deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-0977
Published: 2024-02-07
Description: The Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image URLs in the plugin's timeline widget in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, changes the slideshow type, and then changes it back to an image.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3029865%40timeline-widget-addon-for-elementor&new=3029865%40timeline-widget-addon-for-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/03073726-58d0-45b3-b7a6-7d12dbede919?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3029865%40timeline-widget-addon-for-elementor&new=3029865%40timeline-widget-addon-for-elementor&sfp_email=&sfph_mail=
CVE: CVE-2024-1078
Published: 2024-02-07
Description: The Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ays_quick_start() and add_question_rows() functions in all versions up to, and including, 6.5.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary quizzes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3032035/quiz-maker/tags/6.5.2.5/admin/class-quiz-maker-admin.php?old=3030468&old_path=quiz-maker%2Ftags%2F6.5.2.4%2Fadmin%2Fclass-quiz-maker-admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/7ba2b270-5f02-4cd8-8a22-1723c3873d67?source=cve; https://plugins.trac.wordpress.org/changeset/3032035/quiz-maker/tags/6.5.2.5/admin/class-quiz-maker-admin.php?old=3030468&old_path=quiz-maker%2Ftags%2F6.5.2.4%2Fadmin%2Fclass-quiz-maker-admin.php
CVE: CVE-2024-1079
Published: 2024-02-07
Description: The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() function in all versions up to, and including, 6.5.2.4. This makes it possible for unauthenticated attackers to fetch arbitrary quiz results which can contain PII.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3032035/quiz-maker/tags/6.5.2.5/admin/class-quiz-maker-admin.php?old=3030468&old_path=quiz-maker%2Ftags%2F6.5.2.4%2Fadmin%2Fclass-quiz-maker-admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/602df370-cd5b-46dc-a653-6522aef0c62f?source=cve; https://plugins.trac.wordpress.org/changeset/3032035/quiz-maker/tags/6.5.2.5/admin/class-quiz-maker-admin.php?old=3030468&old_path=quiz-maker%2Ftags%2F6.5.2.4%2Fadmin%2Fclass-quiz-maker-admin.php
CVE: CVE-2023-46914
Published: 2024-02-07
Description: SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via ics_export.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.friendsofpresta.org/modules/2024/02/06/bookingcalendar.html; https://security.friendsofpresta.org/modules/2024/02/06/bookingcalendar.html
CVE: CVE-2024-24303
Published: 2024-02-07
Description: SQL Injection vulnerability in HiPresta "Gift Wrapping Pro" (hiadvancedgiftwrapping) module for PrestaShop before version 1.4.1, allows remote attackers to escalate privileges and obtain sensitive information via the HiAdvancedGiftWrappingGiftWrappingModuleFrontController::addGiftWrappingCartValue() method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.friendsofpresta.org/modules/2024/02/06/hiadvancedgiftwrapping.html; https://security.friendsofpresta.org/modules/2024/02/06/hiadvancedgiftwrapping.html
CVE: CVE-2024-24304
Published: 2024-02-07
Description: In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without restriction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/mailjet/prestashop-mailjet-plugin-apiv3/releases/tag/v3.5.1; https://security.friendsofpresta.org/modules/2024/02/06/mailjet.html; https://github.com/mailjet/prestashop-mailjet-plugin-apiv3/releases/tag/v3.5.1
CVE: CVE-2024-24311
Published: 2024-02-07
Description: Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for PrestaShop before version 1.6.6, a guest can download personal information without restriction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://security.friendsofpresta.org/modules/2024/02/06/lgsitemaps.html; https://security.friendsofpresta.org/modules/2024/02/06/lgsitemaps.html
CVE: CVE-2023-51437
Published: 2024-02-07
Description: Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification.
Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the `saslJaasServerRoleTokenSignerSecretPath` file.

Any component matching an above version running the SASL Authentication Provider is affected. That includes the Pulsar Broker, Proxy, Websocket Proxy, or Function Worker.

