deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-46042
Published: 2023-10-19
Description: An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Num-Nine/CVE/wiki/A-file-write-vulnerability-exists-in-GetSimpleCMS; https://github.com/Num-Nine/CVE/wiki/A-file-write-vulnerability-exists-in-GetSimpleCMS
CVE: CVE-2023-5654
Published: 2023-10-19
Description: The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285, CWE-116
References: https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231; https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231
CVE: CVE-2022-47583
Published: 2023-10-19
Description: Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://dgl.cx/2023/09/ansi-terminal-security#mintty; https://github.com/mintty/mintty/releases/tag/3.6.3; https://dgl.cx/2023/09/ansi-terminal-security#mintty
CVE: CVE-2023-46033
Published: 2023-10-19
Description: D-Link (Non-US) DSL-2750U N300 ADSL2+ and (Non-US) DSL-2730U N150 ADSL2+ are vulnerable to Incorrect Access Control. The UART/Serial interface on the PCB, provides log output and a root terminal without proper access control.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10357; https://www.dlink.com/en/products/dsl-2730u-wireless-n150-adsl2-router; https://www.dlink.com/en/products/dsl-2750u-wireless-n-300-adsl2-modem-router
CVE: CVE-2023-35126
Published: 2023-10-19
Description: An out-of-bounds write vulnerability exists within the parsers for both the "DocumentViewStyles" and "DocumentEditStyles" streams of Ichitaro 2023 1.0.1.59372 when processing types 0x0000-0x0009 of a style record with the type 0x2008. A specially crafted document can cause memory corruption, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129, CWE-787
References: https://jvn.jp/en/jp/JVN28846531/index.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1825; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1825
CVE: CVE-2023-45277
Published: 2023-10-19
Description: Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7; https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies; https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7
CVE: CVE-2023-45278
Published: 2023-10-19
Description: Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7; https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies; https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7
CVE: CVE-2023-45281
Published: 2023-10-19
Description: An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies; https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies
CVE: CVE-2023-45665
Published: 2023-10-19
Description: Rejected reason: This CVE is a duplicate of another CVE.
CVE: CVE-2023-34366
Published: 2023-10-19
Description: A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause memory corruption, resulting in arbitrary code execution. Victim would need to open a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://jvn.jp/en/jp/JVN28846531/index.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1758; https://jvn.jp/en/jp/JVN28846531/index.html
CVE: CVE-2023-35986
Published: 2023-10-19
Description: 
Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to a stack-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.


CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-01; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-01
CVE: CVE-2023-38127
Published: 2023-10-19
Description: An integer overflow exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the parser to make an under-sized allocation, which can later allow for memory corruption, potentially resulting in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://jvn.jp/en/jp/JVN28846531/index.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1808; https://jvn.jp/en/jp/JVN28846531/index.html
CVE: CVE-2023-38128
Published: 2023-10-19
Description: An out-of-bounds write vulnerability exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause a type confusion, which can lead to memory corruption and eventually arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-787
References: https://jvn.jp/en/jp/JVN28846531/index.html; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1809; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1809
CVE: CVE-2023-39431
Published: 2023-10-19
Description: 


Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.




CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-01; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-01
CVE: CVE-2023-5059
Published: 2023-10-19
Description: 




Santesoft Sante FFT Imaging lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-02; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-02
CVE: CVE-2023-40153
Published: 2023-10-19
Description: 
The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02
CVE: CVE-2023-41088
Published: 2023-10-19
Description: 










The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with access to the network, where clients have access to the DexGate server, could capture traffic. The attacker can later us the information within it to access the application.












CVSS Score: 6.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02
CVE: CVE-2023-41089
Published: 2023-10-19
Description: 








The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user as long as the device keeps the session active, since the attack takes advantage of the cookie header to generate "legitimate" requests.










CVSS Score: 8.0 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02
CVE: CVE-2023-42435
Published: 2023-10-19
Description: 




The affected product is vulnerable to a cross-site request forgery vulnerability, which may allow an attacker to perform actions with the permissions of a victim user.






CVSS Score: 5.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02
CVE: CVE-2023-42666
Published: 2023-10-19
Description: 












The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attacker to create malicious requests for obtaining the information of the version about the web server used.














CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02
CVE: CVE-2023-43986
Published: 2023-10-19
Description: DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/fr/declinaisons-personnalisation/20343-configurateur-avance-de-produit-sur-mesure-par-etape.html; https://security.friendsofpresta.org/modules/2023/10/19/configurator.html; https://addons.prestashop.com/fr/declinaisons-personnalisation/20343-configurateur-avance-de-produit-sur-mesure-par-etape.html
CVE: CVE-2023-45381
Published: 2023-10-19
Description: In the module "Creative Popup" (creativepopup) up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via `cp_download_popup().`
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/fr/pop-up/39348-creative-popup.html; https://security.friendsofpresta.org/modules/2023/10/19/creativepopup.html; https://addons.prestashop.com/fr/pop-up/39348-creative-popup.html
CVE: CVE-2023-45809
Published: 2023-10-19
Description: Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 4.1.8 (LTS), 5.0.5 and 5.1.3. The fix is also included in Release Candidate 1 of the forthcoming Wagtail 5.2 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.7 (LOW)
CWE: CWE-200, CWE-425, CWE-532
References: https://github.com/wagtail/wagtail/commit/bc96aed6ac53f998b2f4c4bf97e2d4f5fe337e5b; https://github.com/wagtail/wagtail/security/advisories/GHSA-fc75-58r8-rm3h; https://github.com/wagtail/wagtail/commit/bc96aed6ac53f998b2f4c4bf97e2d4f5fe337e5b
CVE: CVE-2023-45820
Published: 2023-10-19
Description: Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb; https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m; https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb
CVE: CVE-2023-45825
Published: 2023-10-19
Description: ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using `fmt.Errorf("something went wrong (credentials: %q)", credentials)` during connection to the YDB server. If such logging occurred, a  malicious user with access to logs could read sensitive information (i.e. credentials) information and use it to get access to the database. ydb-go-sdk contains this problem in versions from v3.48.6 to v3.53.2. The fix for this problem has been released in version v3.53.3. Users are advised to upgrade. Users unable to upgrade should implement the `fmt.Stringer` interface in your custom credentials type with explicit stringify of object state.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://github.com/ydb-platform/ydb-go-sdk/blob/master/credentials/credentials.go#L10; https://github.com/ydb-platform/ydb-go-sdk/blob/v3.48.6/internal/balancer/balancer.go#L71; https://github.com/ydb-platform/ydb-go-sdk/pull/859
CVE: CVE-2023-45826
Published: 2023-10-19
Description: Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0; https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj; https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0
CVE: CVE-2023-45992
Published: 2023-10-19
Description: A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, could allow the attacker to gain full admin privileges on the exploited system.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-352
References: http://ruckus.com; https://github.com/harry935/CVE-2023-45992; https://server.cloudpath/
CVE: CVE-2022-42150
Published: 2023-10-19
Description: TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default configuration could cause Container Escape.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-276
References: https://github.com/eBPF-Research/eBPF-Attack/blob/main/PoC.md#attack-requirements; https://github.com/tinyclub/cloud-lab/blob/d19ff92713685a7fb84b423dea6a184b25c378c9/configs/common/seccomp-profiles-default.json; https://github.com/tinyclub/linux-lab/issues/14
CVE: CVE-2023-27791
Published: 2023-10-19
Description: An issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate privileges via insecure PRNG.
CVSS Score: 8.1 (HIGH)
CWE: CWE-338
References: https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue; https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue
CVE: CVE-2023-30633
Published: 2023-10-19
Description: An issue was discovered in TrEEConfigDriver in Insyde InsydeH2O with kernel 5.0 through 5.5. It can report false TPM PCR values, and thus mask malware activity. Devices use Platform Configuration Registers (PCRs) to record information about device and software configuration to ensure that the boot process is secure. (For example, Windows uses these PCR measurements to determine device health.) A vulnerable device can masquerade as a healthy device by extending arbitrary values into Platform Configuration Register (PCR) banks. This requires physical access to a target victim's device, or compromise of user credentials for a device. This issue is similar to CVE-2021-42299 (on Surface Pro devices).
CVSS Score: 5.3 (MEDIUM)
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2023045; https://www.insyde.com/security-pledge
CVE: CVE-2023-38584
Published: 2023-10-19
Description: 






In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12; https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf
CVE: CVE-2023-40145
Published: 2023-10-19
Description: 








In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.




CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12; https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf
CVE: CVE-2023-43492
Published: 2023-10-19
Description: 








In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12; https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf
CVE: CVE-2023-45376
Published: 2023-10-19
Description: In the module "Carousels Pack - Instagram, Products, Brands, Supplier" (hicarouselspack) for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct().`
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/en/sliders-galleries/20410-carousels-pack-instagram-products-brands-supplier.html; https://security.friendsofpresta.org/modules/2023/10/19/hicarouselspack.html; https://addons.prestashop.com/en/sliders-galleries/20410-carousels-pack-instagram-products-brands-supplier.html
CVE: CVE-2023-27792
Published: 2023-10-19
Description: An issue found in IXP Data Easy Install v.6.6.14884.0 allows an attacker to escalate privileges via lack of permissions applied to sub directories.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue; https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue
CVE: CVE-2023-27793
Published: 2023-10-19
Description: An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak encoding of sensitive information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue; https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue
CVE: CVE-2023-27795
Published: 2023-10-19
Description: An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue; https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue
CVE: CVE-2023-30131
Published: 2023-10-19
Description: An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue; https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue
CVE: CVE-2023-30132
Published: 2023-10-19
Description: An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptographic Key.
CVSS Score: 7.8 (HIGH)
CWE: CWE-326
References: https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue; https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue
CVE: CVE-2023-45821
Published: 2023-10-19
Description: Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which the `registryIsDockerHub` function was only checking that the registry domain had the `docker.io` suffix. Artifact Hub allows providing some Docker credentials that are used to increase the rate limit applied when interacting with the Docker Hub registry API to read publicly available content. Due to the incorrect check described above, it'd be possible to hijack those credentials by purchasing a domain which ends with `docker.io` and deploying a fake OCI registry on it. <https://artifacthub.io/> uses some credentials that only have permissions to read public content available in the Docker Hub. However, even though credentials for private repositories (disabled on `artifacthub.io`) are handled in a different way, other Artifact Hub deployments could have been using them for a different purpose. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-494
References: https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0; https://github.com/artifacthub/hub/security/advisories/GHSA-g6pq-x539-7w4j; https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0