deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-29294
Published: 2023-06-15
Description: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840
References: https://helpx.adobe.com/security/products/magento/apsb23-35.html; https://helpx.adobe.com/security/products/magento/apsb23-35.html
CVE: CVE-2023-29295
Published: 2023-06-15
Description: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb23-35.html; https://helpx.adobe.com/security/products/magento/apsb23-35.html
CVE: CVE-2023-29296
Published: 2023-06-15
Description: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb23-35.html; https://helpx.adobe.com/security/products/magento/apsb23-35.html
CVE: CVE-2023-29297
Published: 2023-06-15
Description: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1336
References: https://helpx.adobe.com/security/products/magento/apsb23-35.html; https://helpx.adobe.com/security/products/magento/apsb23-35.html
CVE: CVE-2023-29302
Published: 2023-06-15
Description: Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-31.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-31.html
CVE: CVE-2023-29304
Published: 2023-06-15
Description: Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-31.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-31.html
CVE: CVE-2023-29307
Published: 2023-06-15
Description: Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-31.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-31.html
CVE: CVE-2023-29321
Published: 2023-06-15
Description: Adobe Animate versions 22.0.9 (and earlier) and 23.0.1 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/animate/apsb23-36.html; https://helpx.adobe.com/security/products/animate/apsb23-36.html
CVE: CVE-2023-29322
Published: 2023-06-15
Description: Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-31.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-31.html
CVE: CVE-2023-2686
Published: 2023-06-15
Description: Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected device to write payload onto the stack.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U2sFvQAJ?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk/releases; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U2sFvQAJ?operationContext=S1
CVE: CVE-2023-2683
Published: 2023-06-15
Description: A memory leak in the EFR32 Bluetooth LE stack 5.1.0 through 5.1.1 allows an attacker to send an invalid pairing message and cause future legitimate connection attempts to fail. A reset of the device immediately clears the error.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401, CWE-400
References: https://github.com/SiliconLabs; https://https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000U2U1QQAV?operationContext=S1; https://github.com/SiliconLabs
CVE: CVE-2023-2747
Published: 2023-06-15
Description: The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized.
CVSS Score: 3.1 (LOW)
CWE: CWE-1204, CWE-908
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U2sFvQAJ?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U2sFvQAJ?operationContext=S1
CVE: CVE-2023-31672
Published: 2023-06-15
Description: In the PrestaShop < 2.4.3 module "Length, weight or volume sell" (ailinear) there is a SQL injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://friends-of-presta.github.io/security-advisories/modules/2023/06/15/ailinear.html; https://friends-of-presta.github.io/security-advisories/modules/2023/06/15/ailinear.html
CVE: CVE-2023-33243
Published: 2023-06-15
Description: RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become best practice to protect users' passwords in case of a database compromise, this is rendered ineffective when allowing to authenticate using the password hash.
CVSS Score: 8.1 (HIGH)
CWE: CWE-916, CWE-916
References: https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses; https://www.redteam-pentesting.de/en/advisories/rt-sa-2022-004/-starface-authentication-with-password-hash-possible; https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
CVE: CVE-2023-34242
Published: 2023-06-15
Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to version 1.13.4, when Gateway API is enabled in Cilium, the absence of a check on the namespace in which a ReferenceGrant is created could result in Cilium unintentionally gaining visibility of secrets (including certificates) and services across namespaces. An attacker on an affected cluster can leverage this issue to use cluster secrets that should not be visible to them, or communicate with services that they should not have access to. Gateway API functionality is disabled by default. This vulnerability is fixed in Cilium release 1.13.4. As a workaround, restrict the creation of `ReferenceGrant` resources to admin users by using Kubernetes RBAC.
CVSS Score: 3.4 (LOW)
CWE: CWE-200
References: https://github.com/cilium/cilium/releases/tag/v1.13.4; https://github.com/cilium/cilium/security/advisories/GHSA-r7wr-4w5q-55m6; https://github.com/cilium/cilium/releases/tag/v1.13.4
CVE: CVE-2023-34852
Published: 2023-06-15
Description: PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://github.com/funny-kill/CVE-2023-34852/blob/main/CVE-2023-34852.md; https://github.com/sanluan/PublicCMS; https://github.com/funny-kill/CVE-2023-34852/blob/main/CVE-2023-34852.md
CVE: CVE-2023-24030
Published: 2023-06-15
Description: An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any URL if url sanitisation is bypassed in incoming requests. NOTE: this is similar, but not identical, to CVE-2021-34807.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories; https://wiki.zimbra.com/wiki/Security_Center
CVE: CVE-2023-24031
Published: 2023-06-15
Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories; https://wiki.zimbra.com/wiki/Security_Center
CVE: CVE-2023-24032
Published: 2023-06-15
Description: In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to local privilege escalation (LPE).
