deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-31670
Published: 2023-05-23
Description: An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a crafted binary.
CVSS Score: 7.5 (HIGH)
References: https://github.com/WebAssembly/wabt/issues/2199; https://github.com/WebAssembly/wabt/issues/2199
CVE: CVE-2023-31708
Published: 2023-05-23
Description: A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to the Upload software format function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/weng-xianhu/eyoucms/issues/41; https://github.com/weng-xianhu/eyoucms/issues/41
CVE: CVE-2023-31740
Published: 2023-05-23
Description: There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the apply.cgi interface, thereby gaining shell privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: http://linksys.com; https://github.com/D2y6p/CVE/blob/main/Linksys/CVE-2023-31740/Linksys_E2000_RCE.pdf; http://linksys.com
CVE: CVE-2023-31741
Published: 2023-05-23
Description: There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ssid, wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: http://linksys.com; https://github.com/D2y6p/CVE/blob/main/Linksys/CVE-2023-31741/Linksys_E2000_RCE_2.pdf; http://linksys.com
CVE: CVE-2023-31814
Published: 2023-05-23
Description: D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is vulnerable to File inclusion via /model/__lang_msg.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-706
References: https://gist.github.com/[PII_REDACTED]/9503198d3cbd5bc7db47625ac0caaade; https://www.dlink.com/en/security-bulletin/; https://gist.github.com/[PII_REDACTED]/9503198d3cbd5bc7db47625ac0caaade
CVE: CVE-2023-31826
Published: 2023-05-23
Description: Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: http://nevado.skyscreamer.org/; https://github.com/skyscreamer/nevado/issues/121; https://github.com/skyscreamer/nevado/releases
CVE: CVE-2023-31994
Published: 2023-05-23
Description: Certain Hanwha products are vulnerable to Denial of Service (DoS). ck vector is: When an empty UDP packet is sent to the listening service, the service thread results in a non-functional service (DoS) via WS Discovery and Hanwha proprietary discovery services. This affects IP Camera ANE-L7012R 1.41.01 and IP Camera XNV-9082R 2.10.02.
CVSS Score: 5.3 (MEDIUM)
References: https://hanwhavisionamerica.com/download/50042/; https://www.hanwhavision.com/wp-content/uploads/2023/04/Camera-Vulnerability-Report.pdf; https://hanwhavisionamerica.com/download/50042/
CVE: CVE-2023-31995
Published: 2023-05-23
Description: Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hanwhavisionamerica.com/download/50042/; https://www.hanwhavision.com/wp-content/uploads/2023/04/Camera-Vulnerability-Report.pdf; https://hanwhavisionamerica.com/download/50042/
CVE: CVE-2023-31996
Published: 2023-05-23
Description: Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://hanwhavisionamerica.com/download/50042/; https://www.hanwhavision.com/wp-content/uploads/2023/04/Camera-Vulnerability-Report.pdf; https://hanwhavisionamerica.com/download/50042/
CVE: CVE-2023-22654
Published: 2023-05-23
Description: Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may lead to an arbitrary script execution on a logged-in user's web browser. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN14778242/; https://www.monitoring.especmic.co.jp/post/VulnerabilityInRT-12N_RS-12N_RT-22BNandTEU-12N; https://www.tandd.com/news/detail.html?id=780
CVE: CVE-2023-23545
Published: 2023-05-23
Description: Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote unauthenticated attacker to alter the product settings without authentication. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://jvn.jp/en/jp/JVN14778242/; https://www.monitoring.especmic.co.jp/post/VulnerabilityInRT-12N_RS-12N_RT-22BNandTEU-12N; https://www.tandd.com/news/detail.html?id=780
CVE: CVE-2023-25946
Published: 2023-05-23
Description: Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communication data and conduct an arbitrary operation under certain conditions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-863
References: https://jvn.jp/en/jp/JVN48687031/; https://qrio.me/article/announce/2023/4140/; https://jvn.jp/en/jp/JVN48687031/
CVE: CVE-2023-25953
Published: 2023-05-23
Description: Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product is installed to inject arbitrary code while processing the product execution. Since a full disk access privilege is required to execute LINE WORKS Drive Explorer, the attacker may be able to read and/or write to arbitrary files without the access privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://jvn.jp/en/jp/JVN01937209/; https://line.worksmobile.com/jp/release-notes/20230216/; https://jvn.jp/en/jp/JVN01937209/
CVE: CVE-2023-26595
Published: 2023-05-23
Description: Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://cs.cybozu.co.jp/2023/007698.html; https://jvn.jp/en/jp/JVN41694426/; https://cs.cybozu.co.jp/2023/007698.html
CVE: CVE-2023-27304
Published: 2023-05-23
Description: Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to alter the data of Message and/or Bulletin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://cs.cybozu.co.jp/2023/007698.html; https://jvn.jp/en/jp/JVN41694426/; https://cs.cybozu.co.jp/2023/007698.html
CVE: CVE-2023-27384
Published: 2023-05-23
Description: Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data of MultiReport.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://cs.cybozu.co.jp/2023/007698.html; https://jvn.jp/en/jp/JVN41694426/; https://cs.cybozu.co.jp/2023/007698.html
CVE: CVE-2023-27387
Published: 2023-05-23
