deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-32285
Published: 2023-08-11
Description: Improper access control in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-284
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html
CVE: CVE-2023-32543
Published: 2023-08-11
Description: Incorrect default permissions in the Intel(R) ITS sofware before version 3.1 may allow authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276, CWE-276
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00938.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00938.html
CVE: CVE-2023-32547
Published: 2023-08-11
Description: Incorrect default permissions in the MAVinci Desktop Software for Intel(R) Falcon 8+ before version 6.2 may allow authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276, CWE-276
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00934.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00934.html
CVE: CVE-2023-32609
Published: 2023-08-11
Description: Improper access control in the Intel Unite(R) android application before version 4.2.3504 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00932.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00932.html
CVE: CVE-2023-32617
Published: 2023-08-11
Description: Improper input validation in some Intel(R) NUC Rugged Kit, Intel(R) NUC Kit and Intel(R) Compute Element BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html
CVE: CVE-2023-32656
Published: 2023-08-11
Description: Improper buffer restrictions in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-92, CWE-119
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html
CVE: CVE-2023-32663
Published: 2023-08-11
Description: Incorrect default permissions in some Intel(R) RealSense(TM) SDKs in version 2.53.1 may allow an authenticated user to potentially enable escalation of privilege via local access.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00946.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00946.html
CVE: CVE-2023-33867
Published: 2023-08-11
Description: Improper buffer restrictions in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-92, CWE-119
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html
CVE: CVE-2023-33877
Published: 2023-08-11
Description: Out-of-bounds write in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 3.3 (LOW)
CWE: CWE-787, CWE-787
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html
CVE: CVE-2023-34086
Published: 2023-08-11
Description: Improper input validation in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html
CVE: CVE-2023-34349
Published: 2023-08-11
Description: Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-421, CWE-362
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html
CVE: CVE-2023-34355
Published: 2023-08-11
Description: Uncontrolled search path element for some Intel(R) Server Board M10JNP2SB integrated BMC video drivers before version 3.0 for Microsoft Windows and before version 1.13.4 for linux may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00899.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00899.html
CVE: CVE-2023-34427
Published: 2023-08-11
Description: Protection mechanism failure in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-693
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html
CVE: CVE-2023-34438
Published: 2023-08-11
Description: Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-421, CWE-362
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html
CVE: CVE-2023-40256
Published: 2023-08-11
Description: A vulnerability was discovered in Veritas NetBackup Snapshot Manager before 10.2.0.1 that allowed untrusted clients to interact with the RabbitMQ service. This was caused by improper validation of the client certificate due to misconfiguration of the RabbitMQ service. Exploiting this impacts the confidentiality and integrity of messages controlling the backup and restore jobs, and could result in the service becoming unavailable. This impacts only the jobs controlling the backup and restore activities, and does not allow access to (or deletion of) the backup snapshot data itself. This vulnerability is confined to the NetBackup Snapshot Manager feature and does not impact the RabbitMQ instance on the NetBackup primary servers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://www.veritas.com/content/support/en_US/security/VTS23-011; https://www.veritas.com/content/support/en_US/security/VTS23-011
CVE: CVE-2023-3823
Published: 2023-08-11
Description: In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.
CVSS Score: 8.6 (HIGH)
CWE: CWE-611
References: https://github.com/php/php-src/security/advisories/GHSA-3qrf-m4j2-pcrr; https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/
CVE: CVE-2023-3824
Published: 2023-08-11
Description: In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-119, CWE-119
References: https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv; https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/
CVE: CVE-2023-40253
Published: 2023-08-11
Description: Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentication Abuse.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42 (Revision 117460); Genian NAC Suite V5.0: from V5.0.0 through V5.0.54; Genian ZTNA: from V6.0.0 through V6.0.15.


CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78, CWE-287
References: https://docs.genians.com/nac/5.0/release/ko/advisories/GN-SA-2023-001.html; https://docs.genians.com/nac/5.0/release/ko/advisories/GN-SA-2023-001.html
CVE: CVE-2023-40260
Published: 2023-08-11
Description: EmpowerID before 7.205.0.1 allows an attacker to bypass an MFA (multi factor authentication) requirement if the first factor (username and password) is known, because the first factor is sufficient to change an account's email address, and the product would then send MFA codes to the new email address (which may be attacker-controlled). NOTE: this is different from CVE-2023-4177, which claims to be about "some unknown processing of the component Multi-Factor Authentication Code Handler" and thus cannot be correlated with other vulnerability information.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://nvd.nist.gov/vuln/detail/CVE-2023-40260; https://seclists.org/fulldisclosure/2023/Aug/3; https://nvd.nist.gov/vuln/detail/CVE-2023-40260
CVE: CVE-2023-40254
Published: 2023-08-11
Description: Download of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Malicious Software Update.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42 (Revision 117460); Genian NAC Suite V5.0: from V5.0.0 through V5.0.54; Genian ZTNA: from V6.0.0 through V6.0.15.


CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-494
References: https://docs.genians.com/nac/5.0/release/ko/advisories/GN-SA-2023-001.html; https://docs.genians.com/nac/5.0/release/ko/advisories/GN-SA-2023-001.html
CVE: CVE-2023-40267
Published: 2023-08-11
Description: GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca[PII_REDACTED]143f54e5bf4cdd; https://github.com/gitpython-developers/GitPython/pull/1609; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/
CVE: CVE-2023-4105
Published: 2023-08-11
Description: Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message


CVSS Score: 3.1 (LOW)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-4106
Published: 2023-08-11
Description: Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-4107
Published: 2023-08-11
Description: Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-4108
Published: 2023-08-11
Description: Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged


CVSS Score: 4.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-39553
Published: 2023-08-11
Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.

Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server.
This issue affects Apache Airflow Drill Provider: before 2.4.3.
It is recommended to upgrade to a version that is not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2023/08/11/1; https://github.com/apache/airflow/pull/33074; https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf
CVE: CVE-2023-3864
Published: 2023-08-11
Description: Blind SQL injection in a service running in Snow Software license manager from version 8.0.0 up to and including 9.30.1 on Windows allows a logged in user with high privileges to inject SQL commands via the web portal.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC; https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC
CVE: CVE-2023-3937
Published: 2023-08-11
Description: Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC; https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC
CVE: CVE-2022-3403
Published: 2023-08-11
Description: Rejected reason: Duplicate, please use CVE-2023-28931 instead.
CVE: CVE-2023-39417
Published: 2023-08-11
Description: IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://access.redhat.com/errata/RHSA-2023:7545; https://access.redhat.com/errata/RHSA-2023:7579; https://access.redhat.com/errata/RHSA-2023:7580
CVE: CVE-2023-39418
Published: 2023-08-11
Description: A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
CVSS Score: 3.1 (LOW)
CWE: CWE-1220
References: https://access.redhat.com/errata/RHSA-2023:7785; https://access.redhat.com/errata/RHSA-2023:7883; https://access.redhat.com/errata/RHSA-2023:7884
CVE: CVE-2020-19952
Published: 2023-08-11
Description: Cross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attackers to execute arbirary code via crafted payload or opening malicious .md file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jbt/markdown-editor/commit/228f1947a5242a6fbe2995d72d21b7e5f5178f35; https://github.com/jbt/markdown-editor/issues/106; https://github.com/jbt/markdown-editor/pull/110
CVE: CVE-2020-20523
Published: 2023-08-11
Description: Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CMS installation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/GilaCMS/gila/issues/41; https://github.com/GilaCMS/gila/issues/41
CVE: CVE-2020-23595
Published: 2023-08-11
Description: Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/yzmcms/yzmcms/issues/47; https://github.com/yzmcms/yzmcms/issues/47
CVE: CVE-2020-24075
Published: 2023-08-11
Description: Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.laborator.co/kb/kalium/kalium-changelog/#version-3-0-4-jun-23-2020; https://documentation.laborator.co/kb/kalium/kalium-changelog/#version-3-0-4-jun-23-2020
CVE: CVE-2020-24187
Published: 2023-08-11
Description: An issue was discovered in ecma-helpers.c in jerryscript version 2.3.0, allows local attackers to cause a denial of service (DoS) (Null Pointer Dereference).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/Aurorainfinity/Poc/tree/master/jerryscript/NULL-dereference-ecma_get_lex_env_type; https://github.com/jerryscript-project/jerryscript/issues/4076; https://github.com/Aurorainfinity/Poc/tree/master/jerryscript/NULL-dereference-ecma_get_lex_env_type
CVE: CVE-2020-24221
Published: 2023-08-11
Description: An issue was discovered in GetByte function in miniupnp ngiflib version 0.4, allows local attackers to cause a denial of service (DoS) via crafted .gif file (infinite loop).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/miniupnp/ngiflib/issues/17; https://github.com/miniupnp/ngiflib/issues/17
CVE: CVE-2020-24222
Published: 2023-08-11
Description: Buffer Overflow vulnerability in jfif_decode() function in rockcarry ffjpeg through version 1.0.0, allows local attackers to execute arbitrary code due to an issue with ALIGN.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/rockcarry/ffjpeg/issues/31; https://github.com/rockcarry/ffjpeg/issues/31
CVE: CVE-2020-24804
Published: 2023-08-11
Description: Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://github.com/cms-dev/cms/issues/1160; https://github.com/cms-dev/cms/issues/1160
CVE: CVE-2020-24872
Published: 2023-08-11
Description: Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lepton-cms.org/posts/new-security-release-144.php; https://lepton-cms.org/posts/new-security-release-144.php
CVE: CVE-2020-24904
Published: 2023-08-11
Description: An issue was discovered in attach parameter in GNOME Gmail version 2.5.4, allows remote attackers to gain sensitive information via crafted "mailto" link.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/davesteele/gnome-gmail/issues/84; https://github.com/davesteele/gnome-gmail/issues/84
CVE: CVE-2020-24922
Published: 2023-08-11
Description: Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execute arbitrary code and esclate privileges via crafted .html file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/xuxueli/xxl-job/issues/1921; https://github.com/xuxueli/xxl-job/issues/1921
CVE: CVE-2020-24950
Published: 2023-08-11
Description: SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/daylightstudio/FUEL-CMS/issues/562; https://github.com/daylightstudio/FUEL-CMS/issues/562
CVE: CVE-2020-25915
Published: 2023-08-11
Description: Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thinkcmf/thinkcmf/issues/675; https://github.com/thinkcmf/thinkcmf/issues/675
CVE: CVE-2020-27449
Published: 2023-08-11
Description: Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugbounty.zoho.com/bb/#/bug/[PII_REDACTED]9211; https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002; https://bugbounty.zoho.com/bb/#/bug/[PII_REDACTED]9211
CVE: CVE-2020-27514
Published: 2023-08-11
Description: Directory Traversal vulnerability in delete function in admin.api.TemplateController in ZrLog version 2.1.15, allows remote attackers to delete arbitrary files and cause a denial of service (DoS).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/94fzb/zrlog/issues/66; https://github.com/94fzb/zrlog/issues/66
CVE: CVE-2020-27544
Published: 2023-08-11
Description: An issue was discovered in FoldingAtHome Client Advanced Control GUI before commit 9b619ae[PII_REDACTED]8a36dda01b420578de1af77, allows remote attackers to execute arbitrary code via crafted payload to function parse_message in file Connection.py.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/FoldingAtHome/fah-control/commit/9b619ae[PII_REDACTED]8a36dda01b420578de1af77; https://github.com/FoldingAtHome/fah-control/commit/9b619ae[PII_REDACTED]8a36dda01b420578de1af77
CVE: CVE-2020-28717
Published: 2023-08-11
Description: Cross Site Scripting (XSS) vulnerability in content1 parameter in demo.jsp in kindsoft kindeditor version 4.1.12, allows attackers to execute arbitrary code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kindsoft/kindeditor/issues/321; https://github.com/kindsoft/kindeditor/issues/321
CVE: CVE-2020-28840
Published: 2023-08-11
Description: Buffer Overflow vulnerability in jpgfile.c in Matthias-Wandel jhead version 3.04, allows local attackers to execute arbitrary code and cause a denial of service (DoS).
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1900820; https://github.com/F-ZhaoYang/jhead/security/advisories/GHSA-xh27-xwgj-gqw2; https://github.com/Matthias-Wandel/jhead/commit/4827ed31c226dc5ed93603bd649e0e387a1778da
CVE: CVE-2020-28848
Published: 2023-08-11
Description: CSV Injection vulnerability in ChurchCRM version 4.2.0, allows remote attackers to execute arbitrary code via crafted CSV file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://github.com/ChurchCRM/CRM/issues/5465; https://github.com/ChurchCRM/CRM/issues/5465