deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-6303
Published: 2023-11-27
Description: A vulnerability was found in CSZCMS 1.3.0. It has been classified as problematic. This affects an unknown part of the file /admin/settings/ of the component Site Settings Page. The manipulation of the argument Additional Meta Tag with the input <svg><animate onbegin=alert(1) attributeName=x dur=1s> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/t34t/CVE/blob/main/CSZCMS/0-Store-XSS-Vulnerability-in-cszcmsV1.3.0.md; https://vuldb.com/?ctiid.246129; https://vuldb.com/?id.246129
CVE: CVE-2023-6304
Published: 2023-11-27
Description: A vulnerability was found in Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V[PII_REDACTED]0. It has been declared as critical. This vulnerability affects unknown code of the file /goform/goform_get_cmd_process of the component Ping Tool. The manipulation of the argument url leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-246130 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://drive.google.com/file/d/1DUSlAxTbNLBdv1aLUAn-tDMu6Z1rHYH8/view; https://vuldb.com/?ctiid.246130; https://vuldb.com/?id.246130
CVE: CVE-2023-6305
Published: 2023-11-27
Description: A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file ample/app/ajax/suppliar_data.php. The manipulation of the argument columns leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246131.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/BigTiger2020/2023/blob/main/Free%20and%20Open%20Source%20inventory%20management%20system/Free%20and%20Open%20Source%20inventory%20management%20system.md; https://vuldb.com/?ctiid.246131; https://vuldb.com/?id.246131
CVE: CVE-2023-6306
Published: 2023-11-27
Description: A vulnerability classified as critical has been found in SourceCodester Free and Open Source Inventory Management System 1.0. Affected is an unknown function of the file /ample/app/ajax/member_data.php. The manipulation of the argument columns leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246132.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/BigTiger2020/2023/blob/main/Free%20and%20Open%20Source%20inventory%20management%20system/Free%20and%20Open%20Source%20inventory%20management%20system2.md; https://vuldb.com/?ctiid.246132; https://vuldb.com/?id.246132
CVE: CVE-2023-6307
Published: 2023-11-27
Description: A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /download/image. The manipulation of the argument imageUrl leads to relative path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://github.com/N0b1e6/exp/blob/main/README.md; https://vuldb.com/?ctiid.246133; https://vuldb.com/?id.246133
CVE: CVE-2023-6308
Published: 2023-11-27
Description: A vulnerability, which was classified as critical, has been found in Xiamen Four-Faith Video Surveillance Management System 2016/2017. Affected by this issue is some unknown functionality of the component Apache Struts. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-246134 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/gatsby2003/Struts2-046/blob/main/Xiamen%20Four-Faith%20Communication%20Technology%20Co.,%20Ltd.%20video%20surveillance%20management%20system%20has%20a%20command%20execution%20vulnerability.md; https://vuldb.com/?ctiid.246134; https://vuldb.com/?id.246134
CVE: CVE-2023-6309
Published: 2023-11-27
Description: A vulnerability, which was classified as critical, was found in moses-smt mosesdecoder up to 4.0. This affects an unknown part of the file contrib/iSenWeb/trans_result.php. The manipulation of the argument input1 leads to os command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246135.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-78
References: https://github.com/moses-smt/mosesdecoder/issues/237; https://vuldb.com/?ctiid.246135; https://vuldb.com/?id.246135
CVE: CVE-2023-6310
Published: 2023-11-27
Description: A vulnerability has been found in SourceCodester Loan Management System 1.0 and classified as critical. This vulnerability affects the function delete_borrower of the file deleteBorrower.php. The manipulation of the argument borrower_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246136.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20browser.md; https://vuldb.com/?ctiid.246136; https://vuldb.com/?id.246136
CVE: CVE-2023-6311
Published: 2023-11-27
Description: A vulnerability was found in SourceCodester Loan Management System 1.0 and classified as critical. This issue affects the function delete_ltype of the file delete_ltype.php of the component Loan Type Page. The manipulation of the argument ltype_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246137 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20deleteltype.md; https://vuldb.com/?ctiid.246137; https://vuldb.com/?id.246137
CVE: CVE-2023-6312
Published: 2023-11-27
Description: A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function delete_user of the file deleteUser.php of the component Users Page. The manipulation of the argument user_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-246138 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20deleteuser.md; https://vuldb.com/?ctiid.246138; https://vuldb.com/?id.246138
CVE: CVE-2023-6313
Published: 2023-11-27
Description: A vulnerability was found in SourceCodester URL Shortener 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Long URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246139.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/url-shortener.md; https://vuldb.com/?ctiid.246139; https://vuldb.com/?id.246139
CVE: CVE-2023-25632
Published: 2023-11-27
Description: The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-359
References: https://cve.naver.com/detail/cve-2023-25632.html; https://cve.naver.com/detail/cve-2023-25632.html
CVE: CVE-2023-47865
Published: 2023-11-27
Description: Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the Hardened Mode setting was enabled


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-35075
Published: 2023-11-27
Description: Mattermost fails to use  innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though. 


