deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49706
Published: 2023-12-19
Description: Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges, thereby allowing them to act as and with the permissions of another user. Attackers must generate repeated API requests to trigger a race condition with concurrent user activity in the self-service portal.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: https://linotp.org/CVE-2023-49706.txt; https://linotp.org/security-update-linotp3-selfservice.html; https://www.linotp.org/news.html
CVE: CVE-2023-34027
Published: 2023-12-19
Description: Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0.
CVSS Score: 8.3 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/recently-viewed-products/wordpress-recently-viewed-products-plugin-1-0-0-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/recently-viewed-products/wordpress-recently-viewed-products-plugin-1-0-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-34382
Published: 2023-12-19
Description: Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/dokan-lite/wordpress-dokan-plugin-3-7-19-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dokan-lite/wordpress-dokan-plugin-3-7-19-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-38478
Published: 2023-12-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and QuickBooks.This issue affects Integration for WooCommerce and QuickBooks: from n/a through 1.2.3.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/wp-woocommerce-quickbooks/wordpress-integration-for-woocommerce-and-quickbooks-plugin-1-2-3-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-woocommerce-quickbooks/wordpress-integration-for-woocommerce-and-quickbooks-plugin-1-2-3-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-38481
Published: 2023-12-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This issue affects Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin: from n/a before 1.3.7.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://patchstack.com/database/vulnerability/woo-zoho/wordpress-integration-for-woocommerce-and-zoho-crm-plugin-1-3-7-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-zoho/wordpress-integration-for-woocommerce-and-zoho-crm-plugin-1-3-7-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-40602
Published: 2023-12-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 1.5.49.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-for-woocommerce-plugin-1-5-49-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-for-woocommerce-plugin-1-5-49-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-41648
Published: 2023-12-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Swapnil V. Patil Login and Logout Redirect.This issue affects Login and Logout Redirect: from n/a through 2.0.3.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/login-and-logout-redirect/wordpress-login-and-logout-redirect-plugin-2-0-2-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/login-and-logout-redirect/wordpress-login-and-logout-redirect-plugin-2-0-2-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-43826
Published: 2023-12-19
Description: Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.

