deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-36703
Published: 2023-10-10
Description: DHCP Server Service Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36703; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36703
CVE: CVE-2023-36704
Published: 2023-10-10
Description: Windows Setup Files Cleanup Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36704; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36704
CVE: CVE-2023-36706
Published: 2023-10-10
Description: Windows Deployment Services Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36706; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36706
CVE: CVE-2023-36707
Published: 2023-10-10
Description: Windows Deployment Services Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36707; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36707
CVE: CVE-2023-36709
Published: 2023-10-10
Description: Microsoft AllJoyn API Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36709; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36709
CVE: CVE-2023-36710
Published: 2023-10-10
Description: Windows Media Foundation Core Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-197
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36710; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36710
CVE: CVE-2023-36711
Published: 2023-10-10
Description: Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36711; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36711
CVE: CVE-2023-36712
Published: 2023-10-10
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36712; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36712
CVE: CVE-2023-36713
Published: 2023-10-10
Description: Windows Common Log File System Driver Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36713; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36713
CVE: CVE-2023-36717
Published: 2023-10-10
Description: Windows Virtual Trusted Platform Module Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36717; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36717
CVE: CVE-2023-36718
Published: 2023-10-10
Description: Microsoft Virtual Trusted Platform Module Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36718; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36718
CVE: CVE-2023-36720
Published: 2023-10-10
Description: Windows Mixed Reality Developer Tools Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36720; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36720
CVE: CVE-2023-36721
Published: 2023-10-10
Description: Windows Error Reporting Service Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36721; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36721
CVE: CVE-2023-36722
Published: 2023-10-10
Description: Active Directory Domain Services Information Disclosure Vulnerability
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36722; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36722
CVE: CVE-2023-36723
Published: 2023-10-10
Description: Windows Container Manager Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36723; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36723
CVE: CVE-2023-36724
Published: 2023-10-10
Description: Windows Power Management Service Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36724; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36724
CVE: CVE-2023-36725
Published: 2023-10-10
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36725; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36725
CVE: CVE-2023-36726
Published: 2023-10-10
Description: Windows Internet Key Exchange (IKE) Extension Elevation of Privilege  Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36726; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36726
CVE: CVE-2023-36728
Published: 2023-10-10
Description: Microsoft SQL Server Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36728; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36728
CVE: CVE-2023-36729
Published: 2023-10-10
Description: Named Pipe File System Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36729; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36729
CVE: CVE-2023-36730
Published: 2023-10-10
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36730; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36730
CVE: CVE-2023-36731
Published: 2023-10-10
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36731; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36731
CVE: CVE-2023-36732
Published: 2023-10-10
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36732; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36732
CVE: CVE-2023-36737
Published: 2023-10-10
Description: Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36737; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36737
CVE: CVE-2023-36743
Published: 2023-10-10
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36743; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36743
CVE: CVE-2023-36776
Published: 2023-10-10
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36776; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36776
CVE: CVE-2023-36778
Published: 2023-10-10
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36778; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36778
CVE: CVE-2023-36780
Published: 2023-10-10
Description: Skype for Business Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780
CVE: CVE-2023-36785
Published: 2023-10-10
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36785; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36785
CVE: CVE-2023-36786
Published: 2023-10-10
Description: Skype for Business Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-36
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36786; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36786
CVE: CVE-2023-36789
Published: 2023-10-10
Description: Skype for Business Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36789; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36789
CVE: CVE-2023-36790
Published: 2023-10-10
Description: Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36790; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36790
CVE: CVE-2023-36902
Published: 2023-10-10
Description: Windows Runtime Remote Code Execution Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36902; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36902
CVE: CVE-2023-38159
Published: 2023-10-10
Description: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-591, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38159; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38159
CVE: CVE-2023-38166
Published: 2023-10-10
Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38166; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38166
CVE: CVE-2023-38171
Published: 2023-10-10
Description: Microsoft QUIC Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38171; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38171
CVE: CVE-2023-41763
Published: 2023-10-10
Description: Skype for Business Elevation of Privilege Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763
CVE: CVE-2023-41765
Published: 2023-10-10
Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41765; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41765
CVE: CVE-2023-41766
Published: 2023-10-10
Description: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41766; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41766
CVE: CVE-2023-41767
Published: 2023-10-10
Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41767; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41767
CVE: CVE-2023-41768
Published: 2023-10-10
Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41768; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41768
CVE: CVE-2023-41769
Published: 2023-10-10
Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41769; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41769
CVE: CVE-2023-41770
Published: 2023-10-10
Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41770; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41770
CVE: CVE-2023-41771
Published: 2023-10-10
Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41771; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41771
CVE: CVE-2023-41772
Published: 2023-10-10
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41772; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41772
CVE: CVE-2023-41773
Published: 2023-10-10
Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41773; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41773
CVE: CVE-2023-41774
Published: 2023-10-10
Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41774; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41774
CVE: CVE-2023-42794
Published: 2023-10-10
Description: Incomplete Cleanup vulnerability in Apache Tomcat.

