deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-32412
Published: 2023-06-23
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to cause unexpected app termination or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://support.apple.com/en-us/HT213757; https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213759
CVE: CVE-2023-32413
Published: 2023-06-23
Description: A race condition was addressed with improved state handling. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to gain root privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://support.apple.com/en-us/HT213757; https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213759
CVE: CVE-2023-32414
Published: 2023-06-23
Description: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.4. An app may be able to break out of its sandbox.
CVSS Score: 8.6 (HIGH)
CWE: CWE-326
References: https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213758
CVE: CVE-2023-32415
Published: 2023-06-23
Description: This  issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.5 and iPadOS 16.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922
References: https://support.apple.com/en-us/HT213757; https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213761
CVE: CVE-2023-32417
Published: 2023-06-23
Description: This issue was addressed by restricting options offered on a locked device. This issue is fixed in watchOS 9.5. An attacker with physical access to a locked Apple Watch may be able to view user photos or contacts via accessibility features.
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/en-us/HT213764; https://support.apple.com/kb/HT213758; https://support.apple.com/en-us/HT213764
CVE: CVE-2023-32419
Published: 2023-06-23
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.5 and iPadOS 16.5. A remote attacker may be able to cause arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/en-us/HT213757; https://support.apple.com/en-us/HT213757
CVE: CVE-2023-32420
Published: 2023-06-23
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to cause unexpected system termination or read kernel memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/HT213757; https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213761
CVE: CVE-2023-32422
Published: 2023-06-23
Description: This issue was addressed by adding additional SQLite logging restrictions. This issue is fixed in iOS 16.5 and iPadOS 16.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to bypass Privacy preferences.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213757; https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213761
CVE: CVE-2023-32423
Published: 2023-06-23
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://support.apple.com/en-us/HT213757; https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213761
CVE: CVE-2023-32434
Published: 2023-06-23
Description: An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://seclists.org/fulldisclosure/2023/Oct/20; https://support.apple.com/en-us/HT213808; https://support.apple.com/en-us/HT213809
CVE: CVE-2023-32435
Published: 2023-06-23
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213671; https://support.apple.com/en-us/HT213676
CVE: CVE-2023-32439
Published: 2023-06-23
Description: A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://security.gentoo.org/glsa/202401-04; https://support.apple.com/en-us/HT213811; https://support.apple.com/en-us/HT213813
CVE: CVE-2023-34671
Published: 2023-06-23
Description: Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role in the user profile. An attack could occur over the public Internet in some cases.
CVSS Score: 8.8 (HIGH)
References: http://elenos.com; https://strik3r.gitbook.io/strik3r-blog/security-research/cves-pocs/cve-2023-34671; http://elenos.com
CVE: CVE-2023-35153
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` class on a page and setting the payload on the page title. Then, any user visiting `/xwiki/bin/view/AppWithinMinutes/ClassEditSheet` executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update `AppWithinMinutes.ClassEditSheet` with a patch.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/1b87fec1e5b5ec00b7a8c3c3f94f6c5e22547392#diff-79e725ec7125cced7d302e1a1f955a76745af26ef28a148981b810e85335d302; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4wc6-hqv9-qc97; https://jira.xwiki.org/browse/XWIKI-20365
CVE: CVE-2023-3317
Published: 2023-06-23
Description: A use-after-free flaw was found in mt7921_check_offload_capability in drivers/net/wireless/mediatek/mt76/mt7921/init.c in wifi mt76/mt7921 sub-component in the Linux Kernel. This flaw could allow an attacker to crash the system after 'features' memory release. This vulnerability could even lead to a kernel information leak problem.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416, CWE-416
References: https://patchwork.kernel.org/project/linux-wireless/patch/51fd8f76494348aa9ecbf0abc471ebe47a983dfd[PII_REDACTED].git.lorenzo%40kernel.org/; https://patchwork.kernel.org/project/linux-wireless/patch/51fd8f76494348aa9ecbf0abc471ebe47a983dfd[PII_REDACTED].git.lorenzo%40kernel.org/
CVE: CVE-2023-25003
Published: 2023-06-23
Description: A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnerabilities. Exploitation of this vulnerability may lead to code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009
CVE: CVE-2023-33565
Published: 2023-06-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2023-34672
Published: 2023-06-23
Description: Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role within the admin profile. An attack could occur over the public Internet in some cases.
CVSS Score: 8.8 (HIGH)
CWE: CWE-281
References: http://elenos.com; https://strik3r.gitbook.io/strik3r-blog/security-research/cves-pocs/cve-2023-34672; http://elenos.com
CVE: CVE-2023-34673
Published: 2023-06-23
Description: Elenos ETG150 FM transmitter running on version 3.12 was discovered to be leaking SMTP credentials and other sensitive information by exploiting the publicly accessible Memcached service. The attack can occur over the public Internet in some cases.
CVSS Score: 6.5 (MEDIUM)
References: http://elenos.com; https://strik3r.gitbook.io/strik3r-blog/security-research/cves-pocs/cve-2023-34673; http://elenos.com
CVE: CVE-2023-35155
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). For instance, the following URL execute an `alter` on the browser: `<xwiki-host>/xwiki/bin/view/Main/?viewer=share&send=1&target=&target=%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Crenniepak%40intigriti.me%3E&includeDocument=inline&message=I+wanted+to+share+this+page+with+you.`, where `<xwiki-host>` is the URL of your XWiki installation. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8.

CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fwwj-wg89-7h4c; https://jira.xwiki.org/browse/XWIKI-20370; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fwwj-wg89-7h4c
CVE: CVE-2023-35156
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. 

