deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-44187
Published: 2023-10-11
Description: An Exposure of Sensitive Information vulnerability in the 'file copy' command of Junos OS Evolved allows a local, authenticated attacker with shell access to view passwords supplied on the CLI command-line. These credentials can then be used to provide unauthorized access to the remote system.

This issue affects Juniper Networks Junos OS Evolved:
  *  All versions prior to 20.4R3-S7-EVO;
  *  21.1 versions 21.1R1-EVO and later;
  *  21.2 versions prior to 21.2R3-S5-EVO;
  *  21.3 versions prior to 21.3R3-S4-EVO;
  *  21.4 versions prior to 21.4R3-S4-EVO;
  *  22.1 versions prior to 22.1R3-S2-EVO;
  *  22.2 versions prior to 22.2R2-EVO.



CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://supportportal.juniper.net/JSA73151; https://supportportal.juniper.net/JSA73151
CVE: CVE-2023-44188
Published: 2023-10-11
Description: 
A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in telemetry processing of Juniper Networks Junos OS allows a network-based authenticated attacker to flood the system with multiple telemetry requests, causing the Junos Kernel Debugging Streaming Daemon (jkdsd) process to crash, leading to a Denial of Service (DoS). Continued receipt and processing of telemetry requests will repeatedly crash the jkdsd process and sustain the Denial of Service (DoS) condition.

This issue is seen on all Junos platforms. The crash is triggered when multiple telemetry requests come from different collectors. As the load increases, the Dynamic Rendering Daemon (drend) decides to defer processing and continue later, which results in a timing issue accessing stale memory, causing the jkdsd process to crash and restart.

Note: jkdsd is not shipped with SRX Series devices and therefore are not affected by this vulnerability.
This issue affects:

Juniper Networks Junos OS:



  *  20.4 versions prior to 20.4R3-S9;
  *  21.1 versions 21.1R1 and later;
  *  21.2 versions prior to 21.2R3-S6;
  *  21.3 versions prior to 21.3R3-S5;
  *  21.4 versions prior to 21.4R3-S5;
  *  22.1 versions prior to 22.1R3-S4;
  *  22.2 versions prior to 22.2R3-S2;
  *  22.3 versions prior to 22.3R2-S1, 22.3R3-S1;
  *  22.4 versions prior to 22.4R2-S2, 22.4R3;
  *  23.1 versions prior to 23.1R2.




This issue does not affect Juniper Networks Junos OS versions prior to 19.4R1.




CVSS Score: 5.3 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://supportportal.juniper.net/JSA73152; https://supportportal.juniper.net/JSA73152
CVE: CVE-2023-45132
Published: 2023-10-11
Description: NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious `X-Forwarded-For` IP matches `IgnoreIP` `IgnoreCIDR` rules. This old code was arranged to allow older NGINX versions to also support `IgnoreIP` `IgnoreCIDR` when multiple reverse proxies were present. The issue is patched in version 1.6. As a workaround, do not set any `IgnoreIP` `IgnoreCIDR` for older versions.

CVSS Score: 9.1 (CRITICAL)
CWE: CWE-693
References: https://github.com/wargio/naxsi/commit/1b712526ed3314dd6be7e8b0259eabda63c19537; https://github.com/wargio/naxsi/pull/103; https://github.com/wargio/naxsi/security/advisories/GHSA-7qjc-q4j9-pc8x
CVE: CVE-2023-39325
Published: 2023-10-11
Description: A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://go.dev/cl/534215; https://go.dev/cl/534235; https://go.dev/issue/63417
CVE: CVE-2023-44189
Published: 2023-10-11
Description: 
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.

This issue affects Juniper Networks Junos OS Evolved on PTX10003 Series:



  *  All versions prior to 21.4R3-S4-EVO;
  *  22.1 versions prior to 22.1R3-S3-EVO;
  *  22.2 version 22.2R1-EVO and later versions;
  *  22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
  *  22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
  *  23.2 versions prior to 23.2R2-EVO.







CVSS Score: 6.1 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://supportportal.juniper.net/JSA73153; https://supportportal.juniper.net/JSA73153
CVE: CVE-2023-44190
Published: 2023-10-11
Description: 
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.

This issue affects Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016:



  *  All versions prior to 21.4R3-S5-EVO;
  *  22.1 versions prior to 22.1R3-S4-EVO;
  *  22.2 versions 22.2R1-EVO and later;
  *  22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
  *  22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
  *  23.2 versions prior to 23.2R1-S1-EVO, 23.2R2-EVO.







CVSS Score: 6.1 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://supportportal.juniper.net/JSA73154; https://supportportal.juniper.net/JSA73154
CVE: CVE-2023-5218
Published: 2023-10-11
Description: Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1487110; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
CVE: CVE-2023-5473
Published: 2023-10-11
Description: Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1484000; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-5474
Published: 2023-10-11
Description: Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1483194; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-5475
Published: 2023-10-11
Description: Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1476952; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
CVE: CVE-2023-5476
Published: 2023-10-11
Description: Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1474253; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-5477
Published: 2023-10-11
Description: Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control via a crafted command. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1472558; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-5478
Published: 2023-10-11
Description: Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1472404; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-5479
Published: 2023-10-11
Description: Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1471253; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-5481
Published: 2023-10-11
Description: Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1458934; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-5483
Published: 2023-10-11
Description: Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1425355; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-5484
Published: 2023-10-11
Description: Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1414936; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
CVE: CVE-2023-5485
Published: 2023-10-11
Description: Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1395164; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-5486
Published: 2023-10-11
Description: Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1357442; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-5487
Published: 2023-10-11
Description: Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html; https://crbug.com/1062251; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
CVE: CVE-2023-1943
Published: 2023-10-12
Description: Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode.

