deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-0684
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as changing the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/29358ea9-21b7-4294-8fc9-0d38e689cf53?source=cve
CVE: CVE-2023-0685
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_unassign_folders function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin..
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e52b27fa-10e8-43d0-be29-774c2f5487ae?source=cve
CVE: CVE-2023-0711
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the view state of the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c43e93-69a3-407e-860e-ab25af5d7177?source=cve
CVE: CVE-2023-0715
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c3[PII_REDACTED]-4cb2-8e37-f33811bc0a22?source=cve
CVE: CVE-2023-0716
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad60a11-e307-4ec9-9099-091a87ff1d3b?source=cve
CVE: CVE-2023-0717
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/35fb658f-6ffa-4df7-bfcd-25307d89fc26?source=cve
CVE: CVE-2023-0720
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_order function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/8d392d0b-f286-44da-aa32-a08d0279baed?source=cve
CVE: CVE-2023-0722
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_state function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/261a1bf0-a147-48c8-878e-f9b725ac74d8?source=cve
CVE: CVE-2023-0724
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_add_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/08c0ea6c-7e2f-482f-b30c-0e3bcd992159?source=cve
CVE: CVE-2023-0725
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_clone_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/80797183-c69f-4dce-a2e0-52a395ceffaa?source=cve
CVE: CVE-2023-0726
Published: 2023-02-08
Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_edit_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/51b88442-3961-42e2-8ff4-7726819a7f0f?source=cve
CVE: CVE-2023-0739
Published: 2023-02-08
Description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1.0.4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://github.com/answerdev/answer/commit/1ee34b884b905d14d4db457563176b77a974b992; https://huntr.dev/bounties/93d7fac9-50be-4624-9096-45b89fbfd4ae; https://github.com/answerdev/answer/commit/1ee34b884b905d14d4db457563176b77a974b992
CVE: CVE-2023-0740
Published: 2023-02-08
Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/c3001de52af91f09c96e701facbce0b9fa0c98ad; https://huntr.dev/bounties/802ee76d-fe01-482b-a9a4-34699a7c9110; https://github.com/answerdev/answer/commit/c3001de52af91f09c96e701facbce0b9fa0c98ad
CVE: CVE-2023-0741
Published: 2023-02-08
Description: Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/c3001de52af91f09c96e701facbce0b9fa0c98ad; https://huntr.dev/bounties/78233bfa-871d-45e1-815f-dee73e397809; https://github.com/answerdev/answer/commit/c3001de52af91f09c96e701facbce0b9fa0c98ad
CVE: CVE-2023-0742
Published: 2023-02-08
Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/c3001de52af91f09c96e701facbce0b9fa0c98ad; https://huntr.dev/bounties/d73a2c03-7035-453b-9c04-c733ace65544; https://github.com/answerdev/answer/commit/c3001de52af91f09c96e701facbce0b9fa0c98ad
CVE: CVE-2023-0743
Published: 2023-02-08
Description: Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/answerdev/answer/commit/860b1a3bd8cfaa8827e6e6f50ab1d98fa4c2c816; https://huntr.dev/bounties/366cf8bb-19f6-4388-b089-d0a260efd863; https://github.com/answerdev/answer/commit/860b1a3bd8cfaa8827e6e6f50ab1d98fa4c2c816
CVE: CVE-2023-0744
Published: 2023-02-08
Description: Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://packetstormsecurity.com/files/171733/Answerdev-1.0.3-Account-Takeover.html; https://github.com/answerdev/answer/commit/c1fa2b13f6b547b96da60b23350bbe2b29de542d; https://huntr.dev/bounties/35a0e12f-1d54-4fc0-8779-6a4949b7c434
CVE: CVE-2022-2094
Published: 2023-02-08
Description: The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/c9a106e1-29ae-47ad-907b-01086af3d3fb; https://wpscan.com/vulnerability/c9a106e1-29ae-47ad-907b-01086af3d3fb
CVE: CVE-2022-43761
Published: 2023-02-08
Description: Missing authentication when creating and
managing the B&R APROL database in versions < R 4.2-07



allows reading and changing the system configuration. 








CVSS Score: 9.4 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]45-en-original-1.0.pdf; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]45-en-original-1.0.pdf
CVE: CVE-2022-43762
Published: 2023-02-08
Description:  Lack of verification in B&R APROL
Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages




CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]45-en-original-1.0.pdf; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]45-en-original-1.0.pdf
CVE: CVE-2022-43763
Published: 2023-02-08
Description: Insufficient check of preconditions could lead
to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07.








CVSS Score: 7.5 (HIGH)
CWE: CWE-252, CWE-252
References: https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]45-en-original-1.0.pdf; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]45-en-original-1.0.pdf
CVE: CVE-2022-43764
Published: 2023-02-08
Description: Insufficient validation of input parameters when
changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer
overflow. This may lead to Denial-of-Service conditions or execution of
arbitrary code.








CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]45-en-original-1.0.pdf; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]45-en-original-1.0.pdf
CVE: CVE-2022-43765
Published: 2023-02-08
Description: B&R APROL versions < R 4.2-07 doesn’t process correctly specially
formatted data packages sent to port 55502/tcp, which may allow a network based
attacker to cause an application Denial-of-Service.








CVSS Score: 7.5 (HIGH)
CWE: CWE-252, CWE-252
References: https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]45-en-original-1.0.pdf; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]45-en-original-1.0.pdf
CVE: CVE-2022-41620
Published: 2023-02-08
Description: Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/seosamba-webmasters/wordpress-seosamba-for-wordpress-webmasters-plugin-1-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seosamba-webmasters/wordpress-seosamba-for-wordpress-webmasters-plugin-1-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-0747
Published: 2023-02-08
Description: Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/btcpayserver/btcpayserver/pull/4567/commits/d4e464ad4ef0cbbf61751e70f77865de325dd6cf; https://huntr.dev/bounties/7830b9b4-af2e-44ef-8b00-ee2491d4e7ff; https://github.com/btcpayserver/btcpayserver/pull/4567/commits/d4e464ad4ef0cbbf61751e70f77865de325dd6cf
CVE: CVE-2023-0748
Published: 2023-02-08
Description: Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.


CVSS Score: 6.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/btcpayserver/btcpayserver/pull/4575/commits/c2cfa17e9619046b43987627b8429541d2834109; https://huntr.dev/bounties/1a0403b6-9ec9-4587-b559-b1afba798c86; https://github.com/btcpayserver/btcpayserver/pull/4575/commits/c2cfa17e9619046b43987627b8429541d2834109
CVE: CVE-2023-0001
Published: 2023-02-08
Description: An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://security.paloaltonetworks.com/CVE-2023-0001; https://security.paloaltonetworks.com/CVE-2023-0001
CVE: CVE-2023-0002
Published: 2023-02-08
Description: A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-693
References: https://security.paloaltonetworks.com/CVE-2023-0002; https://security.paloaltonetworks.com/CVE-2023-0002
CVE: CVE-2023-0003
Published: 2023-02-08
Description: A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73, CWE-610
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
CVE: CVE-2022-34362
Published: 2023-02-08
Description: 
IBM Sterling Secure Proxy 6.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 230523.


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230523; https://www.ibm.com/support/pages/node/6890663; https://exchange.xforce.ibmcloud.com/vulnerabilities/230523
CVE: CVE-2022-35720
Published: 2023-02-08
Description: IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation that could allow a local attacker to decrypt sensitive information.  IBM X-Force ID:  231373.
CVSS Score: 2.3 (LOW)
CWE: CWE-327
References: https://www.ibm.com/support/pages/node/6890663; https://www.ibm.com/support/pages/node/6890669; https://www.ibm.com/support/pages/node/6890663
CVE: CVE-2022-42438
Published: 2023-02-08
Description: IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths.  IBM X-Force ID:  238210.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238210; https://www.ibm.com/support/pages/node/6909427; https://exchange.xforce.ibmcloud.com/vulnerabilities/238210
CVE: CVE-2022-45526
Published: 2023-02-08
Description: SQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arbitrary commands via the ad parameter to /admin_area/login_transfer.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Future-Depth/IMS/issues/1; https://github.com/Future-Depth/IMS/issues/1
CVE: CVE-2022-45527
Published: 2023-02-08
Description: File upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows unauthorized attackers to directly upload malicious files to the courseimg directory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/Future-Depth/IMS/issues/2; https://github.com/Future-Depth/IMS/issues/2
CVE: CVE-2022-45755
Published: 2023-02-08
Description: Cross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the basic information page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/39; https://github.com/weng-xianhu/eyoucms/issues/39
CVE: CVE-2023-0690
Published: 2023-02-08
Description: HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the credentials being stored in plaintext on the Boundary PKI worker’s disk.

This issue is fixed in version 0.12.0.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-312, CWE-311
References: https://discuss.hashicorp.com/t/hcsec-2023-03-boundary-workers-store-rotated-credentials-in-plaintext-even-when-key-management-service-configured/49907; https://discuss.hashicorp.com/t/hcsec-2023-03-boundary-workers-store-rotated-credentials-in-plaintext-even-when-key-management-service-configured/49907
CVE: CVE-2023-23475
Published: 2023-02-08
Description: IBM Infosphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  245423.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.ibm.com/support/pages/node/6890711; https://www.ibm.com/support/pages/node/6890711