deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2843
Published: 2023-08-07
Description: The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/8e713eaf-f332-47e2-a131-c14222201fdc; https://wpscan.com/vulnerability/8e713eaf-f332-47e2-a131-c14222201fdc
CVE: CVE-2023-3365
Published: 2023-08-07
Description: The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment
CVSS Score: 8.1 (HIGH)
References: https://wpscan.com/vulnerability/21ce5baa-8085-4053-8d8b-f7d3e2ae70c1; https://wpscan.com/vulnerability/21ce5baa-8085-4053-8d8b-f7d3e2ae70c1
CVE: CVE-2023-3492
Published: 2023-08-07
Description: The WP Shopping Pages WordPress plugin through 1.14 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 6.8 (MEDIUM)
References: https://wpscan.com/vulnerability/01b9b1c2-439e-44df-bf01-026cb13d7d40; https://wpscan.com/vulnerability/01b9b1c2-439e-44df-bf01-026cb13d7d40
CVE: CVE-2023-3524
Published: 2023-08-07
Description: The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/89570379-769b-4684-b8a7-28c37b408e5d; https://wpscan.com/vulnerability/89570379-769b-4684-b8a7-28c37b408e5d
CVE: CVE-2023-3575
Published: 2023-08-07
Description: The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/6f884688-2c0d-4844-bd31-ef7085edf112; https://www.onvio.nl/nieuws/research-day-discovering-vulnerabilities-in-wordpress-plugins; https://wpscan.com/vulnerability/6f884688-2c0d-4844-bd31-ef7085edf112
CVE: CVE-2023-3650
Published: 2023-08-07
Description: The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/0a0ecdff-c961-4947-bf7e-bd2392501e33; https://wpscan.com/vulnerability/0a0ecdff-c961-4947-bf7e-bd2392501e33
CVE: CVE-2023-3671
Published: 2023-08-07
Description: The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/8b765f39-38e0-49c7-843a-a5b9375a32e7; https://wpscan.com/vulnerability/8b765f39-38e0-49c7-843a-a5b9375a32e7
CVE: CVE-2023-23757
Published: 2023-08-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://extensions.joomla.org/extension/ba-gallery/; https://extensions.joomla.org/extension/ba-gallery/
CVE: CVE-2023-23758
Published: 2023-08-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://extensions.joomla.org/extension/creative-gallery/; https://extensions.joomla.org/extension/creative-gallery/
CVE: CVE-2023-32783
Published: 2023-08-07
Description: The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a "$" symbol suffix. NOTE: the vendor states "We do not consider this as a security bug and it's an expected behaviour."
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://www.peteslade.com/post/manageengine-adauditplus-cve-2023-32783; https://www.peteslade.com/post/manageengine-adauditplus-cve-2023-32783
CVE: CVE-2023-34476
Published: 2023-08-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://extensions.joomla.org/extension/proforms-basic/; https://extensions.joomla.org/extension/proforms-basic/
CVE: CVE-2023-34477
Published: 2023-08-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://extensions.joomla.org/extension/online-virtual-classroom/; https://extensions.joomla.org/extension/online-virtual-classroom/
CVE: CVE-2023-38044
Published: 2023-08-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://extensions.joomla.org/vulnerable-extensions/resolved/hikashop-versions-from-4-4-1-to-4-7-2-are-affected-sql-injection/; https://www.hikashop.com/support/documentation/56-hikashop-changelog.html; https://extensions.joomla.org/vulnerable-extensions/resolved/hikashop-versions-from-4-4-1-to-4-7-2-are-affected-sql-injection/
CVE: CVE-2023-38045
Published: 2023-08-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://extensions.joomla.org/extension/admiror-gallery/; https://extensions.joomla.org/extension/admiror-gallery/
CVE: CVE-2023-38157
Published: 2023-08-07
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38157; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38157
CVE: CVE-2023-4012
Published: 2023-08-07
Description: ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3).