Description: Cross-site request forgery (CSRF) in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to conduct an arbitrary operation by having a logged-in user view a malicious page. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN14778242/; https://www.monitoring.especmic.co.jp/post/VulnerabilityInRT-12N_RS-12N_RT-22BNandTEU-12N; https://www.tandd.com/news/detail.html?id=780
CVE: CVE-2023-27388
Published: 2023-05-23
Description: Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the product as a registered user. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-863
References: https://jvn.jp/en/jp/JVN14778242/; https://www.monitoring.especmic.co.jp/post/VulnerabilityInRT-12N_RS-12N_RT-22BNandTEU-12N; https://www.tandd.com/news/detail.html?id=780
CVE: CVE-2023-27397
Published: 2023-05-23
Description: Unrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1.1.8. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://jvn.jp/en/jp/JVN31701509/; https://microengine.jp/information/security_2023_05.html; https://jvn.jp/en/jp/JVN31701509/
CVE: CVE-2023-27507
Published: 2023-05-23
Description: MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://jvn.jp/en/jp/JVN31701509/; https://microengine.jp/information/security_2023_05.html; https://jvn.jp/en/jp/JVN31701509/
CVE: CVE-2023-27512
Published: 2023-05-23
Description: Use of hard-coded credentials exists in SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10, and SV-CPT-MC310F versions prior to Ver.8.10, which may allow a remote authenticated attacker to login the affected product with an administrative privilege and perform an unintended operation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798
References: https://jvn.jp/en/vu/JVNVU92106300/; https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_solarview_230508.pdf; https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware
CVE: CVE-2023-27514
Published: 2023-05-23
Description: OS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8.10 allows a remote authenticated attacker to execute an arbitrary OS command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/vu/JVNVU92106300/; https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_solarview_230508.pdf; https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware
CVE: CVE-2023-27518
Published: 2023-05-23
Description: Buffer overflow vulnerability in the multiple setting pages of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8.10 allows a remote authenticated attacker to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://jvn.jp/en/vu/JVNVU92106300/; https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_solarview_230508.pdf; https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware
CVE: CVE-2023-27521
Published: 2023-05-23
Description: OS command injection vulnerability in the mail setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8.10 allows remote authenticated attackers to execute an arbitrary OS command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/vu/JVNVU92106300/; https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_solarview_230508.pdf; https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware
CVE: CVE-2023-27920
Published: 2023-05-23
Description: Improper access control vulnerability in the system date/time setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8.10 allows a remote authenticated attacker to alter system date/time of the affected product.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://jvn.jp/en/vu/JVNVU92106300/; https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_solarview_230508.pdf; https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware
CVE: CVE-2023-27921
Published: 2023-05-23
Description: JINS MEME CORE Firmware version 2.2.0 and earlier uses a hard-coded cryptographic key, which may lead to data acquired by a sensor of the affected product being decrypted by a network-adjacent attacker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://jinsmeme.com/media/2023-04-fwapp2; https://jvn.jp/en/jp/JVN13306058/; https://jinsmeme.com/media/2023-04-fwapp2
CVE: CVE-2023-27922
Published: 2023-05-23
Description: Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN59341308/; https://wordpress.org/plugins/newsletter/; https://jvn.jp/en/jp/JVN59341308/
CVE: CVE-2023-27923
Published: 2023-05-23
Description: Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN95792402/; https://www.vektor-inc.co.jp/product-update/vk-blocks-exunit-xss/; https://jvn.jp/en/jp/JVN95792402/
CVE: CVE-2023-27925
Published: 2023-05-23
Description: Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN95792402/; https://www.vektor-inc.co.jp/product-update/vk-blocks-exunit-xss/; https://jvn.jp/en/jp/JVN95792402/
CVE: CVE-2023-27926
Published: 2023-05-23
Description: Cross-site scripting vulnerability in Profile setting function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN95792402/; https://www.vektor-inc.co.jp/product-update/vk-blocks-exunit-xss/; https://jvn.jp/en/jp/JVN95792402/
CVE: CVE-2023-28367
Published: 2023-05-23
Description: Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN95792402/; https://www.vektor-inc.co.jp/product-update/vk-blocks-exunit-xss/; https://jvn.jp/en/jp/JVN95792402/
CVE: CVE-2023-28390
Published: 2023-05-23
Description: Privilege escalation vulnerability in SR-7100VN firmware Ver.1.38(N) and earlier and SR-7100VN #31 firmware Ver.1.21 and earlier allows a network-adjacent attacker with administrative privilege of the affected product to obtain an administrative privilege of the OS (Operating System). As a result, an arbitrary OS command may be executed.
