deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-30475
Published: 2023-08-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Elliot Sowersby, RelyWP WooCommerce Affiliate Plugin – Coupon Affiliates plugin <= 5.4.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-coupon-usage/wordpress-coupon-affiliates-plugin-5-4-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-coupon-usage/wordpress-coupon-affiliates-plugin-5-4-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30477
Published: 2023-08-14
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Essitco AFFILIATE Solution plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/affiliate-solution/wordpress-affiliate-solution-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/affiliate-solution/wordpress-affiliate-solution-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30483
Published: 2023-08-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Watu Quiz plugin <= 3.3.9.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/watu/wordpress-watu-quiz-plugin-3-3-9-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/watu/wordpress-watu-quiz-plugin-3-3-9-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28535
Published: 2023-08-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Paytm Paytm Payment Donation plugin <= 2.2.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/paytm-donation/wordpress-paytm-payment-donation-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/paytm-donation/wordpress-paytm-payment-donation-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30489
Published: 2023-08-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Email Subscription Popup plugin <= 1.2.16 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/email-subscribe/wordpress-email-subscription-popup-plugin-1-2-16-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/email-subscribe/wordpress-email-subscription-popup-plugin-1-2-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30749
Published: 2023-08-14
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin <= 7.3.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/optima-express/wordpress-optima-express-marketboost-idx-plugin-plugin-7-3-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/optima-express/wordpress-optima-express-marketboost-idx-plugin-plugin-7-3-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-30751
Published: 2023-08-14
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in iControlWP Article Directory Redux plugin <= 1.0.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/article-directory-redux/wordpress-article-directory-redux-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/article-directory-redux/wordpress-article-directory-redux-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30752
Published: 2023-08-14
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Silvia Pfeiffer and Andrew Nimmo External Videos plugin <= 2.0.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/external-videos/wordpress-external-videos-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/external-videos/wordpress-external-videos-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30754
Published: 2023-08-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt plugin <= 1.8.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/adfoxly/wordpress-adfoxly-ad-manager-adsense-ads-ads-txt-plugin-1-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/adfoxly/wordpress-adfoxly-ad-manager-adsense-ads-ads-txt-plugin-1-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-31041
Published: 2023-08-14
Description: An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be stored in cleartext, which might lead to possible information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://www.insyde.com/security-pledge/SA-2023047; https://www.insyde.com/security-pledge/SA-2023047
CVE: CVE-2023-4322
Published: 2023-08-14
Description: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd; https://huntr.dev/bounties/06e2484c-d6f1-4497-af67-26549be9fffd; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/64KUV6OGEVQ75QOV35PUVVDOJTKSJHYN/
CVE: CVE-2023-28768
Published: 2023-08-14
Description: Improper frame handling in the Zyxel XGS2220-30 firmware version V4.80(ABXN.1), XMG1930-30 firmware version V4.80(ACAR.1), and XS1930-10 firmware version V4.80(ABQE.1) could allow an unauthenticated LAN-based attacker to cause denial-of-service (DoS) conditions by sending crafted frames to an affected switch.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dos-vulnerability-of-xgs2220-xmg1930-and-xs1930-series-switches; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dos-vulnerability-of-xgs2220-xmg1930-and-xs1930-series-switches
CVE: CVE-2023-33013
Published: 2023-08-14
Description: A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-in-ntp-feature-of-nbg6604-home-router; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-in-ntp-feature-of-nbg6604-home-router
CVE: CVE-2023-40354
Published: 2023-08-14
Description: An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://jira.mariadb.org/browse/MXS-4681; https://jira.mariadb.org/browse/MXS-4681
CVE: CVE-2023-40359
Published: 2023-08-14
Description: xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.
