deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-44193
Published: 2023-10-13
Description: 
An Improper Release of Memory Before Removing Last Reference vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a local, low privileged attacker to cause an FPC crash, leading to Denial of Service (DoS).

On all Junos MX Series with MPC1 - MPC9, LC480, LC2101, MX10003, and MX80, when Connectivity-Fault-Management (CFM) is enabled in a VPLS scenario, and a specific LDP related command is run, an FPC will crash and reboot. Continued execution of this specific LDP command can lead to sustained Denial of Service condition.

This issue affects:

Juniper Networks Junos OS on MX Series:



  *  All versions prior to 20.4R3-S7;
  *  21.1 versions prior to 21.1R3-S5;
  *  21.2 versions prior to 21.2R3-S4;
  *  21.3 versions prior to 21.3R3-S4;
  *  21.4 versions prior to 21.4R3-S3;
  *  22.1 versions prior to 22.1R3-S1;
  *  22.2 versions prior to 22.2R2-S1, 22.2R3;
  *  22.3 versions prior to 22.3R1-S2, 22.3R2.







CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://supportportal.juniper.net/JSA73157; https://supportportal.juniper.net/JSA73157
CVE: CVE-2023-44194
Published: 2023-10-13
Description: 
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a backdoor with root privileges. The issue is caused by improper directory permissions on a certain system directory, allowing an attacker with access to this directory to create a backdoor with root privileges.

This issue affects Juniper Networks Junos OS:



  *  All versions prior to 20.4R3-S5;
  *  21.1 versions prior to 21.1R3-S4;
  *  21.2 versions prior to 21.2R3-S4;
  *  21.3 versions prior to 21.3R3-S3;
  *  21.4 versions prior to 21.4R3-S1.







CVSS Score: 8.4 (HIGH)
CWE: CWE-276, CWE-276
References: https://supportportal.juniper.net/JSA73158; https://supportportal.juniper.net/JSA73158
CVE: CVE-2023-44195
Published: 2023-10-13
Description: 
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the NetworkStack agent daemon (nsagentd) of Juniper Networks Junos OS Evolved allows an unauthenticated network based attacker to cause limited impact to the availability of the system.

If specific packets reach the Routing-Engine (RE) these will be processed normally even if firewall filters are in place which should have prevented this. This can lead to a limited, increased consumption of resources resulting in a Denial-of-Service (DoS), and unauthorized access.

CVE-2023-44196 is a prerequisite for this issue.

This issue affects Juniper Networks Junos OS Evolved:



  *  21.3-EVO versions prior to 21.3R3-S5-EVO;
  *  21.4-EVO versions prior to 21.4R3-S4-EVO;
  *  22.1-EVO version 22.1R1-EVO and later;
  *  22.2-EVO version 22.2R1-EVO and later;
  *  22.3-EVO versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
  *  22.4-EVO versions prior to 22.4R3-EVO.




This issue doesn't not affected Junos OS Evolved versions prior to 21.3R1-EVO.




CVSS Score: 5.4 (MEDIUM)
CWE: CWE-923
References: https://supportportal.juniper.net/JSA73160; https://supportportal.juniper.net/JSA73160
CVE: CVE-2023-44196
Published: 2023-10-13
Description: 
An Improper Check for Unusual or Exceptional Conditions in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS Evolved on PTX10003 Series allows an unauthenticated adjacent attacker to cause an impact to the integrity of the system.

When specific transit MPLS packets are received by the PFE, these packets are internally forwarded to the RE. This issue is a prerequisite for CVE-2023-44195.

This issue affects Juniper Networks Junos OS Evolved:



  *  All versions prior to 20.4R3-S8-EVO;
  *  21.1-EVO version 21.1R1-EVO and later;
  *  21.2-EVO versions prior to 21.2R3-S6-EVO;
  *  21.3-EVO version 21.3R1-EVO and later;
  *  21.4-EVO versions prior to 21.4R3-S3-EVO;
  *  22.1-EVO versions prior to 22.1R3-S4-EVO;
  *  22.2-EVO versions prior to 22.2R3-S3-EVO;
  *  22.3-EVO versions prior to 22.3R2-S2-EVO, 22.3R3-EVO;
  *  22.4-EVO versions prior to 22.4R2-EVO.







CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://supportportal.juniper.net/JSA73162; https://supportportal.juniper.net/JSA73162
CVE: CVE-2023-44197
Published: 2023-10-13
Description: 
An Out-of-Bounds Write vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

On all Junos OS and Junos OS Evolved devices an rpd crash and restart can occur while processing BGP route updates received over an established BGP session. This specific issue is observed for BGP routes learned via a peer which is configured with a BGP import policy that has hundreds of terms matching IPv4 and/or IPv6 prefixes.

This issue affects Juniper Networks Junos OS:



  *  All versions prior to 20.4R3-S8;
  *  21.1 version 21.1R1 and later versions;
  *  21.2 versions prior to 21.2R3-S2;
  *  21.3 versions prior to 21.3R3-S5;
  *  21.4 versions prior to 21.4R2-S1, 21.4R3-S5.




This issue affects Juniper Networks Junos OS Evolved:



  *  All versions prior to 20.4R3-S8-EVO;
  *  21.1-EVO version 21.1R1-EVO and later versions;
  *  21.2-EVO versions prior to 21.2R3-S2-EVO;
  *  21.3-EVO version 21.3R1-EVO and later versions;
  *  21.4-EVO versions prior to 21.4R2-S1-EVO, 21.4R3-S5-EVO.







CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://supportportal.juniper.net/JSA73163; https://supportportal.juniper.net/JSA73163
CVE: CVE-2023-44198
Published: 2023-10-13
Description: 
An Improper Check for Unusual or Exceptional Conditions vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated network-based attacker to cause an integrity impact in connected networks.

If the SIP ALG is configured and a device receives a specifically malformed SIP packet, the device prevents this packet from being forwarded, but any subsequently received retransmissions of the same packet are forwarded as if they were valid.

This issue affects Juniper Networks Junos OS on SRX Series and MX Series:



  *  20.4 versions prior to 20.4R3-S5;
  *  21.1 versions prior to 21.1R3-S4;
  *  21.2 versions prior to 21.2R3-S4;
  *  21.3 versions prior to 21.3R3-S3;
  *  21.4 versions prior to 21.4R3-S2;
  *  22.1 versions prior to 22.1R2-S2, 22.1R3;
  *  22.2 versions prior to 22.2R2-S1, 22.2R3;
  *  22.3 versions prior to 22.3R1-S2, 22.3R2.




This issue doesn't not affected releases prior to 20.4R1.




CVSS Score: 5.8 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://supportportal.juniper.net/JSA73164; https://supportportal.juniper.net/JSA73164
CVE: CVE-2023-44199
Published: 2023-10-13
Description: 
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS).

On Junos MX Series platforms with Precision Time Protocol (PTP) configured, a prolonged routing protocol churn can lead to an FPC crash and restart.

This issue affects Juniper Networks Junos OS on MX Series:



  *  All versions prior to 20.4R3-S4;
  *  21.1 version 21.1R1 and later versions;
  *  21.2 versions prior to 21.2R3-S2;
  *  21.3 versions prior to 21.3R3-S5;
  *  21.4 versions prior to 21.4R3;
  *  22.1 versions prior to 22.1R3;
  *  22.2 versions prior to 22.2R1-S1, 22.2R2.







CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: https://supportportal.juniper.net/JSA73165; https://supportportal.juniper.net/JSA73165
CVE: CVE-2023-44201
Published: 2023-10-13
Description: 
An Incorrect Permission Assignment for Critical Resource vulnerability in a specific file of Juniper Networks Junos OS and Junos OS Evolved allows a local authenticated attacker to read configuration changes without having the permissions.

When a user with the respective permissions commits a configuration change, a specific file is created. That file is readable even by users with no permissions to access the configuration. This can lead to privilege escalation as the user can read the password hash when a password change is being committed.

This issue affects:

Juniper Networks Junos OS



  *  All versions prior to 20.4R3-S4;
  *  21.1 versions prior to 21.1R3-S4;
  *  21.2 versions prior to 21.2R3-S2;
  *  21.3 versions prior to 21.3R2-S2, 21.3R3-S1;
  *  21.4 versions prior to 21.4R2-S1, 21.4R3.




Juniper Networks Junos OS Evolved



  *  All versions prior to 20.4R3-S4-EVO;
  *  21.1 versions prior to 21.1R3-S2-EVO;
  *  21.2 versions prior to 21.2R3-S2-EVO;
  *  21.3 versions prior to 21.3R3-S1-EVO;
  *  21.4 versions prior to 21.4R2-S2-EVO.







