deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-30766
Published: 2023-06-13
Description: Hidden functionality issue exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on the product or the device settings may be altered. Affected products and versions are as follows: KB-AHR04D versions prior to 91110.1.101106.78, KB-AHR08D versions prior to 91210.1.101106.78, KB-AHR16D versions prior to 91310.1.101106.78, KB-IRIP04A versions prior to 95110.1.100290.78A, KB-IRIP08A versions prior to 95210.1.100290.78A, and KB-IRIP16A versions prior to 95310.1.100290.78A.
CVSS Score: 9.8 (CRITICAL)
References: https://jvn.jp/en/vu/JVNVU90812349/; https://www.kbdevice.com/news/%e3%83%ac%e3%82%b3%e3%83%bc%e3%83%80%e3%83%bc%e3%81%ae%e3%83%8d%e3%83%83%e3%83%88%e3%83%af%e3%83%bc%e3%82%af%e6%94%bb%e6%92%83%e3%81%ab%e5%af%be%e3%81%99%e3%82%8b%e3%82%a2%e3%83%83%e3%83%97%e3%83%87/; https://jvn.jp/en/vu/JVNVU90812349/
CVE: CVE-2023-31195
Published: 2023-06-13
Description: ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is in a position to be able to mount a man-in-the-middle attack, and a user is tricked to log into the affected device through an unencrypted ('http') connection, the user's session may be hijacked.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://jvn.jp/en/jp/JVN34232595/; https://www.asus.com/networking-iot-servers/wifi-routers/asus-wifi-routers/rt-ax3000/helpdesk_bios/?model2Name=RT-AX3000; https://jvn.jp/en/jp/JVN34232595/
CVE: CVE-2023-31196
Published: 2023-06-13
Description: Missing authentication for critical function in Wi-Fi AP UNIT allows a remote unauthenticated attacker to obtain sensitive information of the affected products. Affected products and versions are as follows: AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPUM-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B07 and earlier
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://jvn.jp/en/jp/JVN28412757/; https://www.inaba.co.jp/abaniact/news/Wi-Fi_AP_UNIT%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8B%E8%A4%87%E6%95%B0%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf; https://jvn.jp/en/jp/JVN28412757/
CVE: CVE-2023-31198
Published: 2023-06-13
Description: OS command injection vulnerability exists in Wi-Fi AP UNIT allows. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. Affected products and versions are as follows: AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPUM-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B07 and earlier
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/jp/JVN28412757/; https://www.inaba.co.jp/abaniact/news/Wi-Fi_AP_UNIT%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8B%E8%A4%87%E6%95%B0%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf; https://jvn.jp/en/jp/JVN28412757/
CVE: CVE-2023-32546
Published: 2023-06-13
Description: Code injection vulnerability exists in Chatwork Desktop Application (Mac) 2.6.43 and earlier. If this vulnerability is exploited, a non-administrative user of the Mac where the product is installed may store and obtain audio and image data from the product without the user's consent.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://go.chatwork.com/ja/download/; https://jvn.jp/en/jp/JVN96828492/; https://go.chatwork.com/ja/download/
CVE: CVE-2023-32548
Published: 2023-06-13
Description: OS command injection vulnerability exists in WPS Office version 10.8.0.6186. If a remote attacker who can conduct a man-in-the-middle attack connects the product to a malicious server and sends a specially crafted data, an arbitrary OS command may be executed on the system where the product is installed.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/jp/JVN36060509/; https://support.kingsoft.jp/about/20230605.html; https://jvn.jp/en/jp/JVN36060509/
CVE: CVE-2023-3218
Published: 2023-06-13
Description: Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-366
References: https://github.com/it-novum/openitcockpit/commit/2c2c243964dda97a82eddb3804e39f9665c574bb; https://huntr.dev/bounties/94d50b11-20ca-46e3-9086-dd[PII_REDACTED]; https://github.com/it-novum/openitcockpit/commit/2c2c243964dda97a82eddb3804e39f9665c574bb
CVE: CVE-2023-2807
Published: 2023-06-13
Description: Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects PandoraFMS v771 and prior versions on all platforms.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-3047
Published: 2023-06-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMT Lockcell allows SQL Injection.This issue affects Lockcell: before 15.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fordefence.com/cve-2023-3047-tmt-lockcell-sql-injection/; https://www.usom.gov.tr/bildirim/tr-23-0345; https://fordefence.com/cve-2023-3047-tmt-lockcell-sql-injection/
CVE: CVE-2023-3048
Published: 2023-06-13
Description: Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass.This issue affects Lockcell: before 15.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://fordefence.com/cve-2023-3048-authorization-bypass-through-user-controlled-key-vulnerability-allows-authentication-abuse-authentication-bypass/; https://www.usom.gov.tr/bildirim/tr-23-0345; https://fordefence.com/cve-2023-3048-authorization-bypass-through-user-controlled-key-vulnerability-allows-authentication-abuse-authentication-bypass/
CVE: CVE-2023-3049
Published: 2023-06-13