2.11 Pulsar users should upgrade to at least 2.11.3.
3.0 Pulsar users should upgrade to at least 3.0.2.
3.1 Pulsar users should upgrade to at least 3.1.1.
Any users running Pulsar 2.8, 2.9, 2.10, and earlier should upgrade to one of the above patched versions.

For additional details on this attack vector, please refer to  https://codahale.com/a-lesson-in-timing-attacks/ .


CVSS Score: 7.4 (HIGH)
CWE: CWE-203, CWE-203
References: https://lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5; https://www.openwall.com/lists/oss-security/2024/02/07/1; https://lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5
CVE: CVE-2024-1109
Published: 2024-02-07
Description: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracking data and podcast information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/podlove/podlove-publisher/commit/0ac83d1955aa964a358833b1b5ce790fff45b3f4; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032008%40podlove-podcasting-plugin-for-wordpress&new=3032008%40podlove-podcasting-plugin-for-wordpress&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a7b25b66-e9d1-448d-8367-cce4c0dec635?source=cve
CVE: CVE-2024-1110
Published: 2024-02-07
Description: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862, CWE-862
References: https://github.com/podlove/podlove-publisher/commit/7873ff520631087e2f10737860cdcd64d53187ba; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032008%40podlove-podcasting-plugin-for-wordpress&new=3032008%40podlove-podcasting-plugin-for-wordpress&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9cf461-572c-4be8-96e6-659acf3208f3?source=cve
CVE: CVE-2024-1118
Published: 2024-02-07
Description: The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/podlove/podlove-subscribe-button-wp-plugin/commit/b16b7a2e98db4c642ca671b0aede4dbfce4578b3; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032152%40podlove-subscribe-button&new=3032152%40podlove-subscribe-button&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f234f05f-e377-4e89-81e1-f47ff44eebc5?source=cve
CVE: CVE-2023-39196
Published: 2024-02-07
Description: Improper Authentication vulnerability in Apache Ozone.