CVSS Score: 8.0 (HIGH)
CWE: CWE-250
References: https://github.com/kubernetes/kops/issues/15539; https://groups.google.com/g/kubernetes-security-announce/c/yrCE1x89oaU; https://github.com/kubernetes/kops/issues/15539
CVE: CVE-2023-42298
Published: 2023-10-12
Description: An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of file src/bifs/unquantize.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/gpac/gpac/issues/2567; https://github.com/gpac/gpac/issues/2567
CVE: CVE-2023-40829
Published: 2023-10-12
Description: There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://gist.github.com/wwwziziyu/85bdf8d56b415974c4827a5668f493e9; https://gist.github.com/wwwziziyu/85bdf8d56b415974c4827a5668f493e9
CVE: CVE-2023-44793
Published: 2023-10-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-29453
Published: 2023-10-12
Description: Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g., "var a = {{.}}"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template. Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://support.zabbix.com/browse/ZBX-23388; https://support.zabbix.com/browse/ZBX-23388
CVE: CVE-2023-40833
Published: 2023-10-12
Description: An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/Sholway/93f05987dbf35c15c26de32b1e5590ec; https://gist.github.com/Sholway/93f05987dbf35c15c26de32b1e5590ec
CVE: CVE-2023-5531
Published: 2023-10-12
Description: The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the delete functionality. This makes it possible for unauthenticated attackers to delete image lightboxes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1263536%40wp-responsive-slider-with-lightbox&new=1263536%40wp-responsive-slider-with-lightbox&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wp-responsive-slider-with-lightbox/; https://www.wordfence.com/threat-intel/vulnerabilities/id/055b7ed5-268a-485e-ac7d-8082dc9fb2ad?source=cve
CVE: CVE-2023-32721
Published: 2023-10-12
Description: A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20, CWE-79
References: https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html; https://support.zabbix.com/browse/ZBX-23389; https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html
CVE: CVE-2023-32722
Published: 2023-10-12
Description: The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://support.zabbix.com/browse/ZBX-23390; https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html; https://support.zabbix.com/browse/ZBX-23390
CVE: CVE-2023-32723
Published: 2023-10-12
Description: Request to LDAP is sent before user permissions are checked.
CVSS Score: 8.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html; https://support.zabbix.com/browse/ZBX-23230; https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html
CVE: CVE-2023-32724
Published: 2023-10-12
Description: Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732, CWE-732
References: https://support.zabbix.com/browse/ZBX-23391; https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html; https://support.zabbix.com/browse/ZBX-23391
CVE: CVE-2023-5470
Published: 2023-10-12
Description: The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/etsy-shop/tags/3.0.4/etsy-shop.php#L417; https://plugins.trac.wordpress.org/browser/etsy-shop/tags/3.0.4/etsy-shop.php#L94; https://plugins.trac.wordpress.org/changeset/2977260/etsy-shop#file1
CVE: CVE-2023-45047
Published: 2023-10-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in LeadSquared, Inc LeadSquared Suite plugin <= 0.7.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/leadsquared-suite/wordpress-leadsquared-suite-plugin-0-7-4-cross-site-request-forgery-csrf-leading-to-form-deactivation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/leadsquared-suite/wordpress-leadsquared-suite-plugin-0-7-4-cross-site-request-forgery-csrf-leading-to-form-deactivation-vulnerability?_s_id=cve
CVE: CVE-2023-5554
Published: 2023-10-12
Description: Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://hackerone.com/reports/2106827; https://hackerone.com/reports/2106827
CVE: CVE-2023-5555
Published: 2023-10-12
Description: Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/frappe/lms/commit/5614a6203fb7d438be8e2b1e3030e4528d170ec4; https://huntr.dev/bounties/f6d688ee-b049-4f85-ac3e-f4d3e29e7b9f; https://github.com/frappe/lms/commit/5614a6203fb7d438be8e2b1e3030e4528d170ec4
CVE: CVE-2023-5556
Published: 2023-10-12
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/structurizr/onpremises/commit/6cff4f792b010dfb1ff6a0b4ae1c6e398f8f8a18; https://huntr.dev/bounties/a3ee0f98-6898-41ae-b1bd-242a03a73d1b; https://github.com/structurizr/onpremises/commit/6cff4f792b010dfb1ff6a0b4ae1c6e398f8f8a18
CVE: CVE-2023-23651
Published: 2023-10-12
Description: Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP Google Analytics Extension plugin <= 4.0.4 versions.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/mainwp-google-analytics-extension/wordpress-mainwp-google-analytics-extension-plugin-4-0-4-subscriber-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mainwp-google-analytics-extension/wordpress-mainwp-google-analytics-extension-plugin-4-0-4-subscriber-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-23737
Published: 2023-10-12
Description: Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP Broken Links Checker Extension plugin <= 4.0 versions.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/mainwp-broken-links-checker-extension/wordpress-mainwp-broken-links-checker-extension-plugin-4-0-unauthenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mainwp-broken-links-checker-extension/wordpress-mainwp-broken-links-checker-extension-plugin-4-0-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-43789
Published: 2023-10-12
Description: A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:2146; https://access.redhat.com/errata/RHSA-2024:2217; https://access.redhat.com/errata/RHSA-2024:2974
CVE: CVE-2023-5045
Published: 2023-10-12
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL Injection, Command Line Execution through SQL Injection.This issue affects Kayisi: before 1286.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0580; https://www.usom.gov.tr/bildirim/tr-23-0580
CVE: CVE-2023-5046
Published: 2023-10-12
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection.This issue affects Procost: before 1390.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0581; https://www.usom.gov.tr/bildirim/tr-23-0581