Users are recommended to upgrade to version 1.5.4, which fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2023/12/19/4; https://lists.apache.org/thread/23gzwftpfgtq97tj6ttmbclry53kmwv6; http://www.openwall.com/lists/oss-security/2023/12/19/4
CVE: CVE-2023-45105
Published: 2023-12-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin.This issue affects affiliate-toolkit – WordPress Affiliate Plugin: from n/a through 3.3.9.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/affiliate-toolkit-starter/wordpress-affiliate-toolkit-wordpress-affiliate-plugin-plugin-3-3-9-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/affiliate-toolkit-starter/wordpress-affiliate-toolkit-wordpress-affiliate-plugin-plugin-3-3-9-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-35883
Published: 2023-12-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/core-web-vitals-pagespeed-booster/wordpress-core-web-vitals-pagespeed-booster-plugin-1-0-12-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/core-web-vitals-pagespeed-booster/wordpress-core-web-vitals-pagespeed-booster-plugin-1-0-12-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-37982
Published: 2023-12-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://patchstack.com/database/vulnerability/cf7-salesforce/wordpress-integration-for-contact-form-7-and-salesforce-plugin-1-3-3-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cf7-salesforce/wordpress-integration-for-contact-form-7-and-salesforce-plugin-1-3-3-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-48327
Published: 2023-12-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Vendors WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors.This issue affects WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors: from n/a through 2.4.7.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/wc-vendors/wordpress-wc-vendors-marketplace-plugin-2-4-7-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc-vendors/wordpress-wc-vendors-marketplace-plugin-2-4-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-48738
Published: 2023-12-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Porto Theme Porto Theme - Functionality.This issue affects Porto Theme - Functionality: from n/a before 2.12.1.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/porto-functionality/wordpress-porto-theme-functionality-plugin-2-11-1-unauthenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/porto-functionality/wordpress-porto-theme-functionality-plugin-2-11-1-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-48741
Published: 2023-12-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud AI ChatBot.This issue affects AI ChatBot: from n/a through 4.7.8.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/chatbot/wordpress-ai-chatbot-plugin-4-7-8-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chatbot/wordpress-ai-chatbot-plugin-4-7-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-48764
Published: 2023-12-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection WordPress Brute Force Protection – Stop Brute Force Attacks.This issue affects WordPress Brute Force Protection – Stop Brute Force Attacks: from n/a through 2.2.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/guardgiant/wordpress-wordpress-brute-force-protection-stop-brute-force-attacks-plugin-2-2-5-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/guardgiant/wordpress-wordpress-brute-force-protection-stop-brute-force-attacks-plugin-2-2-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-49750
Published: 2023-12-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoonthemes Couponis - Affiliate & Submitting Coupons WordPress Theme.This issue affects Couponis - Affiliate & Submitting Coupons WordPress Theme: from n/a before 2.2.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/couponis/wordpress-couponis-affiliate-submitting-coupons-wordpress-theme-theme-3-1-7-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/couponis/wordpress-couponis-affiliate-submitting-coupons-wordpress-theme-theme-3-1-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-49764
Published: 2023-12-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Younes JFR. Advanced Database Cleaner.This issue affects Advanced Database Cleaner: from n/a through 3.1.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/advanced-database-cleaner/wordpress-advanced-database-cleaner-plugin-3-1-2-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-database-cleaner/wordpress-advanced-database-cleaner-plugin-3-1-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-49812
Published: 2023-12-19
Description: Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2023-50466
Published: 2023-12-19
Description: An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or access sensitive information via injecting a crafted payload into the HMI Name parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://literate-bakery-10b.notion.site/Weintek-EasyWeb-cMT-Reports-3fc0b10798b54f51a61d719395c408da?pvs=4; https://literate-bakery-10b.notion.site/Weintek-EasyWeb-cMT-Reports-3fc0b10798b54f51a61d719395c408da?pvs=4
CVE: CVE-2022-43450
Published: 2023-12-19
Description: Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/stream/wordpress-stream-plugin-3-9-2-auth-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stream/wordpress-stream-plugin-3-9-2-auth-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2023-38126
Published: 2023-12-19
Description: Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability.

The specific flaw exists within the processing of backup zip files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this to execute code in the context of root. Was ZDI-CAN-20543.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1058/; https://www.zerodayinitiative.com/advisories/ZDI-23-1058/
CVE: CVE-2023-42940
Published: 2023-12-19
Description: A session rendering issue was addressed with improved session tracking. This issue is fixed in macOS Sonoma 14.2.1. A user who shares their screen may unintentionally share the incorrect content.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2023/Dec/20; https://support.apple.com/en-us/HT214048; http://seclists.org/fulldisclosure/2023/Dec/20
CVE: CVE-2023-46624
Published: 2023-12-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Parcel Pro.This issue affects Parcel Pro: from n/a through 1.6.11.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/woo-parcel-pro/wordpress-parcel-pro-plugin-1-6-3-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-parcel-pro/wordpress-parcel-pro-plugin-1-6-3-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-47146
Published: 2023-12-19
Description: IBM Qradar SIEM 7.5 could allow a privileged user to obtain sensitive domain information due to data being misidentified.  IBM X-Force ID:  270372.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270372; https://https://www.ibm.com/support/pages/node/7099297; https://exchange.xforce.ibmcloud.com/vulnerabilities/270372
CVE: CVE-2023-47267
Published: 2023-12-19
Description: An issue discovered in TheGreenBow Windows Enterprise Certified VPN Client 6.52, Windows Standard VPN Client 6.87, and Windows Enterprise VPN Client 6.87 allows attackers to gain escalated privileges via crafted changes to memory mapped file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://www.thegreenbow.com/en/support/security-alerts/#deeplink-16093; https://www.thegreenbow.com/en/support/security-alerts/#deeplink-16093
CVE: CVE-2023-49004
Published: 2023-12-19
Description: An issue in D-Link DIR-850L v.B1_FW223WWb01 allows a remote attacker to execute arbitrary code via a crafted script to the en parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/ef4tless/vuln/blob/master/iot/DIR-850L/bug1.md; https://github.com/ef4tless/vuln/blob/master/iot/DIR-850L/bug1.md
CVE: CVE-2023-49164
Published: 2023-12-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/ocean-extra/wordpress-ocean-extra-plugin-2-2-2-csrf-leading-to-arbitrary-plugin-activation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ocean-extra/wordpress-ocean-extra-plugin-2-2-2-csrf-leading-to-arbitrary-plugin-activation-vulnerability?_s_id=cve
CVE: CVE-2023-50835
Published: 2023-12-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Praveen Goswami Advanced Category Template.This issue affects Advanced Category Template: from n/a through 0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/advanced-category-template/wordpress-advanced-category-template-plugin-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-category-template/wordpress-advanced-category-template-plugin-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45172
Published: 2023-12-19
Description: IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX windows to cause a denial of service.  IBM X-Force ID:  267970.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267970; https://www.ibm.com/support/pages/node/7099314; https://exchange.xforce.ibmcloud.com/vulnerabilities/267970
CVE: CVE-2023-49147
Published: 2023-12-19
Description: An issue was discovered in PDF24 Creator 11.14.0. The configuration of the msi installer file was found to produce a visible cmd.exe window when using the repair function of msiexec.exe. This allows an unprivileged local attacker to use a chain of actions (e.g., an oplock on faxPrnInst.log) to open a SYSTEM cmd.exe.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/176206/PDF24-Creator-11.15.1-Local-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2023/Dec/18; https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-pdf24-creator-geek-software-gmbh/
CVE: CVE-2023-6928
Published: 2023-12-19
Description: 
EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.





CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05
CVE: CVE-2023-6929
Published: 2023-12-19
Description: 




EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorization, access the hidden resources on the system, and execute privileged functionalities.








CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05
CVE: CVE-2023-6930
Published: 2023-12-19
Description: 








EuroTel ETL3100 versions v01c01 and v01x37 suffer from an unauthenticated configuration and log download vulnerability. This enables the attacker to disclose sensitive information and assist in authentication bypass, privilege escalation, and full system access.











CVSS Score: 9.4 (CRITICAL)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05
CVE: CVE-2023-42012
Published: 2023-12-20
Description: An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts.  IBM X-Force ID:  265509.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265509; https://www.ibm.com/support/pages/node/7096548; https://exchange.xforce.ibmcloud.com/vulnerabilities/265509
CVE: CVE-2023-42013
Published: 2023-12-20
Description: IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  265510.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265510; https://www.ibm.com/support/pages/node/7096547; https://exchange.xforce.ibmcloud.com/vulnerabilities/265510
CVE: CVE-2023-45887
Published: 2023-12-20
Description: DS Wireless Communication (DWC) with DWC_VERSION_3 and DWC_VERSION_11 allows remote attackers to execute arbitrary code on a game-playing client's machine via a modified GPCM message.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/177135/DS-Wireless-Communication-Code-Execution.html; https://github.com/MikeIsAStar/DS-Wireless-Communication-Remote-Code-Execution; https://pastebin.com/ukRzztv0
CVE: CVE-2023-47161
Published: 2023-12-20
Description: IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion.  IBM X-Force ID:  270799.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270799; https://www.ibm.com/support/pages/node/7096552; https://exchange.xforce.ibmcloud.com/vulnerabilities/270799
CVE: CVE-2023-50703
Published: 2023-12-20
Description: 
An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized access to the application.





CVSS Score: 6.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03
CVE: CVE-2023-50704
Published: 2023-12-20
Description: 




An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate phishing attacks against application users.








CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03
CVE: CVE-2023-50705
Published: 2023-12-20
Description: 








An attacker could create malicious requests to obtain sensitive information about the web server.







CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03
CVE: CVE-2023-50706
Published: 2023-12-20
Description: 












A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or valid session tokens.




CVSS Score: 4.1 (MEDIUM)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03
CVE: CVE-2023-50707
Published: 2023-12-20
Description: 
Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device.





CVSS Score: 9.6 (CRITICAL)
CWE: CWE-400, CWE-400
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-02
CVE: CVE-2023-6689
Published: 2023-12-20
Description: 




A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative account, a CSRF attack could compromise the entire web application.




CVSS Score: 8.2 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-02