deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-47033
Published: 2024-01-19
Description: MultiSigWallet 0xF0C99 was discovered to contain a reentrancy vulnerability via the function executeTransaction.
CVSS Score: 7.5 (HIGH)
References: https://etherscan.io/address/0xF0C9975eFd521282c2DF[PII_REDACTED]2d691aC4d9; https://github.com/RikkaLzw/CVE/blob/main/CVE-2024.1.19.md; https://etherscan.io/address/0xF0C9975eFd521282c2DF[PII_REDACTED]2d691aC4d9
CVE: CVE-2023-47034
Published: 2024-01-19
Description: A vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://etherscan.io/address/0xdB94c67460DdaA9D6a9d6a2B855B5440f9afEb7C; https://github.com/RikkaLzw/CVE/blob/main/CVE-2024.1.19-2.md; https://etherscan.io/address/0xdB94c67460DdaA9D6a9d6a2B855B5440f9afEb7C
CVE: CVE-2024-0722
Published: 2024-01-19
Description: A vulnerability was found in code-projects Social Networking Site 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file message.php of the component Message Page. The manipulation of the argument Story leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251546 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1r-4P-gWuIxuVL2QdOXsqN6OTRtQEmo7P/view?usp=drive_link; https://vuldb.com/?ctiid.251546; https://vuldb.com/?id.251546
CVE: CVE-2024-0723
Published: 2024-01-19
Description: A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251547.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://packetstormsecurity.com/files/176545/freeSSHd-1.0.9-Denial-Of-Service.html; https://vuldb.com/?ctiid.251547; https://vuldb.com/?id.251547
CVE: CVE-2024-0725
Published: 2024-01-19
Description: A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251548.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://packetstormsecurity.com/files/176544/ProSSHD-1.2-20090726-Denial-Of-Service.html; https://vuldb.com/?ctiid.251548; https://vuldb.com/?id.251548
CVE: CVE-2024-0726
Published: 2024-01-19
Description: A vulnerability was found in Project Worlds Student Project Allocation System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin_login.php of the component Admin Login Module. The manipulation of the argument msg with the input test%22%3Cscript%3Ealert(%27Torada%27)%3C/script%3E leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251549 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://torada.notion.site/Reflected-Cross-site-scripting-at-Project-Allocation-System-d94c7c489c2d48efa23b21a90dd0e03f?pvs=4; https://vuldb.com/?ctiid.251549; https://vuldb.com/?id.251549
CVE: CVE-2024-22911
Published: 2024-01-19
Description: A stack-buffer-underflow vulnerability was found in SWFTools v0.9.2, in the function parseExpression at src/swfc.c:2602.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/matthiaskramm/swftools/issues/216; https://github.com/matthiaskramm/swftools/issues/216
CVE: CVE-2024-22912
Published: 2024-01-19
Description: A global-buffer-overflow was found in SWFTools v0.9.2, in the function countline at swf5compiler.flex:327. It allows an attacker to cause code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/matthiaskramm/swftools/issues/212; https://github.com/matthiaskramm/swftools/issues/212
CVE: CVE-2024-22913
Published: 2024-01-19
Description: A heap-buffer-overflow was found in SWFTools v0.9.2, in the function swf5lex at lex.swf5.c:1321. It allows an attacker to cause code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/matthiaskramm/swftools/issues/213; https://github.com/matthiaskramm/swftools/issues/213
CVE: CVE-2024-22914
Published: 2024-01-19
Description: A heap-use-after-free was found in SWFTools v0.9.2, in the function input at lex.swf5.c:2620. It allows an attacker to cause denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://github.com/matthiaskramm/swftools/issues/214; https://github.com/matthiaskramm/swftools/issues/214
CVE: CVE-2024-22915
Published: 2024-01-19
Description: A heap-use-after-free was found in SWFTools v0.9.2, in the function swf_DeleteTag at rfxswf.c:1193. It allows an attacker to cause code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/matthiaskramm/swftools/issues/215; https://github.com/matthiaskramm/swftools/issues/215
CVE: CVE-2024-22919
Published: 2024-01-19
Description: swftools0.9.2 was discovered to contain a global-buffer-overflow vulnerability via the function parseExpression at swftools/src/swfc.c:2587.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/matthiaskramm/swftools/issues/209; https://github.com/matthiaskramm/swftools/issues/209
CVE: CVE-2024-22955
Published: 2024-01-19
Description: swftools 0.9.2 was discovered to contain a stack-buffer-underflow vulnerability via the function parseExpression at swftools/src/swfc.c:2576.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/matthiaskramm/swftools/issues/207; https://github.com/matthiaskramm/swftools/issues/207
CVE: CVE-2024-22956
Published: 2024-01-19
Description: swftools 0.9.2 was discovered to contain a heap-use-after-free vulnerability via the function removeFromTo at swftools/src/swfc.c:838
