deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-50932
Published: 2024-01-09
Description: An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Confluence, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
CVSS Score: 8.3 (HIGH)
CWE: CWE-352, CWE-352
References: https://help.savignano.net/snotify-email-encryption/sa-2023-11-28; https://help.savignano.net/snotify-email-encryption/sa-2023-11-28
CVE: CVE-2023-6830
Published: 2024-01-09
Description: The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites. CVE-2024-23522 appears to be a duplicate of this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3017166%40formidable%2Ftrunk&old=3009066%40formidable%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ff294b0f-97fe-4d27-bf93-f5bbb57ac1f6?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3017166%40formidable%2Ftrunk&old=3009066%40formidable%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-6842
Published: 2024-01-09
Description: The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name field label and description field label parameter in all versions up to 6.7 (inclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this only affects multi-site installations and installations where unfiltered_html has been disabled. However, in the formidable settings admins can extend form creation, deletion and other management permissions to other user types, which makes it possible for this vulnerability to be exploited by lower level user types as long as they have been granted the proper permissions.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3017166%40formidable%2Ftrunk&old=3009066%40formidable%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/47e402c3-e06c-4ac9-8c60-5666cb1101ce?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3017166%40formidable%2Ftrunk&old=3009066%40formidable%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-6147
Published: 2024-01-09
Description: Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-611, CWE-611
References: http://www.openwall.com/lists/oss-security/2024/01/24/6; https://www.qualys.com/security-advisories/; http://www.openwall.com/lists/oss-security/2024/01/24/6
CVE: CVE-2023-7220
Published: 2024-01-09
Description: A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://github.com/jylsec/vuldb/blob/main/TOTOLINK/NR1800X/1/README.md; https://vuldb.com/?ctiid.249854; https://vuldb.com/?id.249854
CVE: CVE-2023-49235
Published: 2024-01-09
Description: An issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Filtering of debug information is mishandled during use of popen. Consequently, an attacker can bypass validation and execute a shell command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/file/d/1lTloBkH_7zAz1ZbFVSZnfpoPd81aPaHx/view?usp=sharing; https://github.com/pcsle37/TRENDnet/blob/main/TRENDnet_vul.pdf; https://drive.google.com/file/d/1lTloBkH_7zAz1ZbFVSZnfpoPd81aPaHx/view?usp=sharing
CVE: CVE-2023-49236
Published: 2024-01-09
Description: A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. This occurs because of lack of length validation during an sscanf of a user-entered scale field in the RTSP playback function of davinci.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://drive.google.com/file/d/1lTloBkH_7zAz1ZbFVSZnfpoPd81aPaHx/view?usp=sharing; https://github.com/pcsle37/TRENDnet/blob/main/TRENDnet_vul.pdf; https://drive.google.com/file/d/1lTloBkH_7zAz1ZbFVSZnfpoPd81aPaHx/view?usp=sharing
CVE: CVE-2023-49237
Published: 2024-01-09
Description: An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to unpack language packs without strict filtering of URL strings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://drive.google.com/file/d/1lTloBkH_7zAz1ZbFVSZnfpoPd81aPaHx/view?usp=sharing; https://github.com/pcsle37/TRENDnet/blob/main/TRENDnet_vul.pdf; https://drive.google.com/file/d/1lTloBkH_7zAz1ZbFVSZnfpoPd81aPaHx/view?usp=sharing
CVE: CVE-2023-50585
Published: 2024-01-09
Description: Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/LaPhilosophie/IoT-vulnerable/blob/main/Tenda/A18/formSetDeviceName.md; https://github.com/LaPhilosophie/IoT-vulnerable/blob/main/Tenda/A18/formSetDeviceName.md
CVE: CVE-2023-50974
Published: 2024-01-09
Description: In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://appwrite.io/docs/tooling/command-line/installation; https://gist.github.com/SkypLabs/72ee00ecfa7d1a3494e2d69a24279c1d; https://appwrite.io/docs/tooling/command-line/installation
CVE: CVE-2023-6148
Published: 2024-01-09
Description: Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access and access to configure or edit jobs to utilize the plugin to configure a potential rouge endpoint via which it was possible to control response for certain request which could be injected with XSS payloads leading to XSS while processing the response data
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2024/01/24/6; https://www.qualys.com/security-advisories/; http://www.openwall.com/lists/oss-security/2024/01/24/6
CVE: CVE-2023-6149
Published: 2024-01-09
Description: 
Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://www.qualys.com/security-advisories/; https://www.qualys.com/security-advisories/
CVE: CVE-2024-22368
Published: 2024-01-09
Description: The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2024/01/10/2; https://github.com/haile01/perl_spreadsheet_excel_rce_poc/blob/main/parse_xlsx_bomb.md; https://lists.debian.org/debian-lts-announce/2024/01/msg00018.html
CVE: CVE-2023-42797
Published: 2024-01-09
Description: A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20). The network configuration service of affected devices contains a flaw in the conversion of ipv4 addresses that could lead to an uninitialized variable being used in succeeding validation steps.