CVSS Score: 3.1 (LOW)
CWE: CWE-74, CWE-74
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-40703
Published: 2023-11-27
Description: Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading to Denial of Service, by patching the field of a block using a specially crafted string. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-43754
Published: 2023-11-27
Description: Mattermost fails to check whether the  “Allow users to view archived channels”  setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-45223
Published: 2023-11-27
Description: Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-47168
Published: 2023-11-27
Description: Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-48268
Published: 2023-11-27
Description: Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-48369
Published: 2023-11-27
Description: Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-49068
Published: 2023-11-27
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1.

Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.


CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/apache/dolphinscheduler/pull/15192; https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq; https://github.com/apache/dolphinscheduler/pull/15192
CVE: CVE-2023-6202
Published: 2023-11-27
Description: Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-6254
Published: 2023-11-27
Description: A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response-
This issue affects OTRS: from 8.0.X through 8.0.37.


CVSS Score: 8.1 (HIGH)
CWE: CWE-522, CWE-522
References: https://otrs.com/release-notes/otrs-security-advisory-2023-11/; https://otrs.com/release-notes/otrs-security-advisory-2023-11/
CVE: CVE-2023-40610
Published: 2023-11-27
Description: Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2023/11/27/2; https://github.com/orangecertcc/security-research/security/advisories/GHSA-f678-j579-4xf5; https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot
CVE: CVE-2023-42501
Published: 2023-11-27
Description: Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations.
This issue affects Apache Superset: before 2.1.2.
Users should upgrade to version or above 2.1.2 and run `superset init` to reconstruct the Gamma role or remove `can_read` permission from the mentioned resources.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2023/11/27/3; https://lists.apache.org/thread/vk1rmrh9kz0chjmc9tk7o3md6zpz4ygh; http://www.openwall.com/lists/oss-security/2023/11/27/3
CVE: CVE-2023-43701
Published: 2023-11-27
Description: Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. 
Users are recommended to upgrade to version 2.1.2, which fixes this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread/4dnr1knk50fw60jxkjgqj228f0xcc892; https://www.openwall.com/lists/oss-security/2023/11/27/4; https://lists.apache.org/thread/4dnr1knk50fw60jxkjgqj228f0xcc892
CVE: CVE-2023-5607
Published: 2023-11-27
Description: 
An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Interface. The import logic has been updated to restrict file types and content. 


CVSS Score: 8.4 (HIGH)
CWE: CWE-22
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10411; https://kcm.trellix.com/corporate/index?page=content&id=SB10411
CVE: CVE-2023-5871
Published: 2023-11-27
Description: A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://access.redhat.com/errata/RHSA-2024:2204; https://access.redhat.com/security/cve/CVE-2023-5871; https://bugzilla.redhat.com/show_bug.cgi?id=2247308
CVE: CVE-2023-4590
Published: 2023-11-27
Description: Buffer overflow vulnerability in Frhed hex editor, affecting version 1.6.0. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument through the Structured Exception Handler (SEH) registers.
CVSS Score: 7.3 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.incibe.es/en/incibe-cert/notices/aviso/buffer-overflow-vulnerability-frhed; https://www.incibe.es/en/incibe-cert/notices/aviso/buffer-overflow-vulnerability-frhed
CVE: CVE-2023-4931
Published: 2023-11-27
Description: Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-427
References: https://support.plesk.com/hc/en-us/articles/[PII_REDACTED]103; https://www.incibe.es/en/incibe-cert/notices/aviso/uncontrolled-search-path-element-vulnerability-plesk; https://support.plesk.com/hc/en-us/articles/[PII_REDACTED]103
CVE: CVE-2023-6287
Published: 2023-11-27
Description: Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files.
CVSS Score: 3.3 (LOW)
CWE: CWE-598, CWE-532
References: https://checkmk.com/werk/9554; https://checkmk.com/werk/9554
CVE: CVE-2023-31275
Published: 2023-11-27
Description: An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-457, CWE-908
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1748; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1748; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1748
CVE: CVE-2023-32616
Published: 2023-11-27
Description: A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles 3D annotations. A specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1837; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1837; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1837
CVE: CVE-2023-35985
Published: 2023-11-27
Description: An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-73, CWE-610
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1834; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1834; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1834
CVE: CVE-2023-38573
Published: 2023-11-27
Description: A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles a signature field. A specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1839; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1839; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1839
CVE: CVE-2023-39542
Published: 2023-11-27
Description: A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files, which can lead to remote code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-73, CWE-610
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1832; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1832; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1832
CVE: CVE-2023-40194
Published: 2023-11-27
Description: An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace characters. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-73, CWE-610
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1833; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1833; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1833
CVE: CVE-2023-41257
Published: 2023-11-27
Description: A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties.  A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1838; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1838; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1838
CVE: CVE-2023-49029
Published: 2023-11-27
Description: Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitrary code via the nama parameter in the lock/lock.php file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Chiaki2333/717b83b800180e1a4c3ee5f6e49f95c0; https://github.com/Chiaki2333/vulnerability/blob/main/smpn1smg-absis-XSS-lock.php-nama.md; https://github.com/smpn1smg/absis