Description: Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This issue affects Lockcell: before 15.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://fordefence.com/cve-2023-3049-unrestricted-upload-of-file-with-dangerous-type-vulnerability-allows-command-injection/; https://www.usom.gov.tr/bildirim/tr-23-0345; https://fordefence.com/cve-2023-3049-unrestricted-upload-of-file-with-dangerous-type-vulnerability-allows-command-injection/
CVE: CVE-2023-3050
Published: 2023-06-13
Description: Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass.This issue affects Lockcell: before 15.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-784, CWE-565
References: https://fordefence.com/cve-2023-3050-reliance-on-cookies-without-validation-and-integrity-checking-in-a-security-decision-vulnerability-in-tmt-lockcell-allows-privilege-abuse-authentication-bypass/; https://www.usom.gov.tr/bildirim/tr-23-0345; https://fordefence.com/cve-2023-3050-reliance-on-cookies-without-validation-and-integrity-checking-in-a-security-decision-vulnerability-in-tmt-lockcell-allows-privilege-abuse-authentication-bypass/
CVE: CVE-2022-42880
Published: 2023-06-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/auto-upload-images/wordpress-auto-upload-images-plugin-3-3-cross-site-request-forgery-csrf-vulnerability-leading-to-stored-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/auto-upload-images/wordpress-auto-upload-images-plugin-3-3-cross-site-request-forgery-csrf-vulnerability-leading-to-stored-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23831
Published: 2023-06-13
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rating-Widget Rating-Widget: Star Review System plugin <= 3.1.9 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/rating-widget/wordpress-rating-widget-star-review-system-plugin-3-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rating-widget/wordpress-rating-widget-star-review-system-plugin-3-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25964
Published: 2023-06-13
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Noah Hearle, Design Extreme We’re Open! plugin <= 1.46 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/opening-hours/wordpress-we-re-open-plugin-1-46-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/opening-hours/wordpress-we-re-open-plugin-1-46-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26528
Published: 2023-06-13
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in jinit9906 Shipyaari Shipping Management plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/manage-shipyaari-shipping/wordpress-shipyaari-shipping-management-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/manage-shipyaari-shipping/wordpress-shipyaari-shipping-management-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26538
Published: 2023-06-13
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kamyabsoft Chat Bee plugin <= 1.1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/chat-bee/wordpress-chat-bee-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chat-bee/wordpress-chat-bee-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28620
Published: 2023-06-13
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cyberus Labs Cyberus Key plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cyberus-key/wordpress-cyberus-key-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cyberus-key/wordpress-cyberus-key-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33568
Published: 2023-06-13
Description: An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7; https://github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e; https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471
CVE: CVE-2023-35064
Published: 2023-06-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering.This issue affects Satos Mobile: before 20230607.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://https://www.usom.gov.tr/bildirim/tr-23-0346; https://https://www.usom.gov.tr/bildirim/tr-23-0346
CVE: CVE-2023-25978
Published: 2023-06-13
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nate Reist Protected Posts Logout Button plugin <= 1.4.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/protected-posts-logout-button/wordpress-protected-posts-logout-button-plugin-1-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/protected-posts-logout-button/wordpress-protected-posts-logout-button-plugin-1-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27624
Published: 2023-06-13
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcelotorres Redirect After Login plugin <= 0.1.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/redirect-after-login/wordpress-redirect-after-login-plugin-0-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/redirect-after-login/wordpress-redirect-after-login-plugin-0-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33621
Published: 2023-06-13
Description: GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-294
References: http://gl-ar750s-ext.com; http://glinet.com; https://justinapplegate.me/2023/glinet-CVE-2023-33621/
CVE: CVE-2023-33695
Published: 2023-06-13
Description: Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://github.com/dromara/hutool/issues/3103; https://github.com/dromara/hutool/issues/3103
CVE: CVE-2022-31635
Published: 2023-06-13
Description: Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]021-16/hpsbhf03814; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]021-16/hpsbhf03814
CVE: CVE-2022-31636
Published: 2023-06-13