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/matthiaskramm/swftools/issues/208; https://github.com/matthiaskramm/swftools/issues/208
CVE: CVE-2024-22957
Published: 2024-01-19
Description: swftools 0.9.2 was discovered to contain an Out-of-bounds Read vulnerability via the function dict_do_lookup in swftools/lib/q.c:1190.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/matthiaskramm/swftools/issues/206; https://github.com/matthiaskramm/swftools/issues/206
CVE: CVE-2024-0728
Published: 2024-01-19
Description: A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument c_cmodel leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251551.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-73, CWE-610
References: https://github.com/mi2acle/forucmsvuln/blob/master/LFI.md; https://vuldb.com/?ctiid.251551; https://vuldb.com/?id.251551
CVE: CVE-2024-0729
Published: 2024-01-19
Description: A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. Affected by this issue is some unknown functionality of the file cms_admin.php. The manipulation of the argument a_name leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251552.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/mi2acle/forucmsvuln/blob/master/LFI.md; https://vuldb.com/?ctiid.251552; https://vuldb.com/?id.251552
CVE: CVE-2024-0730
Published: 2024-01-19
Description: A vulnerability, which was classified as critical, was found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file course_ajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251553 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://torada.notion.site/SQL-injection-at-course_ajax-php-485d8cca5f8c43dfb1f76c7336a4a45e; https://vuldb.com/?ctiid.251553; https://vuldb.com/?id.251553
CVE: CVE-2023-28722
Published: 2024-01-19
Description: Improper buffer restrictions for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-92
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html
CVE: CVE-2023-28738
Published: 2024-01-19
Description: Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20, CWE-116
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html
CVE: CVE-2023-28743
Published: 2024-01-19
Description: Improper input validation for some Intel NUC BIOS firmware before version QN0073 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html
CVE: CVE-2023-29244
Published: 2024-01-19
Description: Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software installers before version 5.4.1.4479 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.html
CVE: CVE-2023-29495
Published: 2024-01-19
Description: Improper input validation for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html
CVE: CVE-2023-32272
Published: 2024-01-19
Description: Uncontrolled search path in some Intel NUC Pro Software Suite Configuration Tool software installers before version 3.0.0.6 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 7.9 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.html
CVE: CVE-2023-32544
Published: 2024-01-19
Description: Improper access control in some Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software installers before version 1.1.45 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.html
CVE: CVE-2023-33295
Published: 2024-01-19
Description: Cohesity DataProtect prior to 6.8.1_u5 or 7.1 was discovered to have a incorrect access control vulnerability due to a lack of TLS Certificate Validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://cohesity.com; https://github.com/cohesity/SecAdvisory/blob/master/CVE-2023-33295.md; https://cohesity.com
CVE: CVE-2023-38541
Published: 2024-01-19
Description: Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-277, CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.html
CVE: CVE-2023-38587
Published: 2024-01-19
Description: Improper input validation in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01028.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01028.html
CVE: CVE-2023-42429
Published: 2024-01-19
Description: Improper buffer restrictions in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-92
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01028.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01028.html
CVE: CVE-2023-42766
Published: 2024-01-19
Description: Improper input validation in some Intel NUC 8 Compute Element BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01028.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01028.html
CVE: CVE-2023-43956
Published: 2024-01-19
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-36263. Reason: This record is a duplicate of CVE-2023-36263. Notes: All CVE users should reference CVE-2023-36263 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2023-45485
Published: 2024-01-19
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-47035
Published: 2024-01-19
Description: RPTC 0x3b08c was discovered to not conduct status checks on the parameter tradingOpen. This vulnerability can allow attackers to conduct unauthorized transfer operations.