CVSS Score: 9.6 (CRITICAL)
CWE: CWE-87, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/13875a6437d4525ac4aeea25918f2d2dffac9ee1; https://github.com/xwiki/xwiki-platform/commit/24ec12890ac7fa6daec8d0b3435cfcba11362fd5; https://github.com/xwiki/xwiki-platform/commit/e80d22d193df364b07bab[PII_REDACTED]f91a8984a
CVE: CVE-2023-35157
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-phwm-87rg-27qq; https://jira.xwiki.org/browse/XWIKI-20339
CVE: CVE-2023-35158
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: > /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. 
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-87
References: https://github.com/xwiki/xwiki-platform/commit/d[PII_REDACTED]c8355ed44ada273e91df91f682738; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mwxj-g7fw-7hc8; https://jira.xwiki.org/browse/XWIKI-20352
CVE: CVE-2023-35159
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-87, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/5c20ff5e3bdea50f1053fe99a27e011b8d0e4b34; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x234-mg7q-m8g8; https://jira.xwiki.org/browse/XWIKI-20583
CVE: CVE-2023-35160
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/XWiki/Main xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-87, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/dbc92dcdace33823ffd1e[PII_REDACTED]cb5fc6a7f; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r8xc-xxh3-q5x3; https://jira.xwiki.org/browse/XWIKI-20343
CVE: CVE-2023-35161
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.2-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

CVSS Score: 9.6 (CRITICAL)
CWE: CWE-87, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/8f5a889b7cd140770e54f5b4195d88058790e305; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4xm7-5q79-3fch; https://jira.xwiki.org/browse/XWIKI-20583
CVE: CVE-2023-35162
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: > <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/9f01166b1a8ee[PII_REDACTED]eb5040302df067e4d; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-q9hg-9qj2-mxf9; https://jira.xwiki.org/browse/XWIKI-20342
CVE: CVE-2023-3393
Published: 2023-06-23
Description:  Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/fossbilling/fossbilling/commit/47343fb58db5c17c14bc6941dacbeb9c96957351; https://huntr.dev/bounties/e4df9280-900a-407a-a07e-e7fef3345914; https://github.com/fossbilling/fossbilling/commit/47343fb58db5c17c14bc6941dacbeb9c96957351
CVE: CVE-2023-3394
Published: 2023-06-23
Description: Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384
References: https://github.com/fossbilling/fossbilling/commit/b9c35a174750f1463aea86168524efce6cd48ef7; https://huntr.dev/bounties/84bf3e85-cdeb-4b8d-9ea4-74156dbda83f; https://github.com/fossbilling/fossbilling/commit/b9c35a174750f1463aea86168524efce6cd48ef7
CVE: CVE-2023-27908
Published: 2023-06-23
Description: A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0010; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0010
CVE: CVE-2023-34188
Published: 2023-06-23
Description: The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server; https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f; https://github.com/cesanta/mongoose/compare/7.9...7.10
CVE: CVE-2023-34203
Published: 2023-06-23
Description: In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and 12.3.x through 12.6.x before 12.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://www.progress.com/openedge; https://www.progress.com/openedge
CVE: CVE-2023-34460
Published: 2023-06-23
Description: Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.


CVSS Score: 4.8 (MEDIUM)
CWE: CWE-285
References: https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564; https://github.com/tauri-apps/tauri/pull/6969#discussion_r[PII_REDACTED]; https://github.com/tauri-apps/tauri/pull/7227
CVE: CVE-2023-35167
Published: 2023-06-23
Description: Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: https://github.com/remult/remult/commit/6892ae97134126d8710ef7302bb2fc37730994c5; https://github.com/remult/remult/releases/tag/v0.20.6; https://github.com/remult/remult/security/advisories/GHSA-7hh3-3x64-v2g9
CVE: CVE-2023-35759
Published: 2023-06-23
Description: In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/176978/WhatsUp-Gold-2022-22.1.0-Build-39-Cross-Site-Scripting.html; https://community.progress.com/s/article/Product-Alert-Bulletin-June-2023; http://packetstormsecurity.com/files/176978/WhatsUp-Gold-2022-22.1.0-Build-39-Cross-Site-Scripting.html
CVE: CVE-2023-35931
Published: 2023-06-23
Description: Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.



CVSS Score: 3.1 (LOW)
CWE: CWE-526
References: https://github.com/ericcornelissen/shescape/commit/d0fce70f987ac0d8331f93cb45d47e79436173ac; https://github.com/ericcornelissen/shescape/pull/982; https://github.com/ericcornelissen/shescape/releases/tag/v1.7.1
CVE: CVE-2023-36345
Published: 2023-06-23
Description: A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://youtu.be/KxjsEqNWU9E; https://yuyudhn.github.io/pos-codekop-vulnerability/; https://youtu.be/KxjsEqNWU9E
CVE: CVE-2023-36346
Published: 2023-06-23
Description: POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173280/Sales-Of-Cashier-Goods-1.0-Cross-Site-Scripting.html; https://www.youtube.com/watch?v=bbbA-q1syrA; https://yuyudhn.github.io/pos-codekop-vulnerability/
CVE: CVE-2023-36348
Published: 2023-06-23
Description: POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://packetstormsecurity.com/files/173278/POS-Codekop-2.0-Shell-Upload.html; https://www.youtube.com/watch?v=Ge0zqY0sGiQ; https://yuyudhn.github.io/pos-codekop-vulnerability/
CVE: CVE-2023-3212
Published: 2023-06-23
Description: A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=2214348; https://github.com/torvalds/linux/commit/504a10d9e46bc37b23d0a1ae2f28973c8516e636; https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html