Description: Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]021-16/hpsbhf03814; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]021-16/hpsbhf03814
CVE: CVE-2022-31637
Published: 2023-06-13
Description: Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]021-16/hpsbhf03814; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]021-16/hpsbhf03814
CVE: CVE-2022-31638
Published: 2023-06-13
Description: Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]021-16/hpsbhf03814; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]021-16/hpsbhf03814
CVE: CVE-2022-31639
Published: 2023-06-13
Description: Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]021-16/hpsbhf03814; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]021-16/hpsbhf03814
CVE: CVE-2023-20867
Published: 2023-06-13
Description: A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
CVSS Score: 3.9 (LOW)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2023/10/16/11; http://www.openwall.com/lists/oss-security/2023/10/16/2; https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html
CVE: CVE-2023-27837
Published: 2023-06-13
Description: TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the key parameter in the function sub_ 40A774.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/lzd521/IOT/tree/main/TP-Link%20WPA8630P; https://github.com/lzd521/IOT/tree/main/TP-Link%20WPA8630P
CVE: CVE-2023-28303
Published: 2023-06-13
Description: Windows Snipping Tool Information Disclosure Vulnerability
CVSS Score: 3.3 (LOW)
CWE: CWE-359
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28303; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28303
CVE: CVE-2023-28598
Published: 2023-06-13
Description: Zoom for  Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-74
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-28599
Published: 2023-06-13
Description: Zoom clients prior to 5.13.10 contain an HTML injection vulnerability.  A malicious user could inject HTML into  their display name potentially leading a victim to a malicious website during meeting creation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-74
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-30179
Published: 2023-06-13
Description: CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection; https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14; https://github.com/github/advisory-database/pull/2443#issuecomment[PII_REDACTED]
CVE: CVE-2023-31437
Published: 2023-06-13
Description: An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://github.com/kastel-security/Journald; https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf; https://github.com/systemd/systemd/releases
CVE: CVE-2023-31438
Published: 2023-06-13
Description: An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-354
References: https://github.com/kastel-security/Journald; https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf; https://github.com/systemd/systemd/pull/28886
CVE: CVE-2023-31439
Published: 2023-06-13
Description: An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-354
References: https://github.com/kastel-security/Journald; https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf; https://github.com/systemd/systemd/pull/28885
CVE: CVE-2023-31541
Published: 2023-06-13
Description: A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://redmine.com; http://redmineckeditor.com; https://github.com/DreamD2v/CVE-2023-31541/blob/main/CVE-2023-31541.md
CVE: CVE-2023-33620
Published: 2023-06-13
Description: GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522
References: http://gl-ar750s-ext.com; http://glinet.com; https://justinapplegate.me/2023/glinet-CVE-2023-33620/
CVE: CVE-2023-34247
Published: 2023-06-13
Description: Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the `@keystone-6/auth` package.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/keystonejs/keystone/pull/8626; https://github.com/keystonejs/keystone/security/advisories/GHSA-jqxr-vjvv-899m; https://github.com/keystonejs/keystone/pull/8626
CVE: CVE-2023-34249
Published: 2023-06-13
Description: benjjvi/PyBB is an open source bulletin board. Prior to commit dcaeccd37198ecd3e41ea766d1099354b60d69c2, benjjvi/PyBB is vulnerable to SQL Injection. This vulnerability has been fixed as of commit dcaeccd37198ecd3e41ea766d1099354b60d69c2. As a workaround, a user may be able to update the software manually to avoid this problem by sanitizing user queries to `BulletinDatabaseModule.py`.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/benjjvi/PyBB/commit/dcaeccd37198ecd3e41ea766d1099354b60d69c2; https://github.com/benjjvi/PyBB/security/advisories/GHSA-5qrx-fgxq-95gg; https://github.com/benjjvi/PyBB/commit/dcaeccd37198ecd3e41ea766d1099354b60d69c2
CVE: CVE-2023-1707
Published: 2023-06-13
Description: Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to information disclosure when IPsec is enabled with FutureSmart version 5.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]358-16/hpsbpi03838; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]358-16/hpsbpi03838
CVE: CVE-2023-28600
Published: 2023-06-13
Description: Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability.  A malicious user may be able to delete/replace Zoom Client files potentially causing  a loss of integrity and availability to the Zoom Client.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-378
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/