deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-31021
Published: 2023-11-02
Description: NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause a NULL-pointer dereference, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5491; https://nvidia.custhelp.com/app/answers/detail/a_id/5491
CVE: CVE-2023-31022
Published: 2023-11-02
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5491; https://nvidia.custhelp.com/app/answers/detail/a_id/5491
CVE: CVE-2023-31023
Published: 2023-11-02
Description: NVIDIA Display Driver for Windows contains a vulnerability where an attacker may cause a pointer dereference of an untrusted value, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-822
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5491; https://nvidia.custhelp.com/app/answers/detail/a_id/5491
CVE: CVE-2023-31026
Published: 2023-11-02
Description: NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a NULL-pointer dereference may lead to denial of service.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5491; https://nvidia.custhelp.com/app/answers/detail/a_id/5491
CVE: CVE-2023-31027
Published: 2023-11-02
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability that allows Windows users with low levels of privilege to escalate privileges when an administrator is updating GPU drivers, which may lead to escalation of privileges.
CVSS Score: 8.2 (HIGH)
CWE: CWE-427
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5491; https://nvidia.custhelp.com/app/answers/detail/a_id/5491
CVE: CVE-2023-5923
Published: 2023-11-02
Description: A vulnerability classified as critical has been found in Campcodes Simple Student Information System 1.0. This affects an unknown part of the file /admin/index.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-244323.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Simple%20Student%20Information%20System/Simple%20Student%20Information%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.244323; https://vuldb.com/?id.244323
CVE: CVE-2023-5924
Published: 2023-11-02
Description: A vulnerability classified as critical was found in Campcodes Simple Student Information System 1.0. This vulnerability affects unknown code of the file /admin/courses/view_course.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-244324.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Simple%20Student%20Information%20System/Simple%20Student%20Information%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.244324; https://vuldb.com/?id.244324
CVE: CVE-2023-5925
Published: 2023-11-02
Description: A vulnerability, which was classified as critical, has been found in Campcodes Simple Student Information System 1.0. This issue affects some unknown processing of the file /classes/Master.php. The manipulation of the argument f leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-244325 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Simple%20Student%20Information%20System/Simple%20Student%20Information%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.244325; https://vuldb.com/?id.244325
CVE: CVE-2023-5926
Published: 2023-11-02
Description: A vulnerability, which was classified as critical, was found in Campcodes Simple Student Information System 1.0. Affected is an unknown function of the file /admin/students/update_status.php. The manipulation of the argument student_id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-244326 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Simple%20Student%20Information%20System/Simple%20Student%20Information%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.244326; https://vuldb.com/?id.244326
CVE: CVE-2023-5927
Published: 2023-11-02
Description: A vulnerability has been found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/courses/manage_course.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-244327.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Simple%20Student%20Information%20System/Simple%20Student%20Information%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.244327; https://vuldb.com/?id.244327
CVE: CVE-2023-5928
Published: 2023-11-02
Description: A vulnerability was found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/departments/manage_department.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-244328.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Simple%20Student%20Information%20System/Simple%20Student%20Information%20System%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.244328; https://vuldb.com/?id.244328
CVE: CVE-2023-39284
Published: 2023-11-02
Description: An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler.