CVSS Score: 9.8 (CRITICAL)
References: https://invisible-island.net/xterm/xterm.log.html#xterm_380; https://invisible-island.net/xterm/xterm.log.html#xterm_380
CVE: CVE-2023-0872
Published: 2023-08-14
Description: The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

OpenNMS thanks Erik Wynter for reporting this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-269
References: https://docs.opennms.com/horizon/32/releasenotes/changelog.html; https://github.com/OpenNMS/opennms/pull/6354; https://docs.opennms.com/horizon/32/releasenotes/changelog.html
CVE: CVE-2023-32748
Published: 2023-08-14
Description: The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0004; https://www.mitel.com/support/security-advisories
CVE: CVE-2023-38721
Published: 2023-08-14
Description: The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability.   A malicious actor could gain access to a command line with elevated privileges allowing root access to the host operating system.  IBM X-Force ID:  262173.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262173; https://www.ibm.com/support/pages/node/7023423; https://exchange.xforce.ibmcloud.com/vulnerabilities/262173
CVE: CVE-2023-38741
Published: 2023-08-14
Description: 
IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 262905.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262905; https://www.ibm.com/support/pages/node/7025476; https://exchange.xforce.ibmcloud.com/vulnerabilities/262905
CVE: CVE-2023-40311
Published: 2023-08-14
Description: Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that allow an attacker to store on database and then load on JSPs or Angular templates. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.

CVSS Score: 6.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/OpenNMS/opennms; https://github.com/OpenNMS/opennms/pull/6365; https://github.com/OpenNMS/opennms/pull/6366
CVE: CVE-2023-40312
Published: 2023-08-14
Description: Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.

CVSS Score: 6.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://docs.opennms.com/horizon/32/releasenotes/changelog.html; https://github.com/OpenNMS/opennms/pull/6356; https://docs.opennms.com/horizon/32/releasenotes/changelog.html
CVE: CVE-2023-40360
Published: 2023-08-14
Description: QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gitlab.com/birkelund/qemu/-/commit/6c8f8456cb0b239812dee[PII_REDACTED]496da7b98; https://gitlab.com/qemu-project/qemu/-/issues/1815; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-28480
Published: 2023-08-14
Description: An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform allows users to define new User Defined Functions (UDFs) from C/C++ code. To support this functionality TigerGraph allows users to upload custom C/C++ code which is then compiled and installed into the platform. An attacker who has filesystem access on a remote TigerGraph system can alter the behavior of the database against the will of the database administrator; thus effectively bypassing the built in RBAC controls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://neo4j.com/security/cve-2023-28480/; https://neo4j.com/security/cve-2023-28480/
CVE: CVE-2023-28481
Published: 2023-08-14
Description: An issue was discovered in Tigergraph Enterprise 3.7.0. There is unsecured write access to SSH authorized keys file. Any code running as the tigergraph user is able to add their SSH public key into the authorised keys file. This allows an attacker to obtain password-less SSH key access by using their own SSH key.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://neo4j.com/security/cve-2023-28481/; https://neo4j.com/security/cve-2023-28481/
CVE: CVE-2023-28482
Published: 2023-08-14
Description: An issue was discovered in Tigergraph Enterprise 3.7.0. A single TigerGraph instance can host multiple graphs that are accessed by multiple different users. The TigerGraph platform does not protect the confidentiality of any data uploaded to the remote server. In this scenario, any user that has permissions to upload data can browse data uploaded by any other user (irrespective of their permissions).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://neo4j.com/security/cve-2023-28482/; https://neo4j.com/security/cve-2023-28482/
CVE: CVE-2023-28483
Published: 2023-08-14
Description: An issue was discovered in Tigergraph Enterprise 3.7.0. The GSQL query language provides users with the ability to write data to files on a remote TigerGraph server. The locations that a query is allowed to write to are configurable via the GSQL.FileOutputPolicy configuration setting. GSQL queries that contain UDFs can bypass this configuration setting and, as a consequence, can write to any file location to which the administrative user has access.
