deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1156
Published: 2023-03-02
Description: A vulnerability classified as problematic was found in SourceCodester Health Center Patient Record Management System 1.0. This vulnerability affects unknown code of the file admin/fecalysis_form.php. The manipulation of the argument itr_no leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222220.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Lacer23/bug_report/blob/main/bug_report/razormist/Health%20Center%20Patient%20Record%20Management/XSS-1.md; https://vuldb.com/?ctiid.222220; https://vuldb.com/?id.222220
CVE: CVE-2023-1157
Published: 2023-03-02
Description: A vulnerability, which was classified as problematic, was found in finixbit elf-parser. Affected is the function elf_parser::Elf_parser::get_segments of the file elf_parser.cpp. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-222222 is the identifier assigned to this vulnerability.
CVSS Score: 2.8 (LOW)
CWE: CWE-404, CWE-404
References: https://github.com/10cksYiqiyinHangzhouTechnology/elf-parser_segments_poc; https://vuldb.com/?ctiid.222222; https://vuldb.com/?id.222222
CVE: CVE-2023-26051
Published: 2023-03-02
Description: Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1; https://github.com/saleor/saleor/releases/tag/3.1.48; https://github.com/saleor/saleor/releases/tag/3.10.14
CVE: CVE-2023-26052
Published: 2023-03-02
Description: Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12. 
CVSS Score: 3.7 (LOW)
CWE: CWE-209, CWE-209
References: https://github.com/saleor/saleor/releases/tag/3.1.48; https://github.com/saleor/saleor/releases/tag/3.10.14; https://github.com/saleor/saleor/releases/tag/3.11.12
CVE: CVE-2023-26055
Published: 2023-03-02
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

CVSS Score: 9.9 (CRITICAL)
CWE: CWE-150
References: https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-8cw6-4r32-6r3h; https://jira.xwiki.org/browse/XCOMMONS-2498; https://jira.xwiki.org/browse/XWIKI-19793
CVE: CVE-2023-26056
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5, and 13.10.10. There are no known workarounds for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/xwiki/xwiki-platform/commit/4b75f212c2dd2dfc5fb5726c7830c6dbc9a425c6; https://github.com/xwiki/xwiki-platform/commit/bd34ad6710ed72304304a3d5fec38b7cc050ef3b; https://github.com/xwiki/xwiki-platform/commit/dd3f4735b41971b3afc3f3aedf6664b4e8be4894
CVE: CVE-2023-26470
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). Most of the time this will fill the memory allocated to XWiki and make it unusable every time this document is manipulated. This issue has been patched in XWiki 14.0-rc-1.

CVSS Score: 5.7 (MEDIUM)
CWE: CWE-400, CWE-787
References: https://github.com/xwiki/xwiki-platform/commit/04e5a89d2879b160cdfaea846024d3d9c1a525e6; https://github.com/xwiki/xwiki-platform/commit/db3d1c62fc5fb59fefcda3b86065d2d362f55164; https://github.com/xwiki/xwiki-platform/commit/fdfce062642b0ac062da5cda033d25482f4600fa
CVE: CVE-2023-26471
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. The only known workaround consists of applying a patch and rebuilding and redeploying `org.xwiki.platform:xwiki-platform-rendering-async-macro`.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-284
References: https://github.com/xwiki/xwiki-platform/commit/00532d9f1404287cf3ec3a05056640d809516006; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9cqm-5wf7-wcj7; https://jira.xwiki.org/browse/XWIKI-20234
CVE: CVE-2023-26472
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf[PII_REDACTED]af2b531026a614221d5d61f38.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-116, CWE-116
References: https://github.com/xwiki/xwiki-platform/commit/48caf[PII_REDACTED]af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vwr6-qp4q-2wj7; https://jira.xwiki.org/browse/XWIKI-19731
CVE: CVE-2023-26473
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other than upgrading.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vpx4-7rfp-h545; https://jira.xwiki.org/browse/XWIKI-19523; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vpx4-7rfp-h545
CVE: CVE-2023-26474
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-284
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3738-p9x3-mv9r; https://jira.xwiki.org/browse/XWIKI-20373; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3738-p9x3-mv9r
CVE: CVE-2023-26475
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269, CWE-270, CWE-269
References: https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr; https://jira.xwiki.org/browse/XWIKI-20360
CVE: CVE-2023-26476
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-307
References: https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5cf8-vrr8-8hjm; https://jira.xwiki.org/browse/XWIKI-19949
CVE: CVE-2022-35645
Published: 2023-03-02
Description: IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  230958.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230958; https://www.ibm.com/support/pages/node/6959353; https://www.ibm.com/support/pages/node/6959355
CVE: CVE-2022-46501
Published: 2023-03-02
Description: Accruent LLC Maintenance Connection 2021 (all) & 2022.2 was discovered to contain a SQL injection vulnerability via the E-Mail to Work Order function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://accruent.com; https://maintenanceconnection.ca/zero-day-flaw-in-accruent-software/; http://accruent.com
CVE: CVE-2023-22381
Published: 2023-03-02
Description: A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variable value in GitHub Actions when using a Windows based runner. To exploit this vulnerability, an attacker would need existing permission to control the value of environment variables for use with GitHub Actions. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.8.0 and was fixed in versions 3.4.15, 3.5.12, 3.6.8, 3.7.5. This vulnerability was reported via the GitHub Bug Bounty program.