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories; https://wiki.zimbra.com/wiki/Security_Center
CVE: CVE-2023-34797
Published: 2023-06-15
Description: Broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 allows attackers to access sensitive information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-732
References: https://github.com/WhiteBearVN/CWX-Registration-Broken-Access-Control; https://github.com/WhiteBearVN/CWX-Registration-Broken-Access-Control
CVE: CVE-2023-34800
Published: 2023-06-15
Description: D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/Tyaoo/IoT-Vuls/blob/main/dlink/Go-RT-AC750/vul.md; https://www.dlink.com/en/security-bulletin/; https://github.com/Tyaoo/IoT-Vuls/blob/main/dlink/Go-RT-AC750/vul.md
CVE: CVE-2023-23841
Published: 2023-06-15
Description: SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request.  Part of the URL of the request discloses sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/serv-u_15-4_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23841; https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/serv-u_15-4_release_notes.htm
CVE: CVE-2023-28810
Published: 2023-06-15
Description: Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the same local network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/
CVE: CVE-2023-2080
Published: 2023-06-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud allows Blind SQL Injection.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://support.forcepoint.com/s/article/000041871; https://support.forcepoint.com/s/article/000041871
CVE: CVE-2023-29349
Published: 2023-06-16
Description: Microsoft ODBC and OLE DB Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29349; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29349
CVE: CVE-2023-29356
Published: 2023-06-16
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29356; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29356
CVE: CVE-2023-32025
Published: 2023-06-16
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32025; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32025
CVE: CVE-2023-32026
Published: 2023-06-16
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32026; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32026
CVE: CVE-2023-32027
Published: 2023-06-16
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32027; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32027
CVE: CVE-2023-32028
Published: 2023-06-16
Description: Microsoft SQL OLE DB Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32028; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32028
CVE: CVE-2023-3291
Published: 2023-06-16
Description: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.
CVSS Score: 3.3 (LOW)
CWE: CWE-122, CWE-787
References: https://github.com/gpac/gpac/commit/6a748ccc3f76ff10e3ae43014967ea4b0c088aaf; https://huntr.dev/bounties/526954e6-8683-4697-bfa2-886c3204a1d5; https://www.debian.org/security/2023/dsa-5452
CVE: CVE-2023-32752
Published: 2023-06-16
Description: L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-7189-5995e-2.html; https://www.twcert.org.tw/en/cp-139-7189-5995e-2.html
CVE: CVE-2023-32753
Published: 2023-06-16
Description: OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-7190-d73c1-2.html; https://www.twcert.org.tw/en/cp-139-7190-d73c1-2.html
CVE: CVE-2023-32754
Published: 2023-06-16
Description: Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html; https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html
CVE: CVE-2023-34845
Published: 2023-06-16
Description: Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://github.com/bludit/bludit/issues/1212#issuecomment-649514491; https://github.com/bludit/bludit/issues/1369#issuecomment-940806199; https://github.com/bludit/bludit/issues/1508
CVE: CVE-2023-35708
Published: 2023-06-16
Description: In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023; https://www.cisa.gov/news-events/alerts/2023/06/15/progress-software-releases-security-advisory-moveit-transfer-vulnerability; https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability
CVE: CVE-2023-34154
Published: 2023-06-16
Description: Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windows in an arbitrary way, consuming system resources.
CVSS Score: 8.2 (HIGH)
CWE: CWE-732
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202306-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202306-[PII_REDACTED]
CVE: CVE-2023-34157
Published: 2023-06-16
Description: Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-290
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202306-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202306-[PII_REDACTED]
CVE: CVE-2023-34165
Published: 2023-06-16
Description: Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202306-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202306-[PII_REDACTED]
CVE: CVE-2023-2431
Published: 2023-06-16
Description: A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.
CVSS Score: 3.4 (LOW)
CWE: CWE-1287
References: https://github.com/kubernetes/kubernetes/issues/118690; https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/43HDSKBKPSW53OW647B5ETHRWFFNHSRQ/
CVE: CVE-2023-25963
Published: 2023-06-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/js-jobs/wordpress-js-job-manager-plugin-2-0-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/js-jobs/wordpress-js-job-manager-plugin-2-0-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-26013
Published: 2023-06-16
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPChill Strong Testimonials plugin <= 3.0.2 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/strong-testimonials/wordpress-strong-testimonials-plugin-3-0-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/strong-testimonials/wordpress-strong-testimonials-plugin-3-0-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-26541
Published: 2023-06-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Suess asMember plugin <= 1.5.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/asmember/wordpress-asmember-plugin-1-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/asmember/wordpress-asmember-plugin-1-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-2783
Published: 2023-06-16
Description: Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-2784
Published: 2023-06-16
Description: Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests to the Apps. 
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-2786
Published: 2023-06-16
Description: Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-2787
Published: 2023-06-16
Description: Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/