deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49346
Published: 2023-12-14
Description: Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-377, CWE-668, CWE-668
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49346; https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-rffw-gg7p-5688; https://ubuntu.com/security/notices/USN-6556-1
CVE: CVE-2023-49347
Published: 2023-12-14
Description: Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-377, CWE-668, CWE-668
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49347; https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-xxfq-fqfp-cpvj; https://ubuntu.com/security/notices/USN-6556-1
CVE: CVE-2023-6134
Published: 2023-12-14
Description: A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://access.redhat.com/errata/RHSA-2023:7854; https://access.redhat.com/errata/RHSA-2023:7855; https://access.redhat.com/errata/RHSA-2023:7856
CVE: CVE-2023-6702
Published: 2023-12-14
Description: Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html; https://crbug.com/1501326; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/
CVE: CVE-2023-6703
Published: 2023-12-14
Description: Use after free in Blink in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html; https://crbug.com/1502102; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/
CVE: CVE-2023-6704
Published: 2023-12-14
Description: Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html; https://crbug.com/1504792; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/
CVE: CVE-2023-6705
Published: 2023-12-14
Description: Use after free in WebRTC in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html; https://crbug.com/1505708; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/
CVE: CVE-2023-6706
Published: 2023-12-14
Description: Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html; https://crbug.com/1500921; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/
CVE: CVE-2023-6707
Published: 2023-12-14
Description: Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html; https://crbug.com/1504036; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/
CVE: CVE-2023-4489
Published: 2023-12-14
Description: The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-1279, CWE-908
References: https://github.com/SiliconLabs/gecko_sdk; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk
CVE: CVE-2023-48049
Published: 2023-12-15
Description: A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v. 13.0 through 13.0.1.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the name parameter in controllers/main.py component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/luvsn/OdZoo/tree/main/exploits/website_search_blog; https://github.com/luvsn/OdZoo/tree/main/exploits/website_search_blog
CVE: CVE-2023-36878
Published: 2023-12-15
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36878; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36878
CVE: CVE-2023-40954
Published: 2023-12-15
Description: A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/gmarczynski/odoo-web-progress/commit/3c867f1cf7447449c81b1aa24ebb1f7ae757489f; https://github.com/luvsn/OdZoo/tree/main/exploits/web_progress; https://github.com/gmarczynski/odoo-web-progress/commit/3c867f1cf7447449c81b1aa24ebb1f7ae757489f
CVE: CVE-2023-42183
Published: 2023-12-15
Description: lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as when U+1FEF is converted to a backtick.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-116, CWE-116
References: https://github.com/lockss/lockss-daemon/security/advisories/GHSA-mgqj-hphf-9588; https://github.com/lockss/lockss-daemon/security/advisories/GHSA-mgqj-hphf-9588
CVE: CVE-2023-48050
Published: 2023-12-15
Description: SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/luvsn/OdZoo/tree/main/exploits/odoo-biometric-attendance; https://github.com/luvsn/OdZoo/tree/main/exploits/odoo-biometric-attendance
CVE: CVE-2023-6831
Published: 2023-12-15
Description: Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-29, CWE-22
References: https://github.com/mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c1; https://huntr.com/bounties/0acdd745-0167-4912-9d5c-02035fe5b314; https://github.com/mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c1
CVE: CVE-2023-6832
Published: 2023-12-15
Description: Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840
References: https://github.com/microweber/microweber/commit/890e9838aabbc799ebefcf6b20ba25e0fd6dbfee; https://huntr.com/bounties/53105a20-f4b1-45ad-a734-0349de6d7376; https://github.com/microweber/microweber/commit/890e9838aabbc799ebefcf6b20ba25e0fd6dbfee
CVE: CVE-2023-50715
Published: 2023-12-15
Description: Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue.

When starting the Home Assistant 2023.12 release, the login page returns all currently active user accounts to browsing requests from the Local Area Network. Tests showed that this occurs when the request is not authenticated and the request originated locally, meaning on the Home Assistant host local subnet or any other private subnet. The rationale behind this is to make the login more user-friendly and an experience better aligned with other applications that have multiple user-profiles.