CVSS Score: 4.1 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.15; https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.12; https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.8
CVE: CVE-2023-0656
Published: 2023-03-02
Description: A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0004; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0004
CVE: CVE-2023-1101
Published: 2023-03-02
Description: SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes.
CVSS Score: 8.8 (HIGH)
CWE: CWE-307, CWE-307, CWE-307
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0005; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0005
CVE: CVE-2022-40633
Published: 2023-03-02
Description: A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks.
CVSS Score: 4.6 (MEDIUM)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-061-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-061-03
CVE: CVE-2023-1160
Published: 2023-03-03
Description: Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1103
References: https://github.com/cockpit-hq/cockpit/commit/[PII_REDACTED]50f2d788ebc3c67884d4c692587eb8; https://huntr.dev/bounties/3ce480dc-1b1c-4230-9287-0dc3b31c2f87; https://github.com/cockpit-hq/cockpit/commit/[PII_REDACTED]50f2d788ebc3c67884d4c692587eb8
CVE: CVE-2023-0457
Published: 2023-03-03
Description: Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-256, CWE-522
References: https://jvn.jp/vu/JVNVU93891523/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-23-061-01; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-023_en.pdf
CVE: CVE-2023-27560
Published: 2023-03-03
Description: Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://github.com/phpseclib/phpseclib/commit/6298d1cd55c3ffa44533bd41906caec246b60440; https://github.com/phpseclib/phpseclib/releases/tag/3.0.19; https://github.com/phpseclib/phpseclib/commit/6298d1cd55c3ffa44533bd41906caec246b60440
CVE: CVE-2023-0577
Published: 2023-03-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information Technologies SOBIAD allows Cross-Site Scripting (XSS).This issue affects SOBIAD: before 23.02.01.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0125; https://www.usom.gov.tr/bildirim/tr-23-0125
CVE: CVE-2023-0578
Published: 2023-03-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information Technologies Book Cites allows Cross-Site Scripting (XSS).This issue affects Book Cites: before 23.01.05.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0125; https://www.usom.gov.tr/bildirim/tr-23-0125
CVE: CVE-2023-1162
Published: 2023-03-03
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown function of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the argument password leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222258 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://github.com/xxy1126/Vuln/blob/main/Draytek/2.md; https://vuldb.com/?ctiid.222258; https://vuldb.com/?id.222258
CVE: CVE-2023-1163
Published: 2023-03-03
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5 and classified as critical. Affected by this vulnerability is the function getSyslogFile of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222259. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/xxy1126/Vuln/blob/main/Draytek/3.md; https://vuldb.com/?ctiid.222259; https://vuldb.com/?id.222259
CVE: CVE-2023-1164
Published: 2023-03-03
Description: A vulnerability was found in KylinSoft kylin-activation on KylinOS and classified as critical. Affected by this issue is some unknown functionality of the component File Import. The manipulation leads to improper authorization. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.11-23 and 1.30.10-5.p23 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222260.
CVSS Score: 8.4 (HIGH)
CWE: CWE-285, CWE-863
References: https://github.com/i900008/vulndb/blob/main/kylin-activation_vuln.md; https://vuldb.com/?ctiid.222260; https://vuldb.com/?id.222260
CVE: CVE-2023-0957
Published: 2023-03-03
Description: An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This can lead to the extraction of data from workspaces, to a full takeover of the workspace.