By uploading specially crafted network configuration, an authenticated remote attacker could be able to inject commands that are executed on the device with root privileges during device startup.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-908
References: https://cert-portal.siemens.com/productcert/pdf/ssa-583634.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-583634.pdf
CVE: CVE-2023-44120
Published: 2024-01-09
Description: A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product's sudo configuration permits the local administrative account to execute several entries as root user. This could allow an authenticated local attacker to inject arbitrary code and gain root access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://cert-portal.siemens.com/productcert/pdf/ssa-786191.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-786191.pdf
CVE: CVE-2023-49121
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49122
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49123
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49124
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49126
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49127
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49128
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49129
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49130
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49131
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49132
Published: 2024-01-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE: CVE-2023-49251
Published: 2024-01-09
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application allows an attacker to add their own login credentials to the device. This allows an attacker to remotely login as root and take control of the device even after the affected device is fully set up.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf
CVE: CVE-2023-49252
Published: 2024-01-09
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The affected application allows IP configuration change without authentication to the device. This could allow an attacker to cause denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf
CVE: CVE-2023-49621
Published: 2024-01-09
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application uses default credential with admin privileges. An attacker could use the credentials to gain complete control of the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1392
References: https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf
CVE: CVE-2023-49722
Published: 2024-01-09
Description: Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi network.
CVSS Score: 8.3 (HIGH)
CWE: CWE-1125
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-473852.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-473852.html
CVE: CVE-2023-51438
Published: 2024-01-09
Description: A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC847E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows). In default installations of maxView Storage Manager where Redfish® server is configured for remote system management, a vulnerability has been identified that can provide unauthorized access.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-702935.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-702935.pdf
CVE: CVE-2023-51439
Published: 2024-01-09
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-794653.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-794653.pdf
CVE: CVE-2023-51744
Published: 2024-01-09
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/pdf/ssa-794653.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-794653.pdf
CVE: CVE-2023-51745
Published: 2024-01-09
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain a stack overflow vulnerability while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/pdf/ssa-794653.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-794653.pdf
CVE: CVE-2023-51746
Published: 2024-01-09
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain a stack overflow vulnerability while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/pdf/ssa-794653.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-794653.pdf
CVE: CVE-2023-5347
Published: 2024-01-09
Description: An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327, CWE-347, CWE-347
References: http://packetstormsecurity.com/files/176550/Korenix-JetNet-Series-Unauthenticated-Access.html; http://seclists.org/fulldisclosure/2024/Jan/11; https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/
CVE: CVE-2023-5376
Published: 2024-01-09
Description: An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 2024/01.
CVSS Score: 8.6 (HIGH)
CWE: CWE-306, CWE-287
References: http://packetstormsecurity.com/files/176550/Korenix-JetNet-Series-Unauthenticated-Access.html; http://seclists.org/fulldisclosure/2024/Jan/11; https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/
CVE: CVE-2024-22370
Published: 2024-01-09
Description: In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-28975
Published: 2024-01-09
Description: A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the VLAN View Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://infoblox.com; https://piotrryciak.com/posts/xss-infoblox/; http://infoblox.com