The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, 
in progress refactoring that exposed a potential denial of service on 
Windows if a web application opened a stream for an uploaded file but 
failed to close the stream. The file would never be deleted from disk 
creating the possibility of an eventual denial of service due to the 
disk being full.

Other, EOL versions may also be affected.


Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-459
References: https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82; http://www.openwall.com/lists/oss-security/2023/10/10/8; https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82
CVE: CVE-2023-42795
Published: 2023-10-10
Description: Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could 
cause Tomcat to skip some parts of the recycling process leading to 
information leaking from the current request/response to the next.
Older, EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-459
References: https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw; http://www.openwall.com/lists/oss-security/2023/10/10/9; https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw
CVE: CVE-2023-45129
Published: 2023-10-10
Description: Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected. Server administrators are advised to upgrade to Synapse 1.94.0 or later. As a workaround, rooms with malicious server ACL events can be purged and blocked using the admin API.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/matrix-org/synapse/pull/16360; https://github.com/matrix-org/synapse/security/advisories/GHSA-5chr-wjw5-3gq4; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEVRB4MG5UXQ5RLZHSUJXM5GWEBYYS5B/
CVE: CVE-2023-4309
Published: 2023-10-10
Description: Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused elections and enabled web application firewall (WAF) protection for current and future elections on or around 2023-08-12.

CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://schemasecurity.co/private-elections.pdf; https://www.electionservicesco.com/pages/services_internet.php; https://www.youtube.com/watch?v=yeG1xZkHc64
CVE: CVE-2023-5497
Published: 2023-10-10
Description: A vulnerability classified as critical has been found in Tongda OA 2017 11.10. Affected is an unknown function of the file general/hr/salary/welfare_manage/delete.php. The manipulation of the argument WELFARE_ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-241650 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/RCEraser/cve/blob/main/sql_inject_4.md; https://vuldb.com/?ctiid.241650; https://vuldb.com/?id.241650
CVE: CVE-2023-31096
Published: 2023-10-10
Description: An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). There is Local Privilege Escalation to SYSTEM via a Stack Overflow in RTLCopyMemory (IOCTL 0x1b2150). An attacker can exploit this to elevate privileges from a medium-integrity process to SYSTEM. This can also be used to bypass kernel-level protections such as AV or PPL, because exploit code runs with high-integrity privileges and can be used in coordinated BYOVD (bring your own vulnerable driver) ransomware campaigns.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cschwarz1.github.io/posts/0x04/; https://www.broadcom.com; https://cschwarz1.github.io/posts/0x04/
CVE: CVE-2023-45648
Published: 2023-10-10
Description: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially 
crafted, invalid trailer header could cause Tomcat to treat a single 
request as multiple requests leading to the possibility of request 
smuggling when behind a reverse proxy.

Older, EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp; http://www.openwall.com/lists/oss-security/2023/10/10/10; https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp
CVE: CVE-2023-45312
Published: 2023-10-10
Description: In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1188, CWE-1188
References: https://medium.com/%40_sadshade/almost-2000-telegram-proxy-servers-are-potentially-vulnerable-to-rce-since-2018-742a455be16b; https://medium.com/%40_sadshade/almost-2000-telegram-proxy-servers-are-potentially-vulnerable-to-rce-since-2018-742a455be16b
CVE: CVE-2023-36126
Published: 2023-10-10
Description: There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4; https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4
CVE: CVE-2023-36127
Published: 2023-10-10
Description: User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4; https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4
CVE: CVE-2023-26220
Published: 2023-10-10
Description: The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2023-44689
Published: 2023-10-11
Description: e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://jvn.jp/en/jp/JVN15808274/; https://shinsei.e-gov.go.jp/contents/news/2023-03-12t[PII_REDACTED]_1318.html; https://jvn.jp/en/jp/JVN15808274/
CVE: CVE-2023-45194
Published: 2023-10-11
Description: Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-798
References: https://jvn.jp/en/vu/JVNVU99039725/; https://www.mrl.co.jp/20231005_security/; https://jvn.jp/en/vu/JVNVU99039725/
CVE: CVE-2023-5511
Published: 2023-10-11
Description: Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/snipe/snipe-it/commit/6d55d782806c9660e9e65dc5250faacb5d0033ed; https://huntr.dev/bounties/43[PII_REDACTED]-48da-b379-e55e341d78bf; https://github.com/snipe/snipe-it/commit/6d55d782806c9660e9e65dc5250faacb5d0033ed