However, as a result, all accounts are displayed regardless of them having logged in or not and for any device that navigates to the server. This disclosure is mitigated by the fact that it only occurs for requests originating from a LAN address. But note that this applies to the local subnet where Home Assistant resides and to any private subnet that can reach it.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/home-assistant/core/commit/dbfc5ea8f96bde6cd165892f5a6a6f9a65731c76; https://github.com/home-assistant/core/security/advisories/GHSA-jqpc-rc7g-vf83; https://github.com/home-assistant/core/commit/dbfc5ea8f96bde6cd165892f5a6a6f9a65731c76
CVE: CVE-2023-48371
Published: 2023-12-15
Description: ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.twcert.org.tw/tw/cp-132-7590-55002-1.html; https://www.twcert.org.tw/tw/cp-132-7590-55002-1.html
CVE: CVE-2023-48372
Published: 2023-12-15
Description: ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.twcert.org.tw/tw/cp-132-7591-07c51-1.html; https://www.twcert.org.tw/tw/cp-132-7591-07c51-1.html
CVE: CVE-2023-48373
Published: 2023-12-15
Description: ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7592-998bf-1.html; https://www.twcert.org.tw/tw/cp-132-7592-998bf-1.html
CVE: CVE-2023-48374
Published: 2023-12-15
Description: SmartStar Software CWS is a web-base integration platform, it has a vulnerability of using a hard-coded for a specific account with low privilege. An unauthenticated remote attacker can exploit this vulnerability to run partial processes and obtain partial information, but can't disrupt service or obtain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://www.twcert.org.tw/tw/cp-132-7593-d3e5b-1.html; https://www.twcert.org.tw/tw/cp-132-7593-d3e5b-1.html
CVE: CVE-2023-48375
Published: 2023-12-15
Description: SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform actions that they should not be allowed to perform via commands. An authenticated with normal user privilege can execute administrator privilege, resulting in performing arbitrary system operations or disrupting service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html; https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html
CVE: CVE-2023-48376
Published: 2023-12-15
Description: SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.twcert.org.tw/tw/cp-132-7595-d58b1-1.html; https://www.twcert.org.tw/tw/cp-132-7595-d58b1-1.html
CVE: CVE-2023-48378
Published: 2023-12-15
Description: Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7596-648f3-1.html; https://www.twcert.org.tw/tw/cp-132-7596-648f3-1.html
CVE: CVE-2023-48379
Published: 2023-12-15
Description: Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.twcert.org.tw/tw/cp-132-7597-fff54-1.html; https://www.twcert.org.tw/tw/cp-132-7597-fff54-1.html
CVE: CVE-2023-6826
Published: 2023-12-15
Description: The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/browser/e2pdf/trunk/classes/controller/e2pdf-templates.php?rev=2993824#L1488; https://plugins.trac.wordpress.org/browser/e2pdf/trunk/classes/controller/e2pdf-templates.php?rev=2993824#L753; https://plugins.trac.wordpress.org/changeset/3009695/e2pdf#file0
CVE: CVE-2023-6827
Published: 2023-12-15
Description: The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' function in versions up to, and including, 4.3.5. This makes it possible for authenticated attackers with subscriber-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2023-6140 appears to be a duplicate of this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/browser/essential-real-estate/tags/4.3.5/lib/smart-framework/core/fonts/fonts.class.php#L524; https://plugins.trac.wordpress.org/changeset/3009780/essential-real-estate; https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb2ce22-077b-41dd-a2ff-cc1db9d20d38?source=cve
CVE: CVE-2023-29234
Published: 2023-12-15
Description: A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4.

Users are recommended to upgrade to the latest version, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2023/12/15/2; https://lists.apache.org/thread/wb2df2whkdnbgp54nnqn0m94rllx8f77; http://www.openwall.com/lists/oss-security/2023/12/15/2
CVE: CVE-2023-46279
Published: 2023-12-15
Description: Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5.

Users are recommended to upgrade to the latest version, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2023/12/15/3; https://lists.apache.org/thread/zw53nxrkrfswmk9n3sfwxmcj7x030nmo; http://www.openwall.com/lists/oss-security/2023/12/15/3
CVE: CVE-2023-48380
Published: 2023-12-15
Description: Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html; https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html
CVE: CVE-2023-48381
Published: 2023-12-15
Description: Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7599-461d5-1.html; https://www.twcert.org.tw/tw/cp-132-7599-461d5-1.html
CVE: CVE-2023-48382
Published: 2023-12-15
Description: Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7600-dd072-1.html; https://www.twcert.org.tw/tw/cp-132-7600-dd072-1.html
CVE: CVE-2023-48384
Published: 2023-12-15
Description: ArmorX Global Technology Corporation ArmorX Spam has insufficient validation for user input within a special function. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.twcert.org.tw/tw/cp-132-7601-71c94-1.html; https://www.twcert.org.tw/tw/cp-132-7601-71c94-1.html
CVE: CVE-2023-48387
Published: 2023-12-15
Description: TAIWAN-CA(TWCA) JCICSecurityTool  fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-940
References: https://www.twcert.org.tw/tw/cp-132-7602-a47a2-1.html; https://www.twcert.org.tw/tw/cp-132-7602-a47a2-1.html
CVE: CVE-2023-48388
Published: 2023-12-15
Description: Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.twcert.org.tw/tw/cp-132-7603-b1061-1.html; https://www.twcert.org.tw/tw/cp-132-7603-b1061-1.html
CVE: CVE-2023-48389
Published: 2023-12-15
Description: Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7604-ab0fd-1.html; https://www.twcert.org.tw/tw/cp-132-7604-ab0fd-1.html
CVE: CVE-2023-48390
Published: 2023-12-15
Description: Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code  and access the system to perform arbitrary system operations or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://www.twcert.org.tw/tw/cp-132-7605-2d86d-1.html; https://www.twcert.org.tw/tw/cp-132-7605-2d86d-1.html
CVE: CVE-2023-48392
Published: 2023-12-15
Description: Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, to execute login account’s permissions, and obtain relevant information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321, CWE-798
References: https://www.twcert.org.tw/tw/cp-132-7622-57e5f-1.html; https://www.twcert.org.tw/tw/cp-132-7622-57e5f-1.html
CVE: CVE-2023-48393
Published: 2023-12-15
Description: Kaifa Technology WebITR is an online attendance system. A remote attacker with regular user privilege can obtain partial sensitive system information from error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://www.twcert.org.tw/tw/cp-132-7623-5660d-1.html; https://www.twcert.org.tw/tw/cp-132-7623-5660d-1.html
CVE: CVE-2023-48394
Published: 2023-12-15
Description: Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A remote attacker with regular user privilege can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.twcert.org.tw/tw/cp-132-7624-d0300-1.html; https://www.twcert.org.tw/tw/cp-132-7624-d0300-1.html
CVE: CVE-2023-48395
Published: 2023-12-15
Description: Kaifa Technology WebITR is an online attendance system, it has insufficient validation for user input within a special function. A remote attacker with regular user privilege can exploit this vulnerability to inject arbitrary SQL commands to read database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.twcert.org.tw/tw/cp-132-7625-a0b9c-1.html; https://www.twcert.org.tw/tw/cp-132-7625-a0b9c-1.html
CVE: CVE-2023-6835
Published: 2023-12-15
Description: Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1357/; https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1357/