deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-26454
Published: 2023-11-02
Description: Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.


CVSS Score: 7.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE: CVE-2023-26455
Published: 2023-11-02
Description: RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.


CVSS Score: 5.6 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE: CVE-2023-26456
Published: 2023-11-02
Description: Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE: CVE-2023-29043
Published: 2023-11-02
Description: Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document. Script code embedded in malicious documents could be executed in the context of the user editing the document when performing certain actions, like copying content. The relevant attribute does now get encoded to avoid the possibility of executing script code. No publicly available exploits are known.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE: CVE-2023-29044
Published: 2023-11-02
Description: Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get escaped to avoid code execution. No publicly available exploits are known.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE: CVE-2023-29045
Published: 2023-11-02
Description: Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now gets checked for validity to avoid code execution. No publicly available exploits are known.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE: CVE-2023-29046
Published: 2023-11-02
Description: Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE: CVE-2023-29047
Published: 2023-11-02
Description: Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. None No publicly available exploits are known.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE: CVE-2023-42802
Published: 2023-11-02
Description: GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20, CWE-434
References: https://github.com/glpi-project/glpi/releases/tag/10.0.10; https://github.com/glpi-project/glpi/security/advisories/GHSA-rrh2-x4ch-pq3m; https://github.com/glpi-project/glpi/releases/tag/10.0.10
CVE: CVE-2023-45323
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45324
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45325
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'address' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45326
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45327
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45328
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45329
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45330
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45331
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45332
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45333
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45334
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45335
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45336
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45337
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45339
Published: 2023-11-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-45340
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/details-router.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45341
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_price' parameter of the routers/menu-router.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45342
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/register-router.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45343
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'ticket_id' parameter of the routers/ticket-message.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45344
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_balance' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-5919
Published: 2023-11-02
Description: A vulnerability was found in SourceCodester Company Website CMS 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /dashboard/createblog of the component Create Blog Page. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-244310 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://vuldb.com/?ctiid.244310; https://vuldb.com/?id.244310; https://www.jianshu.com/p/a451953f36f1?v=[PII_REDACTED]08
CVE: CVE-2023-38469
Published: 2023-11-02
Description: A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://access.redhat.com/security/cve/CVE-2023-38469; https://bugzilla.redhat.com/show_bug.cgi?id=2191687; https://access.redhat.com/security/cve/CVE-2023-38469
CVE: CVE-2023-38470
Published: 2023-11-02
Description: A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://access.redhat.com/security/cve/CVE-2023-38470; https://bugzilla.redhat.com/show_bug.cgi?id=2191690; https://access.redhat.com/security/cve/CVE-2023-38470
CVE: CVE-2023-38471
Published: 2023-11-02
Description: A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://access.redhat.com/security/cve/CVE-2023-38471; https://bugzilla.redhat.com/show_bug.cgi?id=2191691; https://access.redhat.com/security/cve/CVE-2023-38471
CVE: CVE-2023-38472
Published: 2023-11-02
Description: A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://access.redhat.com/security/cve/CVE-2023-38472; https://bugzilla.redhat.com/show_bug.cgi?id=2191692; https://access.redhat.com/security/cve/CVE-2023-38472
CVE: CVE-2023-45338
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45345
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45346
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-45347
Published: 2023-11-02
Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_verified' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/hann; https://projectworlds.in/; https://fluidattacks.com/advisories/hann
CVE: CVE-2023-46725
Published: 2023-11-02
Description: FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the `/api/updateProducts.json` endpoint to make the server send a request to an arbitrary host. This means that the server can be used as a proxy into the internal network where the server is. Furthermore, the checks on a valid image are not adequate, leading to a time of check time of use issue. For example, by using a custom server that returns 200 on HEAD requests, then return a valid image on first GET request and then a 302 redirect to final target on second GET request, the server will copy whatever file is at the redirect destination, making this a full SSRF. Version 3.6.1 fixes this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-918, CWE-367, CWE-918
References: https://github.com/foodcoopshop/foodcoopshop/commit/0d5bec5c4c22e1affe7fd321a30e3f3a4d99e808; https://github.com/foodcoopshop/foodcoopshop/pull/972; https://github.com/foodcoopshop/foodcoopshop/security/advisories/GHSA-jhww-fx2j-3rf7
CVE: CVE-2022-4900
Published: 2023-11-02
Description: A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://access.redhat.com/security/cve/CVE-2022-4900; https://bugzilla.redhat.com/show_bug.cgi?id=2179880; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-38473
Published: 2023-11-02
Description: A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://access.redhat.com/security/cve/CVE-2023-38473; https://bugzilla.redhat.com/show_bug.cgi?id=2191694; https://access.redhat.com/security/cve/CVE-2023-38473
CVE: CVE-2023-46925
Published: 2023-11-02
Description: Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/reportico-web/reportico/issues/47; https://github.com/reportico-web/reportico/issues/47
CVE: CVE-2023-4217
Published: 2023-11-02
Description: A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.


CVSS Score: 3.1 (LOW)
CWE: CWE-1004, CWE-668
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities
CVE: CVE-2023-5035
Published: 2023-11-02
Description: A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.


CVSS Score: 3.1 (LOW)
CWE: CWE-614, CWE-319
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities
CVE: CVE-2023-5846
Published: 2023-11-02
Description: 
Franklin Fueling System TS-550 versions prior to 1.9.23.8960 are vulnerable to attackers decoding admin credentials, resulting in unauthenticated access to the device.





CVSS Score: 8.3 (HIGH)
CWE: CWE-916, CWE-916
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-04; https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-04
CVE: CVE-2023-31016
Published: 2023-11-02
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability where an uncontrolled search path element may allow an attacker to execute arbitrary code, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5491; https://nvidia.custhelp.com/app/answers/detail/a_id/5491
CVE: CVE-2023-31017
Published: 2023-11-02
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may be able to write arbitrary data to privileged locations by using reparse points. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-552, CWE-552
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5491; https://nvidia.custhelp.com/app/answers/detail/a_id/5491
CVE: CVE-2023-31018
Published: 2023-11-02
Description: NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer dereference, which may lead to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5491; https://nvidia.custhelp.com/app/answers/detail/a_id/5491
CVE: CVE-2023-31019
Published: 2023-11-02
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restricts access from the named pipe server to a connecting client, which may lead to potential impersonation to the client's secure context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5491; https://nvidia.custhelp.com/app/answers/detail/a_id/5491
CVE: CVE-2023-31020
Published: 2023-11-02
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control, which may lead to denial of service or data tampering.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5491; https://nvidia.custhelp.com/app/answers/detail/a_id/5491