CVSS Score: 5.5 (MEDIUM)
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2023056; https://www.insyde.com/security-pledge
CVE: CVE-2023-5929
Published: 2023-11-02
Description: A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/students/manage_academic.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-244329 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Simple%20Student%20Information%20System/Simple%20Student%20Information%20System%20-%20vuln%207.pdf; https://vuldb.com/?ctiid.244329; https://vuldb.com/?id.244329
CVE: CVE-2023-5930
Published: 2023-11-02
Description: A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/students/manage_academic.php. The manipulation of the argument student_id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-244330 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Simple%20Student%20Information%20System/Simple%20Student%20Information%20System%20-%20vuln%208.pdf; https://vuldb.com/?ctiid.244330; https://vuldb.com/?id.244330
CVE: CVE-2023-31579
Published: 2023-11-02
Description: Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/dromara/lamp-cloud/issues/183; https://github.com/xubowenW/JWTissues/blob/main/lamp%20issue.md; https://github.com/dromara/lamp-cloud/issues/183
CVE: CVE-2023-39042
Published: 2023-11-02
Description: An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39042.md; https://liff.line.me/[PII_REDACTED]-VmNyyXqO; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39042.md
CVE: CVE-2023-39047
Published: 2023-11-02
Description: An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39047.md; https://liff.line.me/[PII_REDACTED]-oGgKdNNW; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39047.md
CVE: CVE-2023-39048
Published: 2023-11-02
Description: An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39048.md; https://liff.line.me/[PII_REDACTED]-g5YonEZK; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39048.md
CVE: CVE-2023-39050
Published: 2023-11-02
Description: An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39050.md; https://liff.line.me/[PII_REDACTED]-MPKmV0nq; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39050.md
CVE: CVE-2023-39051
Published: 2023-11-02
Description: An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39051.md; https://liff.line.me/[PII_REDACTED]-jy2OO7WE; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39051.md
CVE: CVE-2023-39053
Published: 2023-11-02
Description: An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39053.md; https://liff.line.me/[PII_REDACTED]-eDjDJQ68; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39053.md
CVE: CVE-2023-39054
Published: 2023-11-02
Description: An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39054.md; https://liff.line.me/[PII_REDACTED]-2aM5Rl7Q; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39054.md
CVE: CVE-2023-39057
Published: 2023-11-02
Description: An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39057.md; https://liff.line.me/[PII_REDACTED]-WZNjNErk; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39057.md
CVE: CVE-2023-39283
Published: 2023-11-02
Description: An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to SMM which could lead to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2023055; https://www.insyde.com/security-pledge
CVE: CVE-2023-42299
Published: 2023-11-02
Description: Buffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_subimage_data function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/OpenImageIO/oiio/issues/3840; https://github.com/OpenImageIO/oiio/issues/3840
CVE: CVE-2023-43194
Published: 2023-11-02
Description: Submitty before v22.06.00 is vulnerable to Incorrect Access Control. An attacker can delete any post in the forum by modifying request parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://fuchai.net/cve/CVE-2023-43194; https://github.com/Submitty/Submitty/pull/8032; https://fuchai.net/cve/CVE-2023-43194
CVE: CVE-2023-46352
Published: 2023-11-02
Description: In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer table such as name / surname / email.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://addons.prestashop.com/en/analytics-statistics/18739-pixel-plus-events-capi-pixel-catalog-for-facebook.html; https://security.friendsofpresta.org/modules/2023/10/31/facebookconversiontrackingplus.html; https://addons.prestashop.com/en/analytics-statistics/18739-pixel-plus-events-capi-pixel-catalog-for-facebook.html
CVE: CVE-2023-46958
Published: 2023-11-02
Description: An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://lmxcms.com; http://www.lmxcms.com/; https://gist.github.com/durian5201314/6507d1057c62f4bf93e740a631617434
CVE: CVE-2023-42027
Published: 2023-11-03
Description: IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  266057.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266057; https://www.ibm.com/support/pages/node/7063659; https://www.ibm.com/support/pages/node/7063664
CVE: CVE-2023-42029
Published: 2023-11-03
Description: IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  266059.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266059; https://www.ibm.com/support/pages/node/7063659; https://www.ibm.com/support/pages/node/7063663
CVE: CVE-2023-43018
Published: 2023-11-03
Description: IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.  IBM X-Force ID:  266163.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-250, CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266163; https://www.ibm.com/support/pages/node/7063668; https://exchange.xforce.ibmcloud.com/vulnerabilities/266163