CVSS Score: 7.5 (HIGH)
CWE: CWE-372
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038422; https://gitlab.com/NTPsec/ntpsec/-/issues/794; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038422
CVE: CVE-2023-4199
Published: 2023-08-07
Description: A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file catagory_data.php. The manipulation of the argument columns[1][data] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-236289 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yesec/Inventory-Management-System/blob/main/SQL%20Injection%20in%20catagory_data.php/vuln.md; https://vuldb.com/?ctiid.236289; https://vuldb.com/?id.236289
CVE: CVE-2023-36054
Published: 2023-08-07
Description: lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-824
References: https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd; https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final; https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final
CVE: CVE-2023-36499
Published: 2023-08-07
Description: Netgear XR300 v1.0.3.78 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at genie_ap_wifi_change.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/nvram_ssid/README.md; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/nvram_ssid/README.md
CVE: CVE-2023-38412
Published: 2023-08-07
Description: Netgear R6900P v1.3.3.154 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at ia_ap_setting.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/nvram_ssid/README.md; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/nvram_ssid/README.md
CVE: CVE-2023-38591
Published: 2023-08-07
Description: Netgear DG834Gv5 1.6.01.34 was discovered to contain multiple buffer overflows via the wla_ssid and wla_temp_ssid parameters at bsw_ssid.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/nvram_ssid/README.md; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/nvram_ssid/README.md
CVE: CVE-2023-38921
Published: 2023-08-07
Description: Netgear WG302v2 v5.2.9 and WAG302v2 v5.1.19 were discovered to contain multiple command injection vulnerabilities in the upgrade_handler function via the firmwareRestore and firmwareServerip parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/FirmRec/IoT-Vulns/tree/main/netgear/upgrade_handler; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/tree/main/netgear/upgrade_handler
CVE: CVE-2023-38922
Published: 2023-08-07
Description: Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_passwd and http_username parameters in the update_auth function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_auth/README.md; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_auth/README.md
CVE: CVE-2023-38924
Published: 2023-08-07
Description: Netgear DGN3500 1.1.00.37 was discovered to contain a buffer overflow via the http_password parameter at setup.cgi.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_password_create_smb_cfg/README.md; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_password_create_smb_cfg/README.md
CVE: CVE-2023-38925
Published: 2023-08-07
Description: Netgear DC112A 1.0.0.64, EX6200 1.0.3.94 and R6300v2 1.0.4.8 were discovered to contain a buffer overflow via the http_passwd parameter in password.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_smb_pass/README.md; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_smb_pass/README.md
CVE: CVE-2023-38926
Published: 2023-08-07
Description: Netgear EX6200 v1.0.3.94 was discovered to contain a buffer overflow via the wla_temp_ssid parameter at acosNvramConfig_set.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/nvram_ssid/README.md; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/nvram_ssid/README.md
CVE: CVE-2023-38928
Published: 2023-08-07
Description: Netgear R7100LG 1.0.0.78 was discovered to contain a command injection vulnerability via the password parameter at usb_remote_invite.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/FirmRec/IoT-Vulns/tree/main/netgear/usb_remote_invite_password; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/tree/main/netgear/usb_remote_invite_password
CVE: CVE-2023-38929
Published: 2023-08-07
Description: Tenda 4G300 v1.01.42 was discovered to contain a stack overflow via the page parameter at /VirtualSer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/VirtualSer/README.md; https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/VirtualSer/README.md
CVE: CVE-2023-38930
Published: 2023-08-07
Description: Tenda AC7 V1.0,V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0,V15.03.06.28, AC9 V3.0,V15.03.06.42_multi and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/addWifiMacFilter/README.md; https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/addWifiMacFilter/README.md
CVE: CVE-2023-38931
Published: 2023-08-07
Description: Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13 and FH1203 V2.0.1.6 were discovered to contain a stack overflow via the list parameter in the setaccount function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/cloudv2_setaccount/README.md; https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/cloudv2_setaccount/README.md
CVE: CVE-2023-38932
Published: 2023-08-07
Description: Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter in the SafeEmailFilter function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/formSafeEmailFilter; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/formSafeEmailFilter
CVE: CVE-2023-38933
Published: 2023-08-07
Description: Tenda AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6 and AC9 V3.0 V15.03.06.42_multi, and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the deviceId parameter in the formSetClientState function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetClientState/README.md; https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetClientState/README.md
CVE: CVE-2023-38934
Published: 2023-08-07
