deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-30444
Published: 2023-04-27
Description: IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.  IBM X-Force ID:  253350.
CVSS Score: 7.1 (HIGH)
CWE: CWE-918
References: https://www.ibm.com/support/pages/node/6985859; https://www.ibm.com/support/pages/node/6985859; https://www.ibm.com/support/pages/node/6985859
CVE: CVE-2023-24966
Published: 2023-04-27
Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  246904.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/246904; https://www.ibm.com/support/pages/node/6986333; https://exchange.xforce.ibmcloud.com/vulnerabilities/246904
CVE: CVE-2023-2341
Published: 2023-04-27
Description: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11; https://huntr.dev/bounties/cf3901ac-a649-478f-ab08-094ef759c11d; https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11
CVE: CVE-2023-2342
Published: 2023-04-27
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564; https://huntr.dev/bounties/01cd3ed5-dce8-4021-9de0-81cb14bf1829; https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564
CVE: CVE-2023-2343
Published: 2023-04-27
Description: Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e; https://huntr.dev/bounties/2fa17227-a717-4b66-ab5a-16bffbb4edb2; https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e
CVE: CVE-2023-2344
Published: 2023-04-27
Description: A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_service of the component HTTP POST Request Handler. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227587.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: http://cdn.polowong.top/image[PII_REDACTED]3041378.png; https://vuldb.com/?ctiid.227587; https://vuldb.com/?id.227587
CVE: CVE-2023-30349
Published: 2023-04-27
Description: JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/jflyfox/jfinal_cms/issues/54; https://github.com/jflyfox/jfinal_cms/issues/54
CVE: CVE-2023-2345
Published: 2023-04-27
Description: A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to improper authorization. The attack may be launched remotely. The identifier of this vulnerability is VDB-227588.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-285
References: https://vuldb.com/?ctiid.227588; https://vuldb.com/?id.227588; https://vuldb.com/?ctiid.227588
CVE: CVE-2023-2346
Published: 2023-04-27
Description: A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227589 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Service%20Provider%20Management%20System/Service%20Provider%20Management%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.227589; https://vuldb.com/?id.227589
CVE: CVE-2023-2347
Published: 2023-04-27
Description: A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227590 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Service%20Provider%20Management%20System/Service%20Provider%20Management%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.227590; https://vuldb.com/?id.227590
CVE: CVE-2023-2348
Published: 2023-04-27
Description: A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227591.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Service%20Provider%20Management%20System/Service%20Provider%20Management%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.227591; https://vuldb.com/?id.227591
CVE: CVE-2023-30338
Published: 2023-04-27
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/emlog/emlog/issues/229; https://github.com/emlog/emlog/issues/229
CVE: CVE-2023-30847
Published: 2023-04-27
Description: H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request  number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later.
CVSS Score: 8.2 (HIGH)
CWE: CWE-824
References: https://github.com/h2o/h2o/commit/f010336bab162839df43d9e[PII_REDACTED]6c97e33; https://github.com/h2o/h2o/pull/3229; https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx
CVE: CVE-2023-2349
Published: 2023-04-27
Description: A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227592.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Service%20Provider%20Management%20System/Service%20Provider%20Management%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.227592; https://vuldb.com/?id.227592
CVE: CVE-2023-2350
Published: 2023-04-27
Description: A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227593 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Service%20Provider%20Management%20System/Service%20Provider%20Management%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.227593; https://vuldb.com/?id.227593
CVE: CVE-2023-30848
Published: 2023-04-27
Description: Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3.patch; https://github.com/pimcore/pimcore/pull/14972; https://github.com/pimcore/pimcore/security/advisories/GHSA-6mhm-gcpf-5gr8
CVE: CVE-2023-30849
Published: 2023-04-27
Description: Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/pimcore/pimcore/commit/c6c80905e58c7724c776f980570a56df7016c6d1.patch; https://github.com/pimcore/pimcore/pull/14968; https://github.com/pimcore/pimcore/security/advisories/GHSA-xmg8-w465-mr56
CVE: CVE-2023-30624
Published: 2023-04-27
Description: Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled with LLVM 16 which causes some writes, which are critical for correctness, to be optimized away. Vulnerable versions of Wasmtime compiled with Rust 1.70, which is currently in beta, or later are known to have incorrectly compiled functions. Versions of Wasmtime compiled with the current Rust stable release, 1.69, and prior are not known at this time to have any issues, but can theoretically exhibit potential issues.

