deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-31851
Published: 2023-07-17
Description: Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/CalfCrusher/CVE-2023-31851; https://www.cudy.com; https://github.com/CalfCrusher/CVE-2023-31851
CVE: CVE-2023-31853
Published: 2023-07-17
Description: Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/CalfCrusher/CVE-2023-31853; https://www.cudy.com; https://github.com/CalfCrusher/CVE-2023-31853
CVE: CVE-2023-34005
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Front End Users plugin <= 3.2.24 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/front-end-only-users/wordpress-front-end-users-plugin-3-2-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/front-end-only-users/wordpress-front-end-users-plugin-3-2-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-36511
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <= 1.6.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-order-barcodes/wordpress-woocommerce-order-barcodes-plugin-1-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-order-barcodes/wordpress-woocommerce-order-barcodes-plugin-1-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-36513
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/automatewoo/wordpress-automatewoo-plugin-5-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/automatewoo/wordpress-automatewoo-plugin-5-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-36514
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-37968
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Faboba Falang multilanguage for WordPress plugin <= 1.3.39 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/falang/wordpress-falang-multilanguage-plugin-1-3-39-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/falang/wordpress-falang-multilanguage-plugin-1-3-39-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-36424
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Nikola Loncar Easy Appointments plugin <= 3.11.9 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/easy-appointments/wordpress-easy-appointments-plugin-3-11-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-appointments/wordpress-easy-appointments-plugin-3-11-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-38062
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Theme plugin <= 1.0.9 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/download-theme/wordpress-download-theme-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/download-theme/wordpress-download-theme-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-35818
Published: 2023-07-17
Description: An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit another behavior in the chip to gain unauthorized access to the ROM download mode. Access to ROM download mode may be further exploited to read the encrypted flash content in cleartext format or execute stub code.
CVSS Score: 6.8 (MEDIUM)
References: https://espressif.com; https://www.espressif.com/sites/default/files/advisory_downloads/AR2023-005%20Security%20Advisory%20Concerning%20Bypassing%20Secure%20Boot%20and%20Flash%20Encryption%20Using%20EMFI%20EN.pdf; https://espressif.com
CVE: CVE-2023-36656
Published: 2023-07-17
Description: Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via the KeyValuesTable component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/jaegertracing/jaeger-ui/pull/1498; https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r; https://github.com/mafintosh/json-markup/pull/15
CVE: CVE-2023-37974
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Justin Klein WP Social AutoConnect plugin <= 4.6.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-fb-autoconnect/wordpress-wp-social-autoconnect-plugin-4-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-fb-autoconnect/wordpress-wp-social-autoconnect-plugin-4-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-37985
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in FiveStarPlugins Restaurant Menu and Food Ordering plugin <= 2.4.6 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/food-and-drink-menu/wordpress-restaurant-menu-and-food-ordering-by-five-star-plugins-plugin-2-4-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/food-and-drink-menu/wordpress-restaurant-menu-and-food-ordering-by-five-star-plugins-plugin-2-4-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-3577
Published: 2023-07-17
Description: Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF.


CVSS Score: 3.5 (LOW)
CWE: CWE-918, CWE-918
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3581
Published: 2023-07-17
Description: Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3582
Published: 2023-07-17
Description: Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to, 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3584
Published: 2023-07-17
Description: Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme.


CVSS Score: 3.1 (LOW)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3585
Published: 2023-07-17
Description: Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3586
Published: 2023-07-17
Description: Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.


CVSS Score: 4.2 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3587
Published: 2023-07-17
Description: Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions.


CVSS Score: 2.7 (LOW)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3590
Published: 2023-07-17
Description: Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.


CVSS Score: 3.1 (LOW)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3591
Published: 2023-07-17
Description: Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.


CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3593
Published: 2023-07-17
Description: Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3613
Published: 2023-07-17
Description: Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default. 


CVSS Score: 3.5 (LOW)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3614
Published: 2023-07-17
Description: Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsive for an extended period of time by linking to specially crafted image file.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-3615
Published: 2023-07-17
Description: Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection.


CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2021-37386
Published: 2023-07-17
Description: Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injection vulnerability via the serial number update function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://cwe.mitre.org/data/definitions/79.html; https://gist.githubusercontent.com/LuigiPolidorio/ec78daac7c3d97966f2e3703ca5d1685/raw/d64a487407d6f9685d[PII_REDACTED]a6c84c6fa621/reference.txt; https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection
CVE: CVE-2023-28767
Published: 2023-07-17
Description: The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36,  USG FLEX 50(W) series firmware versions 5.10 through 5.36, 

USG20(W)-VPN series firmware versions 5.10 through 5.36, and VPN series firmware versions 5.00 through 5.36. An unauthenticated, LAN-based attacker could leverage the vulnerability to inject some operating system (OS) commands into the device configuration data on an affected device when the cloud management mode is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
CVE: CVE-2023-34669
Published: 2023-07-17
Description: TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://w3b5h3ll.notion.site/w3b5h3ll/TOTOLINK-CP300-c96d775881f0476b9ef465dba9c6d9b8; https://w3b5h3ll.notion.site/w3b5h3ll/TOTOLINK-CP300-c96d775881f0476b9ef465dba9c6d9b8
CVE: CVE-2023-37475
Published: 2023-07-17
Description: Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of memory` which is unrecoverable and can cause denial of service of the consumer of avro. The root cause of the issue is that avro uses part of the input to `Unmarshal()` to determine the size when creating a new slice and hence an attacker may consume arbitrary amounts of memory which in turn may cause the application to crash. This issue has been addressed in commit `b4a402f4` which has been included in release version `2.13.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/hamba/avro/commit/b4a402f41cf44b6094b[PII_REDACTED]ba9bb1eb290; https://github.com/hamba/avro/security/advisories/GHSA-9x44-9pgq-cf45; https://github.com/hamba/avro/commit/b4a402f41cf44b6094b[PII_REDACTED]ba9bb1eb290
CVE: CVE-2023-33011
Published: 2023-07-17
Description: A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-134, CWE-134
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
CVE: CVE-2023-33012
Published: 2023-07-17
Description: A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
CVE: CVE-2023-34138
Published: 2023-07-17
Description: A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.60 through 5.36 Patch 2, and VPN series firmware versions 4.60 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the list of trusted RADIUS clients in advance.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
CVE: CVE-2023-34139
Published: 2023-07-17
Description: A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
CVE: CVE-2023-34140
Published: 2023-07-17
Description: A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 4.16 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.16 through 5.36 Patch 2, VPN series firmware versions 4.30 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to cause denial of service (DoS) conditions by sending a crafted request to the CAPWAP daemon.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
CVE: CVE-2023-34141
Published: 2023-07-17
Description: A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
CVE: CVE-2022-30858
Published: 2023-07-17
Description: An issue was discovered in ngiflib 0.4. There is SEGV in SDL_LoadAnimatedGif when use SDLaffgif. poc : ./SDLaffgif CA_file2_0
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/Marsman1996/pocs/blob/master/ngiflib/CVE-2022-30858/README.md; https://github.com/miniupnp/ngiflib/issues/22; https://github.com/Marsman1996/pocs/blob/master/ngiflib/CVE-2022-30858/README.md
CVE: CVE-2023-37791
Published: 2023-07-17
Description: D-Link DIR-619L v2.04(TW) was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/naihsin/IoT/tree/main/D-Link/DIR-619L/overflow; https://www.dlink.com/en/security-bulletin/; https://github.com/naihsin/IoT/tree/main/D-Link/DIR-619L/overflow
CVE: CVE-2023-28864
Published: 2023-07-17
Description: Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. (The data typically includes credentials for additional systems.) The attacker must wait for an admin to run the "chef-server-ctl reconfigure" command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922
References: https://blog.mondoo.com/chef-infra-server-cve-2023-28864-impact-and-remediation; https://docs.chef.io/release_notes_server/; https://github.com/chef/chef-server/blob/8a2dc[PII_REDACTED]7f7c7728633a03dcee812e56a/omnibus/files/server-ctl-cookbooks/infra-server/recipes/oc_bifrost.rb#L42
CVE: CVE-2023-37461
Published: 2023-07-17
Description: Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause metersphere to attempt to overwrite an existing file in the defined location or to create a new file. Attackers would be limited to overwriting files that the metersphere process has access to. This issue has been addressed in version 2.10.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-22
References: https://github.com/metersphere/metersphere/security/advisories/GHSA-xfr9-jgfp-fx3v; https://github.com/metersphere/metersphere/security/advisories/GHSA-xfr9-jgfp-fx3v
CVE: CVE-2023-37769
Published: 2023-07-17
Description: stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://gitlab.freedesktop.org/pixman/pixman/-/issues/76; https://gitlab.freedesktop.org/pixman/pixman/-/issues/76
CVE: CVE-2023-37770
Published: 2023-07-17
Description: faust commit ee39a19 was discovered to contain a stack overflow via the component boxppShared::print() at /boxes/ppbox.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/grame-cncm/faust/issues/922; https://github.com/grame-cncm/faust/issues/922
CVE: CVE-2023-37781
Published: 2023-07-17
Description: An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/emqx/emqx/issues/10419; https://github.com/emqx/emqx/issues/10419