Description: Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) was discovered to contain a stack overflow via the deviceId parameter in the formSetDeviceName function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetDeviceName/README.md; https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetDeviceName/README.md
CVE: CVE-2023-38935
Published: 2023-08-07
Description: Tenda AC1206 V15.03.06.23, AC8 V4 V16.03.34.06, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13 and AC9 V3.0 V15.03.06.42_multi were discovered to contain a tack overflow via the list parameter in the formSetQosBand function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetQosBand/README.md; https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetQosBand/README.md
CVE: CVE-2023-38936
Published: 2023-08-07
Description: Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6, AC9 V3.0 V15.03.06.42_multi and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetSpeedWan/README.md; https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetSpeedWan/README.md
CVE: CVE-2023-38937
Published: 2023-08-07
Description: Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, AC5 V1.0 V15.03.06.28, AC9 V3.0 V15.03.06.42_multi and AC10 v4.0 V16.03.10.13 were discovered to contain a stack overflow via the list parameter in the formSetVirtualSer function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetVirtualSer/README.md; https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetVirtualSer/README.md
CVE: CVE-2023-38938
Published: 2023-08-07
Description: Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter at /L7Im.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/frmL7ImForm; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/frmL7ImForm
CVE: CVE-2023-38939
Published: 2023-08-07
Description: Tenda F1202 V1.2.0.9 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the mit_ssid parameter in the formWrlsafeset function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/formWrlsafeset; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/formWrlsafeset
CVE: CVE-2023-38940
Published: 2023-08-07
Description: Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/form_fast_setting_wifi_set; https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/form_fast_setting_wifi_set
CVE: CVE-2023-39349
Published: 2023-08-07
Description: Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-287
References: https://github.com/getsentry/self-hosted/releases/tag/23.7.2; https://github.com/getsentry/sentry/commit/fad12c1150d1135edf9666ea72ca11bc110c1083; https://github.com/getsentry/sentry/pull/53850
CVE: CVE-2023-39363
Published: 2023-08-07
Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a `.vy` contract compiled with `vyper` versions `0.2.15`, `0.2.16`, or `0.3.0`; a primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates); and a secondary function that utilizes the same `key` and would be affected by the improper state caused by the primary function. Version 0.3.1 contains a fix for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-863
References: https://github.com/vyperlang/vyper/pull/2439; https://github.com/vyperlang/vyper/pull/2514; https://github.com/vyperlang/vyper/security/advisories/GHSA-5824-cm3x-3c38
CVE: CVE-2023-39550
Published: 2023-08-07
Description: Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_passwd and http_username parameters in the check_auth function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_auth/README.md; https://www.netgear.com/about/security/; https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_auth/README.md
CVE: CVE-2023-4200
Published: 2023-08-07
Description: A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file product_data.php.. The manipulation of the argument columns[1][data] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-236290 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Yesec/Inventory-Management-System/blob/main/SQL%20Injection%20in%20product_data.php/vuln.md; https://vuldb.com/?ctiid.236290; https://vuldb.com/?id.236290
CVE: CVE-2023-38704
Published: 2023-08-07
Description: import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for remote code execution in cases where an application passes user-supplied input directly to the `import()` function. This vulnerability has been patched in import-in-the-middle version 1.4.2.

Some workarounds are available. Do not pass any user-supplied input to `import()`. Instead, verify it against a set of allowed values. If using import-in-the-middle, directly or indirectly, and support for EcmaScript Modules is not needed, ensure that no options are set, either via command-line or the `NODE_OPTIONS` environment variable, that would enable loader hooks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://github.com/DataDog/import-in-the-middle/commit/2531cdd9d1d73f9eaa87c16967f60cb276c1971b; https://github.com/DataDog/import-in-the-middle/security/advisories/GHSA-5r27-rw8r-7967; https://github.com/DataDog/import-in-the-middle/commit/2531cdd9d1d73f9eaa87c16967f60cb276c1971b
CVE: CVE-2023-39520
Published: 2023-08-07
Description: Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is spawning an SYSTEM Powershell without the `-NoProfile` parameter. Therefore the profile of the user starting the repair will be loaded. Version 1.9.3 contains a fix for this issue. Adding a `-NoProfile` to the powershell is a possible workaround.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://github.com/cryptomator/cryptomator/commit/727c32ad50c3901a6144a11cf984a3b7ebcf8b2b; https://github.com/cryptomator/cryptomator/releases/download/1.9.2/Cryptomator-1.9.2-x64.msi; https://github.com/cryptomator/cryptomator/releases/tag/1.9.3
CVE: CVE-2023-39524
Published: 2023-08-07
Description: PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/PrestaShop/PrestaShop/commit/2047d4c053043102bc46a37d383b392704bf14d7; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-75p5-jwx4-qw9h; https://github.com/PrestaShop/PrestaShop/commit/2047d4c053043102bc46a37d383b392704bf14d7