The underlying problem is that Wasmtime's runtime state for an instance involves a Rust-defined structure called `Instance` which has a trailing `VMContext` structure after it. This `VMContext` structure has a runtime-defined layout that is unique per-module. This representation cannot be expressed with safe code in Rust so `unsafe` code is required to maintain this state. The code doing this, however, has methods which take `&self` as an argument but modify data in the `VMContext` part of the allocation. This means that pointers derived from `&self` are mutated. This is typically not allowed, except in the presence of `UnsafeCell`, in Rust. When compiled to LLVM these functions have `noalias readonly` parameters which means it's UB to write through the pointers.

Wasmtime's internal representation and management of `VMContext` has been updated to use `&mut self` methods where appropriate. Additionally verification tools for `unsafe` code in Rust, such as `cargo miri`, are planned to be executed on the `main` branch soon to fix any Rust-level issues that may be exploited in future compiler versions.

Precomplied binaries available for Wasmtime from GitHub releases have been compiled with at most LLVM 15 so are not known to be vulnerable. As mentioned above, however, it's still recommended to update.

Wasmtime version 6.0.2, 7.0.1, and 8.0.1 have been issued which contain the patch necessary to work correctly on LLVM 16 and have no known UB on LLVM 15 and earlier. If Wasmtime is compiled with Rust 1.69 and prior, which use LLVM 15, then there are no known issues. There is a theoretical possibility for undefined behavior to exploited, however, so it's recommended that users upgrade to a patched version of Wasmtime. Users using beta Rust (1.70 at this time) or nightly Rust (1.71 at this time) must update to a patched version to work correctly.
CVSS Score: 3.9 (LOW)
CWE: CWE-758
References: https://github.com/bytecodealliance/wasmtime/commit/0977952dcd9d482bff7c288868ccb52769b3a92e; https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ch89-5g45-qwc7; https://github.com/bytecodealliance/wasmtime/commit/0977952dcd9d482bff7c288868ccb52769b3a92e
CVE: CVE-2023-30850
Published: 2023-04-27
Description: Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38.patch; https://github.com/pimcore/pimcore/pull/14952; https://github.com/pimcore/pimcore/security/advisories/GHSA-jwg4-qcgv-5wg6
CVE: CVE-2023-30852
Published: 2023-04-27
Description: Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the `scriptPath` and `scripts` parameters. The `scriptPath` parameter is not sanitized properly and is vulnerable to path traversal attack. Any JavaScript/CSS file from the application server can be read by specifying sufficient number of `../` patterns to go out from the application webroot followed by path of the folder where the file is located in the "scriptPath" parameter and the file name in the "scripts" parameter. The JavaScript file is successfully read only if the web application has read access to it. Users should update to version 10.5.21 to receive a patch or, as a workaround, apply the patch manual.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/pimcore/pimcore/commit/498cadec2292f7842fb10612068ac78496e884b4.patch; https://github.com/pimcore/pimcore/pull/14959; https://github.com/pimcore/pimcore/security/advisories/GHSA-j5c3-r84f-9596
CVE: CVE-2023-2158
Published: 2023-04-27
Description: Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user's account by crafting a custom "Remember Me" token. This is possible due to the use of a hard-coded cipher which was used when generating the token. A malicious actor who creates this token can supply it to a separate Code Dx system, provided they know the username they want to impersonate, and impersonate the user.  Score 6.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321, CWE-798, CWE-798
References: https://community.synopsys.com/s/question/0D5Hr00006VdZblKAF/announcement-changelog-code-dx-202342; https://community.synopsys.com/s/question/0D5Hr00006VdZblKAF/announcement-changelog-code-dx-202342
CVE: CVE-2023-2335
Published: 2023-04-27
Description: 
Plaintext Password in Registry

 vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve 

Admin user credentials

This issue affects surelock windows: from 2.3.12 through 2.40.0.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-314, CWE-522
References: https://www.42gears.com/security-and-compliance/; https://www.42gears.com/security-and-compliance/
CVE: CVE-2023-21712
Published: 2023-04-27
Description: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21712; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21712
CVE: CVE-2023-27860
Published: 2023-04-27
Description: IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message.  This information could be used in further attacks against the system.  IBM X-Force ID:  249207.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249207; https://www.ibm.com/support/pages/node/6985679; https://exchange.xforce.ibmcloud.com/vulnerabilities/249207
CVE: CVE-2023-28261
Published: 2023-04-27
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28261; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28261; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-28286
Published: 2023-04-27
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28286; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28286; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-2355
Published: 2023-04-27
Description: Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3900.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-4048; https://security-advisory.acronis.com/advisories/SEC-4048
CVE: CVE-2022-31647
Published: 2023-04-27
Description: Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59, CWE-59
References: https://docs.docker.com/desktop/release-notes/#docker-desktop-460; https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-2; https://docs.docker.com/desktop/release-notes/#docker-desktop-460
CVE: CVE-2022-34292
Published: 2023-04-27
Description: Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling the DataFolder parameter for DockerDesktop.vhdx, a similar issue to CVE-2022-31647.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59, CWE-59
References: https://docs.docker.com/desktop/release-notes/#docker-desktop-460; https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-2; https://docs.docker.com/desktop/release-notes/#docker-desktop-460
CVE: CVE-2022-37326
Published: 2023-04-27
Description: Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field inside the DaemonJSON field in the WindowsContainerStartRequest class. This can indirectly lead to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://docs.docker.com/desktop/release-notes/#docker-desktop-460; https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-2; https://docs.docker.com/desktop/release-notes/#docker-desktop-460
CVE: CVE-2022-38730
Published: 2023-04-27
Description: Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. This allows exploiting a symlink vulnerability in ..\dataRoot\network\files\local-kv.db because of a TOCTOU race condition.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59, CWE-367, CWE-59
References: https://docs.docker.com/desktop/release-notes/#docker-desktop-460; https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-2; https://docs.docker.com/desktop/release-notes/#docker-desktop-460
CVE: CVE-2023-29950
Published: 2023-04-27
Description: swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules/swftools.c
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/matthiaskramm/swftools/issues/198; https://github.com/matthiaskramm/swftools/issues/198
CVE: CVE-2022-25091
Published: 2023-04-27
Description: Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: http://www.infopop.com/support/ubbclassic/version5.html; https://marc.info/?l=vuln-dev&m=[PII_REDACTED]1786&w=2; https://vulners.com/securityvulns/SECURITYVULNS:DOC:954
CVE: CVE-2023-25437
Published: 2023-04-27
Description: An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cleartext passwords passed in the raw HTML.
CVSS Score: 8.8 (HIGH)
CWE: CWE-319, CWE-319
References: https://i.imgur.com/aDuiY8q.png; https://yechiel.xyz/vulnerability-in-vtechs-vcs754a-business-phones-exposes-sip-credentials; https://i.imgur.com/aDuiY8q.png
CVE: CVE-2023-29471
Published: 2023-04-27
Description: Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://akka.io/security/alpakka-kafka-cve-2023-29471.html; https://github.com/akka/alpakka-kafka/issues/1592; https://akka.io/security/alpakka-kafka-cve-2023-29471.html
CVE: CVE-2023-29489
Published: 2023-04-27
Description: An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/; https://forums.cpanel.net/threads/cpanel-tsr-2023-0001-full-disclosure.708949/; https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/
CVE: CVE-2023-1967
Published: 2023-04-27
Description: Keysight N8844A Data Analytics Web Service deserializes untrusted data without sufficiently verifying the resulting data will be valid. 
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-115-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-115-01
CVE: CVE-2023-30380
Published: 2023-04-27
Description: An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/Howard512966/DedeCMS-v5.7.107-Directory-Traversal; https://github.com/Howard512966/DedeCMS-v5.7.107-Directory-Traversal
CVE: CVE-2023-28384
Published: 2023-04-27
Description: mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06; https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06
CVE: CVE-2023-28400
Published: 2023-04-27
Description: mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. 
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06; https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06