CVSS Score: 8.2 (HIGH)
CWE: CWE-1385, CWE-346
References: https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=default&orgId=71ccd717-aa2d-4a1e-942e-c768d37e9e0c&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d; https://github.com/gitpod-io/gitpod/commit/12956988eec0031f42ffdfa3bdc3359f65628f9f; https://github.com/gitpod-io/gitpod/commit/673ab6856fa04c13b7b1f2a968e4d090f1d94e4f
CVE: CVE-2023-1165
Published: 2023-03-03
Description: A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-222261 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ha1yuYiqiyinHangzhouTechn0logy/crmeb_java/blob/main/README.md; https://vuldb.com/?ctiid.222261; https://vuldb.com/?id.222261
CVE: CVE-2022-45551
Published: 2023-03-03
Description: An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command to the Network Diagnosis endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://shenzhen.com; http://zbt.com; https://blog.prodefense.io/zbt-we1626-wireless-router-cve-disclosures-b3534484d97d
CVE: CVE-2022-45552
Published: 2023-03-03
Description: An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI bus interface connected to pinout of the NAND flash memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: http://shenzhen.com; http://zbt.com; https://blog.prodefense.io/zbt-we1626-wireless-router-cve-disclosures-b3534484d97d
CVE: CVE-2022-45553
Published: 2023-03-03
Description: An issue discovered in Shenzhen Zhibotong Electronics WBT WE1626 Router v 21.06.18 allows attacker to execute arbitrary commands via serial connection to the UART port.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://shenzhen.com; http://zbt.com; https://blog.prodefense.io/zbt-we1626-wireless-router-cve-disclosures-b3534484d97d
CVE: CVE-2022-45988
Published: 2023-03-03
Description: starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted file upload.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://github.com/happy0717/CVE-2022-45988; https://github.com/happy0717/StarSoftComm_HP_CooCare_An_elevation_of_privilege_vulnerability_exists/edit/main/README.md; https://github.com/happy0717/CVE-2022-45988
CVE: CVE-2022-47664
Published: 2023-03-03
Description: Libde265 1.0.9 is vulnerable to Buffer Overflow in ff_hevc_put_hevc_qpel_pixels_8_sse
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/strukturag/libde265/issues/368; https://github.com/strukturag/libde265/issues/368
CVE: CVE-2022-47665
Published: 2023-03-03
Description: Libde265 1.0.9 has a heap buffer overflow vulnerability in de265_image::set_SliceAddrRS(int, int, int)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/369; https://github.com/strukturag/libde265/issues/369
CVE: CVE-2022-2835
Published: 2023-03-03
Description: A flaw was found in coreDNS. This flaw allows a malicious user to reroute internal calls to some internal services that were accessed by the FQDN in a format of <service>.<namespace>.svc.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-923
References: https://bugzilla.redhat.com/show_bug.cgi?id=2118542; https://bugzilla.redhat.com/show_bug.cgi?id=2118542
CVE: CVE-2022-2837
Published: 2023-03-03
Description: A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains (TLD) to a pod they control by creating projects and namespaces that match the TLD.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-923, CWE-601, CWE-601
References: https://bugzilla.redhat.com/show_bug.cgi?id=2118543; https://bugzilla.redhat.com/show_bug.cgi?id=2118543
CVE: CVE-2022-41862
Published: 2023-03-03
Description: In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=2165722; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.postgresql.org/support/security/CVE-2022-41862/
CVE: CVE-2022-4645
Published: 2023-03-03
Description: LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4645.json; https://gitlab.com/libtiff/libtiff/-/commit/e[PII_REDACTED][PII_REDACTED]3d61afd16ac094ff246; https://gitlab.com/libtiff/libtiff/-/issues/277
CVE: CVE-2023-20061
Published: 2023-03-03
Description: Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on an affected system. Cisco plans to release software updates that address these vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-infodisc-ssrf-84ZBmwVk; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-infodisc-ssrf-84ZBmwVk
CVE: CVE-2023-20062
Published: 2023-03-03
Description: Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on an affected system. Cisco plans to release software updates that address these vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-918
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-infodisc-ssrf-84ZBmwVk; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-infodisc-ssrf-84ZBmwVk