The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication.
The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this vulnerability.
The accessible metadata does not contain sensitive information that can be used to exploit the system later on, and the accessible data does not make it possible to gain access to actual user data within Ozone.
This issue affects Apache Ozone: 1.2.0 and subsequent releases up until 1.3.0.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2024/02/07/2; https://lists.apache.org/thread/o96ct5t7kj5cgrmmfc6756m931t08nky; http://www.openwall.com/lists/oss-security/2024/02/07/2
CVE: CVE-2024-24130
Published: 2024-02-07
Description: Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter at resellercenter/login.asp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Hebing123/cve/issues/13; https://github.com/Hebing123/cve/issues/13
CVE: CVE-2024-24131
Published: 2024-02-07
Description: SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Hebing123/cve/issues/14; https://github.com/Hebing123/cve/issues/14
CVE: CVE-2024-24133
Published: 2024-02-07
Description: Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Hebing123/cve/issues/16; https://github.com/Hebing123/cve/issues/16
CVE: CVE-2024-24186
Published: 2024-02-07
Description: Jsish v3.5.0 (commit 42c694c) was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/pcmacdon/jsish/issues/98; https://github.com/pcmacdon/jsish/issues/98
CVE: CVE-2024-24188
Published: 2024-02-07
Description: Jsish v3.5.0 was discovered to contain a heap-buffer-overflow in ./src/jsiUtils.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/pcmacdon/jsish/issues/100; https://github.com/pcmacdon/jsish/issues/100
CVE: CVE-2024-24189
Published: 2024-02-07
Description: Jsish v3.5.0 (commit 42c694c) was discovered to contain a use-after-free via the SplitChar at ./src/jsiUtils.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/pcmacdon/jsish/issues/101; https://github.com/pcmacdon/jsish/issues/101
CVE: CVE-2024-25200
Published: 2024-02-07
Description: Espruino 2v20 (commit fcc9ba4) was discovered to contain a Stack Overflow via the jspeFactorFunctionCall at src/jsparse.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/espruino/Espruino/issues/2457; https://github.com/espruino/Espruino/issues/2457
CVE: CVE-2024-25201
Published: 2024-02-07
Description: Espruino 2v20 (commit fcc9ba4) was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at src/jsvar.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/espruino/Espruino/issues/2456; https://github.com/espruino/Espruino/issues/2456
CVE: CVE-2024-24771
Published: 2024-02-07
Description: Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromised could potentially have the second-factor authentication bypassed if an attacker somehow managed to authenticate to Open Forms. The maintainers of Open Forms do not believe it is or has been possible to perform this login. However, if this were possible, the victim's account may be abused to view (potentially sensitive) submission data or have been used to impersonate other staff accounts to view and/or modify data. Three mitigating factors to help prevent exploitation include: the usual login page (at `/admin/login/`) does not fully log in the user until the second factor was succesfully provided; the additional non-MFA protected login page at `/api/v2/api-authlogin/` was misconfigured and could not be used to log in; and there are no additional ways to log in. This also requires credentials of a superuser to be compromised to be exploitable. Versions 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain the following patches to address these weaknesses: Move and only enable the API auth endpoints (`/api/v2/api-auth/login/`) with `settings.DEBUG = True`. `settings.DEBUG = True` is insecure and should never be applied in production settings. Additionally, apply a custom permission check to the hijack flow to only allow second-factor-verified superusers to perform user hijacking.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284, CWE-287, CWE-654
References: https://github.com/open-formulieren/open-forms/releases/tag/2.2.9; https://github.com/open-formulieren/open-forms/releases/tag/2.3.7; https://github.com/open-formulieren/open-forms/releases/tag/2.4.5
CVE: CVE-2024-24811
Published: 2024-02-07
Description: SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a; https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw; https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a
CVE: CVE-2024-24812
Published: 2024-02-07
Description: Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/frappe/frappe/releases/tag/v14.59.0; https://github.com/frappe/frappe/releases/tag/v15.5.0; https://github.com/frappe/frappe/security/advisories/GHSA-7p3m-h76m-hg9v
CVE: CVE-2024-25143
Published: 2024-02-07
Description: The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25143; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25143
CVE: CVE-2024-25145
Published: 2024-02-07
Description: Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145
CVE: CVE-2024-22012
Published: 2024-02-07
Description: there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2024-02-01; https://source.android.com/security/bulletin/pixel/2024-02-01
CVE: CVE-2024-24815
Published: 2024-02-07
Description: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S-cdata; https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html; https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filter.html
CVE: CVE-2023-31002
Published: 2024-02-07
Description: IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user.  IBM X-Force ID:  254657.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-312, CWE-256
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254657; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-32328
Published: 2024-02-07
Description: IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of the server.  IBM X-Force Id:  254957.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254657; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-32330
Published: 2024-02-07
Description: IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure calls that could allow an attacker on the network to take control of the server.  IBM X-Force ID:  254977.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254977; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-38369
Published: 2024-02-07
Description: IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts.  IBM X-Force ID:  261196.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-521
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/261196; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-43017
Published: 2024-02-07
Description: IBM Security Verify Access 10.0.0.0 through 10.0.6.1 could allow a privileged user to install a configuration file that could allow remote access.  IBM X-Force ID:  266155.
CVSS Score: 8.2 (HIGH)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266155; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-47700
Published: 2024-02-07
Description: IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that would not be correctly validated by the Storwize server.  This could lead to a user connecting to a malicious host, believing that it was a trusted system and deceived into accepting spoofed data.  IBM X-Force ID:  271016.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271016; https://www.ibm.com/support/pages/node/7114767; https://exchange.xforce.ibmcloud.com/vulnerabilities/271016
CVE: CVE-2024-20252
Published: 2024-02-07
Description: Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device. 
 Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
 For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352, CWE-352
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3
CVE: CVE-2024-20254
Published: 2024-02-07
Description: Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device. 
 Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
 For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352, CWE-352
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3