CVSS Score: 8.8 (HIGH)
References: https://neo4j.com/security/cve-2023-28483/; https://neo4j.com/security/cve-2023-28483/
CVE: CVE-2023-29468
Published: 2023-08-14
Description: The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_EXT_2_IE_ID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code execution. This affects WILINK8-WIFI-MCP8 version 8.5_SP3 and earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.ti.com/lit/swra773; https://www.ti.com/lit/swra773
CVE: CVE-2023-39292
Published: 2023-08-14
Description: A SQL Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to access sensitive information and execute arbitrary database and management operations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0008; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0008
CVE: CVE-2023-39293
Published: 2023-08-14
Description: A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute arbitrary commands within the context of the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0009; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0009
CVE: CVE-2023-39908
Published: 2023-08-14
Description: The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://blog.inhq.net/posts/yubico-yubihsm-pkcs-vuln/; https://www.yubico.com/support/security-advisories/ysa-2023-01/; https://blog.inhq.net/posts/yubico-yubihsm-pkcs-vuln/
CVE: CVE-2022-4953
Published: 2023-08-14
Description: The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
CVSS Score: 6.1 (MEDIUM)
References: https://github.com/elementor/elementor/commit/292fc49e0f979bd52d838f0326d1faaebfa59f5e; https://wpscan.com/vulnerability/8273357e-f9e1-44bc-8082-8faab838eda7; https://github.com/elementor/elementor/commit/292fc49e0f979bd52d838f0326d1faaebfa59f5e
CVE: CVE-2023-2606
Published: 2023-08-14
Description: The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/62deb3ed-a7e4-4cdc-a615-cad2ec2e1e8f; https://wpscan.com/vulnerability/62deb3ed-a7e4-4cdc-a615-cad2ec2e1e8f
CVE: CVE-2023-2802
Published: 2023-08-14
Description: The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/c5cc136a-2fa6-44ff-b5b5-26d367937df9; https://wpscan.com/vulnerability/c5cc136a-2fa6-44ff-b5b5-26d367937df9
CVE: CVE-2023-2803
Published: 2023-08-14
Description: The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/ec640d47-bb22-478d-9668-1dab72f12f8d; https://wpscan.com/vulnerability/ec640d47-bb22-478d-9668-1dab72f12f8d
CVE: CVE-2023-3328
Published: 2023-08-14
Description: The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/d8b76875-cf7f-43a9-b88b-d8aefefab131; https://wpscan.com/vulnerability/d8b76875-cf7f-43a9-b88b-d8aefefab131
CVE: CVE-2023-3435
Published: 2023-08-14
Description: The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/30a37a61-0d16-46f7-b9d8-721d983afc6b; https://wpscan.com/vulnerability/30a37a61-0d16-46f7-b9d8-721d983afc6b
CVE: CVE-2023-3601
Published: 2023-08-14
Description: The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/c0cc513e-c306-4920-9afb-e33d95a7292f; https://wpscan.com/vulnerability/c0cc513e-c306-4920-9afb-e33d95a7292f
CVE: CVE-2023-3645
Published: 2023-08-14
Description: The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/58c11f1e-6ea0-468c-b974-4aea9eb94b82; https://wpscan.com/vulnerability/58c11f1e-6ea0-468c-b974-4aea9eb94b82
CVE: CVE-2023-3721
Published: 2023-08-14
Description: The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3f90347a-6586-4648-9f2c-d4f321bf801a; https://wpscan.com/vulnerability/3f90347a-6586-4648-9f2c-d4f321bf801a
CVE: CVE-2023-40023
Published: 2023-08-14
Description: yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion (LFI) vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential remote code execution, or other security breaches. Users utilizing versions of the Yak Engine prior to 1.2.4-sp1 are impacted. This vulnerability has been patched in version 1.2.4-sp1. Users are advised to upgrade. users unable to upgrade may avoid exposing vulnerable versions to untrusted input and to closely monitor any unexpected server behavior until they can upgrade.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/yaklang/yaklang/pull/295; https://github.com/yaklang/yaklang/pull/296; https://github.com/yaklang/yaklang/security/advisories/GHSA-xvhg-w6qc-m3qq
CVE: CVE-2023-40024
Published: 2023-08-14
Description: ScanCode.io is a server to script and automate software composition analysis pipelines. In the `/license/` endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist. Attackers can exploit this vulnerability to inject malicious scripts into the response generated by the `license_details_view` function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information. This issue has been addressed in release `32.5.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nexB/scancode.io/blob/dd7769fbc97c84545579cebf1dc[PII_REDACTED]a11/CHANGELOG.rst#v3252-2023-08-14; https://github.com/nexB/scancode.io/security/advisories/GHSA-6xcx-gx7r-rccj; https://github.com/nexB/scancode.io/blob/dd7769fbc97c84545579cebf1dc[PII_REDACTED]a11/CHANGELOG.rst#v3252-2023-08-14