CVSS Score: 6.8 (MEDIUM)
References: https://jvn.jp/en/jp/JVN80476232/; https://www.icom.co.jp/news/7239/; https://jvn.jp/en/jp/JVN80476232/
CVE: CVE-2023-28392
Published: 2023-05-23
Description: Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier allow an authenticated user with an administrative privilege to execute an arbitrary OS command.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/jp/JVN28412757/; https://jvn.jp/en/vu/JVNVU98968780/; https://www.inaba.co.jp/abaniact/news/Wi-Fi%20AP%20UNIT%E3%80%8CAC-WAPU-300%E3%80%8D%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8BOS%E3%82%B3%E3%83%9E%E3%83%B3%E3%83%89%E3%82%A4%E3%83%B3%E3%82%B8%E3%82%A7%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf
CVE: CVE-2023-28394
Published: 2023-05-23
Description: Beekeeper Studio versions prior to 3.9.9 allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on the PC where the affected product is installed. As a result, an arbitrary OS command may be executed as well.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/beekeeper-studio/beekeeper-studio; https://jvn.jp/en/jp/JVN11705010/; https://www.beekeeperstudio.io/
CVE: CVE-2023-28408
Published: 2023-05-23
Description: Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information depending on settings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://jvn.jp/en/jp/JVN01093915/; https://plugins.2inc.org/mw-wp-form/blog/2023/05/08/752/; https://jvn.jp/en/jp/JVN01093915/
CVE: CVE-2023-28409
Published: 2023-05-23
Description: Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload an arbitrary file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://jvn.jp/en/jp/JVN01093915/; https://plugins.2inc.org/mw-wp-form/blog/2023/05/08/752/; https://jvn.jp/en/jp/JVN01093915/
CVE: CVE-2023-28413
Published: 2023-05-23
Description: Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitive information, alter the website, or cause a denial-of-service (DoS) condition.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://jvn.jp/en/jp/JVN01093915/; https://snow-monkey.2inc.org/2023/04/28/snow-monkey-forms-v5-0-7/; https://jvn.jp/en/jp/JVN01093915/
CVE: CVE-2023-30469
Published: 2023-05-23
Description: Cross-site Scripting vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component) allows Reflected XSS.This issue affects Hitachi Ops Center Analyzer: from 10.9.1-00 before 10.9.2-00.


CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-115/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-115/index.html
CVE: CVE-2023-2844
Published: 2023-05-23
Description: Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/cloudexplorer-dev/cloudexplorer-lite/commit/d9f55a44e579d312977b02317b2020de758b763a; https://huntr.dev/bounties/6644b36e-603d-4dbe-8ee2-5df8b8fb2e22; https://github.com/cloudexplorer-dev/cloudexplorer-lite/commit/d9f55a44e579d312977b02317b2020de758b763a
CVE: CVE-2023-2845
Published: 2023-05-23
Description: Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/cloudexplorer-dev/cloudexplorer-lite/commit/d9f55a44e579d312977b02317b2020de758b763a; https://huntr.dev/bounties/ac10e81c-998e-4425-9d74-b985d9b0254c; https://github.com/cloudexplorer-dev/cloudexplorer-lite/commit/d9f55a44e579d312977b02317b2020de758b763a
CVE: CVE-2023-23693
Published: 2023-05-23
Description: 
Dell VxRail, versions prior to 7.0.450, contains an OS command injection Vulnerability in DCManager command-line utility. A local high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000213011/dsa-2023-071-dell-vxrail-security-update-for-multiple-third-party-component-vulnerabilities-7-0-450; https://www.dell.com/support/kbdoc/en-us/000213011/dsa-2023-071-dell-vxrail-security-update-for-multiple-third-party-component-vulnerabilities-7-0-450
CVE: CVE-2023-23694
Published: 2023-05-23
Description: 
Dell VxRail versions earlier than 7.0.450, contain(s) an OS command injection vulnerability in VxRail Manager. A local authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000213011/dsa-2023-071-dell-vxrail-security-update-for-multiple-third-party-component-vulnerabilities-7-0-450; https://www.dell.com/support/kbdoc/en-us/000213011/dsa-2023-071-dell-vxrail-security-update-for-multiple-third-party-component-vulnerabilities-7-0-450
CVE: CVE-2023-31669
Published: 2023-05-23
Description: WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-116, CWE-116
References: https://github.com/WebAssembly/wabt/issues/2165; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OSFFCKXUQ5PAC5UVXY7N6HEHVQ3AC2RG/; https://github.com/WebAssembly/wabt/issues/2165
CVE: CVE-2023-23706
Published: 2023-05-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/miniorange-login-openid/wordpress-wordpress-social-login-and-register-discord-google-twitter-linkedin-plugin-7-5-14-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/miniorange-login-openid/wordpress-wordpress-social-login-and-register-discord-google-twitter-linkedin-plugin-7-5-14-cross-site-request-forgery-csrf-vulnerability?_s_id=cve