CVSS Score: 7.5 (HIGH)
References: https://etherscan.io/token/0x3b08c03fa8278cf81b9043b[PII_REDACTED]76fcdbb; https://github.com/RikkaLzw/CVE/blob/main/CVE-2024.1.19-3.md; https://etherscan.io/token/0x3b08c03fa8278cf81b9043b[PII_REDACTED]76fcdbb
CVE: CVE-2023-50447
Published: 2024-01-19
Description: Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-95
References: http://www.openwall.com/lists/oss-security/2024/01/20/1; https://devhub.checkmarx.com/cve-details/CVE-2023-50447/; https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/
CVE: CVE-2023-50693
Published: 2024-01-19
Description: An issue in Jester v.0.6.0 and before allows a remote attacker to send a malicious crafted request.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/anas-cherni/dd297786750f300a2bab3bb73fee919b; https://github.com/dom96/jester/issues/326; https://github.com/dom96/jester/pull/327
CVE: CVE-2023-50694
Published: 2024-01-19
Description: An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to send a malicious crafted request due to insufficient parsing in the parser.nim component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://gist.github.com/anas-cherni/c95e2fc1fd84d93167eb60193318d0b8; https://github.com/dom96/httpbeast/issues/95; https://github.com/dom96/httpbeast/pull/96
CVE: CVE-2023-5080
Published: 2024-01-19
Description: A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-266
References: https://support.lenovo.com/us/en/product_security/LEN-142135; https://support.lenovo.com/us/en/product_security/LEN-142135
CVE: CVE-2023-5081
Published: 2024-01-19
Description: An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier.
CVSS Score: 3.3 (LOW)
CWE: CWE-497
References: https://support.lenovo.com/us/en/product_security/LEN-142135; https://support.lenovo.com/us/en/product_security/LEN-142135
CVE: CVE-2023-6043
Published: 2024-01-19
Description: A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://support.lenovo.com/us/en/product_security/LEN-144736; https://support.lenovo.com/us/en/product_security/LEN-144736
CVE: CVE-2023-6044
Published: 2024-01-19
Description: A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Service and execute arbitrary code with elevated privileges.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-290
References: https://support.lenovo.com/us/en/product_security/LEN-144736; https://support.lenovo.com/us/en/product_security/LEN-144736
CVE: CVE-2023-6450
Published: 2024-01-19
Description: An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-404
References: https://iknow.lenovo.com.cn/detail/419672; https://iknow.lenovo.com.cn/detail/419672
CVE: CVE-2024-0663
Published: 2024-01-19
Description: Rejected reason: REJECT: This is a false positive report.
CVE: CVE-2024-0731
Published: 2024-01-19
Description: A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as problematic. This vulnerability affects unknown code of the component PUT Command Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251554 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404, CWE-120
References: https://fitoxs.com/vuldb/01-PCMan%20v2.0.7-exploit.txt; https://vuldb.com/?ctiid.251554; https://vuldb.com/?id.251554
CVE: CVE-2024-0732
Published: 2024-01-19
Description: A vulnerability was found in PCMan FTP Server 2.0.7 and classified as problematic. This issue affects some unknown processing of the component STOR Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251555.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404, CWE-120
References: https://fitoxs.com/vuldb/02-PCMan%20v2.0.7-exploit.txt; https://vuldb.com/?ctiid.251555; https://vuldb.com/?id.251555
CVE: CVE-2024-22211
Published: 2024-01-19
Description: FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability.
CVSS Score: 3.7 (LOW)
CWE: CWE-122, CWE-190, CWE-190
References: https://github.com/FreeRDP/FreeRDP/commit/939e922936e9c3ae8fc204968645e5e7563a2fff; https://github.com/FreeRDP/FreeRDP/commit/aeac3040cc99eeaff1e1171a822114c857b9dca9; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rjhp-44rv-7v59
CVE: CVE-2024-23329
Published: 2024-01-19
Description:  changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.7 (LOW)
CWE: CWE-863
References: https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f; https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr; https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f
CVE: CVE-2024-23331
Published: 2024-01-19
Description: Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-178, CWE-200, CWE-284
References: https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5; https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw; https://vitejs.dev/config/server-options.html#server-fs-deny
CVE: CVE-2023-49329
Published: 2024-01-19
Description: Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlying operating system. The fixed versions are 4.4.5, 4.5.4, and 4.6.2. The earliest affected version is 4.3.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.anomali.com/collaborate/ciso-blog; https://www.anomali.com/security-advisory/anml-2023-01; https://www.anomali.com/collaborate/ciso-blog
CVE: CVE-2024-0733
Published: 2024-01-19
Description: A vulnerability was found in Smsot up to 2.12. It has been classified as critical. Affected is an unknown function of the file /api.php of the component HTTP POST Request Handler. The manipulation of the argument data[sign] leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251556.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/3GznRo9vWRJ8; https://vuldb.com/?ctiid.251556; https://vuldb.com/?id.251556