script right or remote code execution including full access to the XWiki instance if the victim has programming right.

For the attack to work, the attacker needs to convince the victim to visit a link like `<xwiki-host>/xwiki/bin/create/NonExistingSpace/WebHome?title=$services.logging.getLogger(%22foo%22).error(%22Script%20executed!%22)` where `<xwiki-host>`  is the URL of the Wiki installation and to then click on the "Create" button on that page. The page looks like a regular XWiki page that the victim would also see when clicking the button to create a page that doesn't exist yet, the malicious code is not displayed anywhere on that page. After clicking the "Create" button, the malicious title would be displayed but at this point, the code has already been executed and the attacker could use this code also to hide the attack, e.g., by redirecting the victim again to the same page with an innocent title. It thus seems plausible that this attack could work if the attacker can place a fake "create page" button on a page which is possible with edit right.

This has been patched in `org.xwiki.platform:xwiki-platform-web` version 14.10.12 and `org.xwiki.platform:xwiki-platform-web-templates` versions 14.10.12 and 15.5-rc-1 by displaying the title already in the first step such that the victim can notice the attack before continuing. It is possible to manually patch the modified files from the patch in an existing installation. For the JavaScript change, the minified JavaScript file would need to be obtained from a build of XWiki and replaced accordingly.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-116, CWE-116
References: https://github.com/xwiki/xwiki-platform/commit/199e27ce7016757e66fa7cea99e718044a1b639b; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghf6-2f42-mjh9; https://jira.xwiki.org/browse/XWIKI-20869
CVE: CVE-2023-45136
Published: 2023-10-25
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy (disabled by default), XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflected cross-site scripting attack in the page creation form. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation. This has been patched in XWiki 14.10.12 and 15.5-rc-1 by adding appropriate escaping. The vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the changes from the fix.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/ba56fda175156dd35035f2b8c86cbd8ef1f90c2e; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qcj9-gcpg-4w2w; https://jira.xwiki.org/browse/XWIKI-20854
CVE: CVE-2023-46408
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/16/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/16/1.md
CVE: CVE-2023-46409
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/13/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/13/1.md
CVE: CVE-2023-46410
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/10/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/10/1.md
CVE: CVE-2023-46411
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/11/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/11/1.md
CVE: CVE-2023-46412
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/15/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/15/1.md
CVE: CVE-2023-46413
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/1/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/1/1.md
CVE: CVE-2023-46414
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/14/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/14/1.md
CVE: CVE-2023-46415
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/17/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/17/1.md
CVE: CVE-2023-46416
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/12/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/12/1.md
CVE: CVE-2023-46417
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/2/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/2/1.md
CVE: CVE-2023-46418
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/7/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/7/1.md
CVE: CVE-2023-46419
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/6/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/6/1.md
CVE: CVE-2023-46420
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/5/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/5/1.md
CVE: CVE-2023-46421
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/8/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/8/1.md
CVE: CVE-2023-46422
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/9/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/9/1.md
CVE: CVE-2023-46423
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/4/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/4/1.md
CVE: CVE-2023-46424
Published: 2023-10-25
Description: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/3/1.md; https://www.totolink.cn/index.php/home/menu/detail.html?menu_listtpl=download&id=88&ids=36; https://github.com/XYIYM/Digging/blob/main/TOTOLINK/X6000R/3/1.md
CVE: CVE-2023-5043
Published: 2023-10-25
Description: Ingress nginx annotation injection causes arbitrary command execution.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20, CWE-74
References: http://www.openwall.com/lists/oss-security/2023/10/25/4; https://github.com/kubernetes/ingress-nginx/issues/10571; https://groups.google.com/g/kubernetes-security-announce/c/pVsXsOpxYZo
CVE: CVE-2023-5044
Published: 2023-10-25
Description: Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20, CWE-94
References: http://www.openwall.com/lists/oss-security/2023/10/25/3; https://github.com/kubernetes/ingress-nginx/issues/10572; https://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0
CVE: CVE-2023-5367
Published: 2023-10-25
Description: A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://access.redhat.com/errata/RHSA-2023:6802; https://access.redhat.com/errata/RHSA-2023:6808; https://access.redhat.com/errata/RHSA-2023:7373
CVE: CVE-2023-5380
Published: 2023-10-25
Description: A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/errata/RHSA-2023:7428; https://access.redhat.com/errata/RHSA-2024:2169; https://access.redhat.com/errata/RHSA-2024:2298
CVE: CVE-2023-5574
Published: 2023-10-25
Description: A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/errata/RHSA-2024:2298; https://access.redhat.com/security/cve/CVE-2023-5574; https://bugzilla.redhat.com/show_bug.cgi?id=2244735
CVE: CVE-2023-45137
Published: 2023-10-25
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in version 3.1-milestone-2 and prior to version 13.4-rc-1, as well as `org.xwiki.platform:xwiki-platform-web-templates` prior to versions 14.10.12 and 15.5-rc-1, are vulnerable to cross-site scripting. When trying to create a document that already exists, XWiki displays an error message in the form for creating it. Due to missing escaping, this error message is vulnerable to raw HTML injection and thus XSS. The injected code is the document reference of the existing document so this requires that the attacker first creates a non-empty document whose name contains the attack code. This has been patched in `org.xwiki.platform:xwiki-platform-web` version 13.4-rc-1 and `org.xwiki.platform:xwiki-platform-web-templates` versions 14.10.12 and 15.5-rc-1 by adding the appropriate escaping. The vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the changes from the fix.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/ed8ec747967f8a16434806e727a57214a8843581; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-93gh-jgjj-r929; https://jira.xwiki.org/browse/XWIKI-20961
CVE: CVE-2023-46133
Published: 2023-10-25
Description: CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 2.1.0 contains a patch for this issue. As a workaround, configure CryptoES to use SHA256 with at least 250,000 iterations.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-328, CWE-916, CWE-327
References: https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757; https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h; https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757
CVE: CVE-2023-46134
Published: 2023-10-25
Description: D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code on the server. This issue has been patched in version 3.7.0 by turning off "Custom Filter" input by default. The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users.

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/man-group/dtale/commit/bf8c54ab2490803f45f0652a9a0e221a94d39668; https://github.com/man-group/dtale/security/advisories/GHSA-jq6c-r9xf-qxjm; https://github.com/man-group/dtale/commit/bf8c54ab2490803f45f0652a9a0e221a94d39668
CVE: CVE-2023-46137
Published: 2023-10-25
Description: Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm; https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm; https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html
CVE: CVE-2023-46233
Published: 2023-10-25
Description: crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-328, CWE-916, CWE-327
References: https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a; https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf; https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html
CVE: CVE-2023-38845
Published: 2023-10-25
Description: An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38845.md; https://liff.line.me/[PII_REDACTED]-8nDEQNbe; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38845.md
CVE: CVE-2023-38846
Published: 2023-10-25
Description: An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38846.md; https://liff.line.me/[PII_REDACTED]-KmmGkje5; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38846.md
CVE: CVE-2023-38847
Published: 2023-10-25
Description: An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38847.md; https://liff.line.me/[PII_REDACTED]-oX5J26Ak; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38847.md
CVE: CVE-2023-38848
Published: 2023-10-25
Description: An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38848.md; https://liff.line.me/[PII_REDACTED]-Wk2xYj38; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38848.md
CVE: CVE-2023-38849
Published: 2023-10-25
Description: An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38849.md; https://liff.line.me/[PII_REDACTED]-yvGg5PjN; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38849.md