CVE: CVE-2017-7252
Published: 2023-11-03
Description: bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://botan.randombit.net/security.html; https://bugzilla.suse.com/show_bug.cgi?id=1034591; https://botan.randombit.net/security.html
CVE: CVE-2023-36022
Published: 2023-11-03
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36022; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36022; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-36029
Published: 2023-11-03
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36029; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36029; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-36034
Published: 2023-11-03
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36034; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36034; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-46176
Published: 2023-11-03
Description: IBM MQ Appliance 9.3 CD could allow a local attacker to gain elevated privileges on the system, caused by improper validation of security keys.  IBM X-Force ID:  269535.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-424
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/269535; https://www.ibm.com/support/pages/node/7060769; https://exchange.xforce.ibmcloud.com/vulnerabilities/269535
CVE: CVE-2023-35896
Published: 2023-11-03
Description: IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.  IBM X-Force ID:  259247.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/259247; https://www.ibm.com/support/pages/node/7065203; https://exchange.xforce.ibmcloud.com/vulnerabilities/259247
CVE: CVE-2023-46954
Published: 2023-11-03
Description: SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitrary code via the name parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/jakedmurphy1/CVE-2023-46954; https://github.com/jakedmurphy1/CVE-2023-46954
CVE: CVE-2020-28407
Published: 2023-11-03
Description: In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as TMP2-00.permall.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=1198395; https://github.com/stefanberger/swtpm/releases/tag/v0.4.2; https://github.com/stefanberger/swtpm/releases/tag/v0.5.1
CVE: CVE-2023-31102
Published: 2023-11-03
Description: Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191, CWE-191
References: https://ds-security.com/post/integer-overflow-in-7-zip-cve-2023-31102/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269/
CVE: CVE-2023-34259
Published: 2023-11-03
Description: Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the filesystem, even files that require root privileges. NOTE: this issue exists because of an incomplete fix for CVE-2020-23575.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://sec-consult.com/vulnerability-lab/; https://seclists.org/fulldisclosure/2023/Jul/15; https://sec-consult.com/vulnerability-lab/
CVE: CVE-2023-34260
Published: 2023-11-03
Description: Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed by a directory reference such as %2fetc%00index.htm to try to read the /etc directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://sec-consult.com/vulnerability-lab/; https://seclists.org/fulldisclosure/2023/Jul/15; https://sec-consult.com/vulnerability-lab/
CVE: CVE-2023-34261
Published: 2023-11-03
Description: Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they lead to a "nicht einloggen" error rather than a falsch error.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://sec-consult.com/vulnerability-lab/; https://seclists.org/fulldisclosure/2023/Jul/15; https://sec-consult.com/vulnerability-lab/
CVE: CVE-2023-36620
Published: 2023-11-03
Description: An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is used to authenticate requests to the API.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-284
References: https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/; https://seclists.org/fulldisclosure/2023/Jul/12; https://useboomerang.com/
CVE: CVE-2023-36621
Published: 2023-11-03
Description: An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions temporarily or uninstall the application without the parents noticing.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/; https://seclists.org/fulldisclosure/2023/Jul/12; https://useboomerang.com/
CVE: CVE-2023-38965
Published: 2023-11-03
Description: Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: http://packetstormsecurity.com/files/175077/Lost-And-Found-Information-System-1.0-Insecure-Direct-Object-Reference.html; https://github.com/Or4ngm4n/vulnreability-code-review-php/blob/main/Lost%20and%20Found%20Information%20System%20v1.0.txt; https://www.exploit-db.com/exploits/51795
CVE: CVE-2023-41164
Published: 2023-11-03
Description: In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://docs.djangoproject.com/en/4.2/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/
CVE: CVE-2023-41259
Published: 2023-11-03
Description: Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://docs.bestpractical.com/release-notes/rt/4.4.7; https://docs.bestpractical.com/release-notes/rt/5.0.5; https://docs.bestpractical.com/release-notes/rt/index.html
CVE: CVE-2023-41260
Published: 2023-11-03
Description: Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://docs.bestpractical.com/release-notes/rt/4.4.7; https://docs.bestpractical.com/release-notes/rt/5.0.5; https://docs.bestpractical.com/release-notes/rt/index.html