deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-41032
Published: 2023-09-12
Description: A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.0.253), Parasolid V35.1 (All versions < V35.1.184), Parasolid V36.0 (All versions < V36.0.142), Simcenter Femap V2301 (All versions < V2301.0003), Simcenter Femap V2306 (All versions < V2306.0001). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21263)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-190839.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-887122.pdf; https://www.bentley.com/advisories/be-2023-0004/
CVE: CVE-2023-41033
Published: 2023-09-12
Description: A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.260), Parasolid V35.1 (All versions < V35.1.246), Parasolid V36.0 (All versions < V36.0.156), Simcenter Femap V2301 (All versions < V2301.0003), Simcenter Femap V2306 (All versions < V2306.0001). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21266)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-190839.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-887122.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-190839.pdf
CVE: CVE-2023-41846
Published: 2023-09-12
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application is vulnerable to memory corruption while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://cert-portal.siemens.com/productcert/pdf/ssa-764801.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-764801.pdf
CVE: CVE-2023-4759
Published: 2023-09-12
Description: Arbitrary File Overwrite in Eclipse JGit <= 6.6.0

In Eclipse JGit, all versions <= 6.6.0[PII_REDACTED]15-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.

This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.

The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.

Setting git configuration option core.symlinks = false before checking out avoids the problem.

The issue was fixed in Eclipse JGit version 6.6.[PII_REDACTED]50-r and 6.7.0[PII_REDACTED]40-r, available via  Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and  repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from  5.13.3[PII_REDACTED]12-r.


The JGit maintainers would like to thank RyotaK for finding and reporting this issue.




CVSS Score: 8.8 (HIGH)
CWE: CWE-59, CWE-178, CWE-59, CWE-178
References: https://git.eclipse.org/c/jgit/jgit.git/commit/?id=9072103f3b3cf64dd12ad2949836ab98f62dabf1; https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/11; https://projects.eclipse.org/projects/technology.jgit/releases/6.6.1
CVE: CVE-2023-27169
Published: 2023-09-12
Description: Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and predictable symmetric encryption keys for license generation and validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://balwurk.com; https://balwurk.com/cve-use-of-hard-coded-cryptographic-key/; https://writeback4t.com
CVE: CVE-2023-39637
Published: 2023-09-12
Description: D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://d-link.com; http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-816; https://github.com/mmmmmx1/dlink/blob/main/DIR-816/readme.md
CVE: CVE-2023-40611
Published: 2023-09-12
Description: Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: http://www.openwall.com/lists/oss-security/2023/11/12/1; https://github.com/apache/airflow/pull/33413; https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0
CVE: CVE-2023-40712
Published: 2023-09-12
Description: Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI.

Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/apache/airflow/pull/33512; https://github.com/apache/airflow/pull/33516; https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts
CVE: CVE-2023-41013
Published: 2023-09-12
Description: Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://icewrap.com; https://medium.com/%40katikitala.sushmitha078/cve-2023-41013-789841dcad91; http://icewrap.com
CVE: CVE-2023-39150
Published: 2023-09-12
Description: ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/dgl/081cf503dc635df39d844e058a6d4c88; https://github.com/Maximus5/ConEmu/commit/60683a186628ffaa7689fcb64b3c38ced69287c1; https://gist.github.com/dgl/081cf503dc635df39d844e058a6d4c88
CVE: CVE-2023-2071
Published: 2023-09-12
Description: 
Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets.  The device has the functionality, through a CIP class, to execute exported functions from libraries.  There is a routine that restricts it to execute specific functions from two dynamic link library files.  By using a CIP class, an attacker can upload a self-made library to the device which allows the attacker to bypass the security check and execute any code written in the function.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-434
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140724; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140724
CVE: CVE-2023-40834
Published: 2023-09-12
Description: OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the password parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://packetstormsecurity.com/files/174525/OpenCart-CMS-4.0.2.2-Brute-Force.html; https://www.opencart.com/; https://packetstormsecurity.com/files/174525/OpenCart-CMS-4.0.2.2-Brute-Force.html
CVE: CVE-2023-40218
Published: 2023-09-12
Description: An issue was discovered in the NPU kernel driver in Samsung Exynos Mobile Processor 9820, 980, 2100, 2200, 1280, and 1380. An integer overflow can bypass detection of error cases via a crafted application.
CVSS Score: 2.0 (LOW)
CWE: CWE-190
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-40784
Published: 2023-09-12
Description: DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.cnblogs.com/SFYHAC/articles/17619123.html; https://vulmon.com/vulnerabilitydetails?qid=CVE-2023-40784; https://www.cnblogs.com/SFYHAC/articles/17619123.html
CVE: CVE-2023-4863
Published: 2023-09-12
Description: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.openwall.com/lists/oss-security/2023/09/21/4; http://www.openwall.com/lists/oss-security/2023/09/22/1; http://www.openwall.com/lists/oss-security/2023/09/22/3
CVE: CVE-2023-4913
Published: 2023-09-12
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository cecilapp/cecil prior to 7.47.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cecilapp/cecil/commit/00dc79f10ce723034b7140d79f4ac731d1d902eb; https://huntr.dev/bounties/d2a9ec4d-1b4b-470b-87da-ec069f5925ae; https://github.com/cecilapp/cecil/commit/00dc79f10ce723034b7140d79f4ac731d1d902eb
CVE: CVE-2023-4914
Published: 2023-09-12
Description: Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://github.com/cecilapp/cecil/commit/00dc79f10ce723034b7140d79f4ac731d1d902eb; https://huntr.dev/bounties/cdd995b2-c983-428b-a73a-827b61b7c06b; https://github.com/cecilapp/cecil/commit/00dc79f10ce723034b7140d79f4ac731d1d902eb
CVE: CVE-2023-0119
Published: 2023-09-12
Description: A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://access.redhat.com/errata/RHSA-2023:3387; https://access.redhat.com/errata/RHSA-2023:6818; https://access.redhat.com/security/cve/CVE-2023-0119
CVE: CVE-2023-34469
Published: 2023-09-12
Description: 
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. A successful exploit of this vulnerability may lead to a loss of confidentiality. 
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023007.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023007.pdf
CVE: CVE-2023-34470
Published: 2023-09-12
Description: 
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023007.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023007.pdf
CVE: CVE-2023-29332
Published: 2023-09-12
Description: Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-330, CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29332; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29332
CVE: CVE-2023-29463
Published: 2023-09-12
Description: 
The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user could potentially retrieve other application users’ session data and or log users out of their session.


CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140590; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140590
CVE: CVE-2023-33136
Published: 2023-09-12
Description: Azure DevOps Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33136; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33136
CVE: CVE-2023-35355
Published: 2023-09-12
Description: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35355; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35355
CVE: CVE-2023-36736
Published: 2023-09-12
Description: Microsoft Identity Linux Broker Remote Code Execution Vulnerability
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36736; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36736
CVE: CVE-2023-36739
Published: 2023-09-12
Description: 3D Viewer Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36739; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36739
CVE: CVE-2023-36740
Published: 2023-09-12
Description: 3D Viewer Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36740; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36740
CVE: CVE-2023-36742
Published: 2023-09-12
Description: Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36742; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36742
CVE: CVE-2023-36744
Published: 2023-09-12
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36744; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36744
CVE: CVE-2023-36745
Published: 2023-09-12
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36745; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36745
CVE: CVE-2023-36756
Published: 2023-09-12
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36756; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36756
CVE: CVE-2023-36757
Published: 2023-09-12
Description: Microsoft Exchange Server Spoofing Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36757; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36757
CVE: CVE-2023-36758
Published: 2023-09-12
Description: Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36758; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36758
CVE: CVE-2023-36759
Published: 2023-09-12
Description: Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36759; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36759
CVE: CVE-2023-36760
Published: 2023-09-12
Description: 3D Viewer Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36760; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36760
CVE: CVE-2023-36761
Published: 2023-09-12
Description: Microsoft Word Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36761; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36761; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36761
CVE: CVE-2023-36762
Published: 2023-09-12
Description: Microsoft Word Remote Code Execution Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36762; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36762
CVE: CVE-2023-36763
Published: 2023-09-12
Description: Microsoft Outlook Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36763; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36763
CVE: CVE-2023-36764
Published: 2023-09-12
Description: Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36764; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36764
CVE: CVE-2023-36765
Published: 2023-09-12
Description: Microsoft Office Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36765; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36765
CVE: CVE-2023-36766
Published: 2023-09-12
Description: Microsoft Excel Information Disclosure Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36766; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36766
CVE: CVE-2023-36767
Published: 2023-09-12
Description: Microsoft Office Security Feature Bypass Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36767; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36767
CVE: CVE-2023-36770
Published: 2023-09-12
Description: 3D Builder Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36770; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36770
CVE: CVE-2023-36771
Published: 2023-09-12
Description: 3D Builder Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36771; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36771
CVE: CVE-2023-36772
Published: 2023-09-12
Description: 3D Builder Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36772; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36772
CVE: CVE-2023-36773
Published: 2023-09-12
Description: 3D Builder Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36773; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36773
CVE: CVE-2023-36777
Published: 2023-09-12
Description: Microsoft Exchange Server Information Disclosure Vulnerability
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36777; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36777
CVE: CVE-2023-36788
Published: 2023-09-12
Description: .NET Framework Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36788; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36788
CVE: CVE-2023-36792
Published: 2023-09-12
Description: Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36792; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36792
CVE: CVE-2023-36793
Published: 2023-09-12
Description: Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36793; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36793
CVE: CVE-2023-36794
Published: 2023-09-12
Description: Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36794; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36794
CVE: CVE-2023-36796
Published: 2023-09-12
Description: Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36796; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36796
CVE: CVE-2023-36799
Published: 2023-09-12
Description: .NET Core and Visual Studio Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799
CVE: CVE-2023-36800
Published: 2023-09-12
Description: Dynamics Finance and Operations Cross-site Scripting Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36800; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36800
CVE: CVE-2023-36801
Published: 2023-09-12
Description: DHCP Server Service Information Disclosure Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36801; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36801
CVE: CVE-2023-36802
Published: 2023-09-12
Description: Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36802
CVE: CVE-2023-36803
Published: 2023-09-12
Description: Windows Kernel Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36803; http://packetstormsecurity.com/files/175109/Microsoft-Windows-Kernel-Out-Of-Bounds-Reads-Memory-Disclosure.html; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36803
CVE: CVE-2023-36804
Published: 2023-09-12
Description: Windows GDI Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36804; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36804