CVSS Score: 5.0 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://supprtportal.juniper.net/JSA73167; https://supprtportal.juniper.net/JSA73167
CVE: CVE-2023-44203
Published: 2023-10-13
Description: 
An Improper Check or Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on QFX5000 Series, EX2300, EX3400, EX4100, EX4400 and EX4600 allows a adjacent attacker to send specific traffic, which leads to packet flooding, resulting in a Denial of Service (DoS).

When a specific IGMP packet is received in an isolated VLAN, it is duplicated to all other ports under the primary VLAN, which causes a flood.

This issue affects QFX5000 series, EX2300, EX3400, EX4100, EX4400 and EX4600 platforms only.

This issue affects Juniper Junos OS on on QFX5000 Series, EX2300, EX3400, EX4100, EX4400 and EX4600:



  *  All versions prior to 20.4R3-S5;
  *  21.1 versions prior to 21.1R3-S4;
  *  21.2 versions prior to 21.2R3-S3;
  *  21.3 versions prior to 21.3R3-S5;
  *  21.4 versions prior to 21.4R3-S2;
  *  22.1 versions prior to 22.1R3;
  *  22.2 versions prior to 22.2R3;
  *  22.3 versions prior to 22.3R2.







CVSS Score: 6.5 (MEDIUM)
CWE: CWE-703
References: https://supportportal.juniper.net/JSA73169; https://supportportal.juniper.net/JSA73169
CVE: CVE-2023-44204
Published: 2023-10-13
Description: 
An Improper Validation of Syntactic Correctness of Input vulnerability in Routing Protocol Daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).

When a malformed BGP UPDATE packet is received over an established BGP session, the rpd crashes and restarts.

This issue affects both eBGP and iBGP implementations.

This issue affects:

Juniper Networks Junos OS



  *  21.4 versions prior to 21.4R3-S4;
  *  22.1 versions prior to 22.1R3-S3;
  *  22.2 versions prior to 22.2R3-S2;
  *  22.3 versions prior to 22.3R2-S2, 22.3R3;
  *  22.4 versions prior to 22.4R2-S1, 22.4R3;
  *  23.2 versions prior to 23.2R1, 23.2R2;




Juniper Networks Junos OS Evolved



  *  21.4 versions prior to 21.4R3-S5-EVO;
  *  22.1 versions prior to 22.1R3-S3-EVO;
  *  22.2 versions prior to 22.2R3-S3-EVO;
  *  22.3 versions prior to 22.3R2-S2-EVO;
  *  22.4 versions prior to 22.4R3-EVO;
  *  23.2 versions prior to 23.2R2-EVO;







CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1286, CWE-20
References: https://supportportal.juniper.net/JSA73170; https://supportportal.juniper.net/JSA73170
CVE: CVE-2023-5563
Published: 2023-10-13
Description: The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.
CVSS Score: 7.1 (HIGH)
CWE: CWE-703
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-98mc-rj7w-7rpv; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-98mc-rj7w-7rpv
CVE: CVE-2023-5564
Published: 2023-10-13
Description: Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/froxlor/froxlor/commit/e8ed43056c1665522a586e3485da67f2bdf073aa; https://huntr.dev/bounties/9254d8f3-a847-4ae8-8477-d2ce027cff5c; https://github.com/froxlor/froxlor/commit/e8ed43056c1665522a586e3485da67f2bdf073aa
CVE: CVE-2023-42752
Published: 2023-10-13
Description: An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html; https://access.redhat.com/security/cve/CVE-2023-42752; https://bugzilla.redhat.com/show_bug.cgi?id=2239828
CVE: CVE-2023-4562
Published: 2023-10-13
Description: Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequence programs from the product or write malicious sequence programs or improper data in the product without authentication by sending illegitimate messages.







CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://jvn.jp/vu/JVNVU90509290/; https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-13; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-012_en.pdf
CVE: CVE-2023-5557
Published: 2023-10-13
Description: A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-693
References: https://access.redhat.com/errata/RHSA-2023:7712; https://access.redhat.com/errata/RHSA-2023:7713; https://access.redhat.com/errata/RHSA-2023:7730
CVE: CVE-2023-26366
Published: 2023-10-13
Description: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://helpx.adobe.com/security/products/magento/apsb23-50.html; https://helpx.adobe.com/security/products/magento/apsb23-50.html
CVE: CVE-2023-26367
Published: 2023-10-13
Description: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/magento/apsb23-50.html; https://helpx.adobe.com/security/products/magento/apsb23-50.html
CVE: CVE-2023-38218
Published: 2023-10-13
Description: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb23-50.html; https://helpx.adobe.com/security/products/magento/apsb23-50.html
CVE: CVE-2023-38219
Published: 2023-10-13
Description: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Payload is stored in an admin area, resulting in high confidentiality and integrity impact.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb23-50.html; https://helpx.adobe.com/security/products/magento/apsb23-50.html
CVE: CVE-2023-38220
Published: 2023-10-13
Description: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://helpx.adobe.com/security/products/magento/apsb23-50.html; https://helpx.adobe.com/security/products/magento/apsb23-50.html
CVE: CVE-2023-38221
Published: 2023-10-13
Description: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.
CVSS Score: 8.0 (HIGH)
CWE: CWE-89
References: https://helpx.adobe.com/security/products/magento/apsb23-50.html; https://helpx.adobe.com/security/products/magento/apsb23-50.html
CVE: CVE-2023-38249
Published: 2023-10-13
Description: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.
CVSS Score: 8.0 (HIGH)
CWE: CWE-89
References: https://helpx.adobe.com/security/products/magento/apsb23-50.html; https://helpx.adobe.com/security/products/magento/apsb23-50.html
CVE: CVE-2023-38250
Published: 2023-10-13
Description: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.
CVSS Score: 8.0 (HIGH)
CWE: CWE-89
References: https://helpx.adobe.com/security/products/magento/apsb23-50.html; https://helpx.adobe.com/security/products/magento/apsb23-50.html
CVE: CVE-2023-38251
Published: 2023-10-13
Description: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-service. Exploitation of this issue does not require user interaction.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://helpx.adobe.com/security/products/magento/apsb23-50.html; https://helpx.adobe.com/security/products/magento/apsb23-50.html
CVE: CVE-2023-38000
Published: 2023-10-13
Description: Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve; https://patchstack.com/database/vulnerability/gutenberg/wordpress-gutenberg-plugin-16-8-0-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-3-2-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cve
CVE: CVE-2023-5571
Published: 2023-10-13
Description: Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/vriteio/vrite/commit/1877683b932bb33fb20d688e476284b70bb9fe23; https://huntr.dev/bounties/926ca25f-dd4a-40cf-8e6b-9d7b5938e95a; https://github.com/vriteio/vrite/commit/1877683b932bb33fb20d688e476284b70bb9fe23
CVE: CVE-2023-5572
Published: 2023-10-13
Description: Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/vriteio/vrite/commit/1877683b932bb33fb20d688e476284b70bb9fe23; https://huntr.dev/bounties/db649f1b-8578-4ef0-8df3-d320ab33f1be; https://github.com/vriteio/vrite/commit/1877683b932bb33fb20d688e476284b70bb9fe23
CVE: CVE-2023-5573
Published: 2023-10-13
Description: Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/vriteio/vrite/commit/1877683b932bb33fb20d688e476284b70bb9fe23; https://huntr.dev/bounties/46a2bb2c-712a-4008-a147-b862e3af7d72; https://github.com/vriteio/vrite/commit/1877683b932bb33fb20d688e476284b70bb9fe23
CVE: CVE-2023-39999
Published: 2023-10-13
Description: Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/
CVE: CVE-2023-43079
Published: 2023-10-13
Description: 
Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to execute arbitrary code in order to elevate privileges on the system. Exploitation may lead to a complete system compromise.


CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000218469/dsa-2023-367-dell-openmanage-server-administrator-omsa-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218469/dsa-2023-367-dell-openmanage-server-administrator-omsa-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-29464
Published: 2023-10-13
Description: 
FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. Sending a size larger than the buffer size results in leakage of data from memory resulting in an information disclosure. If the size is large enough, it causes communications over the common industrial protocol to become unresponsive to any type of packet, resulting in a denial-of-service to FactoryTalk Linx over the common industrial protocol.


CVSS Score: 8.2 (HIGH)
CWE: CWE-20, CWE-787
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141040; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141040