deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-37566
Published: 2023-07-13
Description: Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A v1.24 and earlier, WRC-1167FEBK-A v1.18 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, and LAN-W301NR all versions.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://jvn.jp/en/vu/JVNVU91850798/; https://www.elecom.co.jp/news/security/20230711-01/; https://www.elecom.co.jp/news/security/20230810-01/
CVE: CVE-2023-37567
Published: 2023-07-13
Description: Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A v1.24 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, and LAN-W301NR all versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://jvn.jp/en/vu/JVNVU91850798/; https://www.elecom.co.jp/news/security/20230711-01/; https://www.elecom.co.jp/news/security/20230810-01/
CVE: CVE-2023-37568
Published: 2023-07-13
Description: ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://jvn.jp/en/vu/JVNVU91850798/; https://www.elecom.co.jp/news/security/20230711-01/; https://jvn.jp/en/vu/JVNVU91850798/
CVE: CVE-2023-38197
Published: 2023-07-13
Description: An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://codereview.qt-project.org/c/qt/qtbase/+/488960; https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html; https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
CVE: CVE-2023-2200
Published: 2023-07-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-116, CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/408281; https://hackerone.com/reports/1935628; https://gitlab.com/gitlab-org/gitlab/-/issues/408281
CVE: CVE-2023-2576
Published: 2023-07-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected branch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/410123; https://hackerone.com/reports/1898054; https://gitlab.com/gitlab-org/gitlab/-/issues/410123
CVE: CVE-2023-2620
Published: 2023-07-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions. This addresses an incomplete fix for CVE-2023-0838.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-201
References: https://gitlab.com/gitlab-org/gitlab/-/issues/410433; https://hackerone.com/reports/1976206; https://gitlab.com/gitlab-org/gitlab/-/issues/410433
CVE: CVE-2023-34131
Published: 2023-07-13
Description: Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restricted web pages. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010; https://www.sonicwall.com/support/notices/[PII_REDACTED]18060; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
CVE: CVE-2023-34132
Published: 2023-07-13
Description: Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-836
References: http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010; https://www.sonicwall.com/support/notices/[PII_REDACTED]18060
CVE: CVE-2023-34133
Published: 2023-07-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010; https://www.sonicwall.com/support/notices/[PII_REDACTED]18060
CVE: CVE-2023-34134
Published: 2023-07-13
Description: Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator password hash via a web service call. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010; https://www.sonicwall.com/support/notices/[PII_REDACTED]18060; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
CVE: CVE-2023-34135
Published: 2023-07-13
Description: Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via web service. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-36, CWE-22
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010; https://www.sonicwall.com/support/notices/[PII_REDACTED]18060; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
CVE: CVE-2023-34136
Published: 2023-07-13
Description: Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010; https://www.sonicwall.com/support/notices/[PII_REDACTED]18060; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
CVE: CVE-2023-34137
Published: 2023-07-13
Description: SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305, CWE-287
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010; https://www.sonicwall.com/support/notices/[PII_REDACTED]18060; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
CVE: CVE-2023-37562
Published: 2023-07-13
Description: Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN05223215/; https://www.elecom.co.jp/news/security/20230711-01/; https://jvn.jp/en/jp/JVN05223215/
CVE: CVE-2023-37563
Published: 2023-07-13
Description: ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtain sensitive information. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, WRC-1167FEBK-A v1.18 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1467GHBK-S all versions, WRC-1900GHBK-A all versions, and WRC-1900GHBK-S all versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922
References: https://jvn.jp/en/jp/JVN05223215/; https://www.elecom.co.jp/news/security/20230711-01/; https://www.elecom.co.jp/news/security/20230810-01/
CVE: CVE-2023-38198
Published: 2023-07-13
Description: acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2023/07/13/1; https://github.com/acmesh-official/acme.sh/issues/4659; https://github.com/acmesh-official/acme.sh/releases/tag/3.0.6
CVE: CVE-2023-38199
Published: 2023-07-13
Description: coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://github.com/coreruleset/coreruleset/issues/3191; https://github.com/coreruleset/coreruleset/pull/3237; https://github.com/coreruleset/coreruleset/issues/3191
CVE: CVE-2023-3342
Published: 2023-07-13
Description: The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in version 3.0.2 and fully patched in version 3.0.2.1.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://lana.codes/lanavdb/c0a58dff-7a5b-4cc0-82d6-2255e61d801c/; https://plugins.trac.wordpress.org/browser/user-registration/tags/3.0.1/includes/functions-ur-core.php#L3156; https://plugins.trac.wordpress.org/changeset/2933689/user-registration/trunk/includes/functions-ur-core.php
CVE: CVE-2023-3343
Published: 2023-07-13
Description: The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input from the 'profile-pic-url' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/user-registration/tags/3.0.1/includes/functions-ur-core.php#L3156; https://plugins.trac.wordpress.org/changeset/2932199/user-registration/trunk/includes/functions-ur-core.php#file0; https://www.wordfence.com/threat-intel/vulnerabilities/id/3590277a-3319-4707-b728-d75ea59e8ad9?source=cve
CVE: CVE-2023-3362
Published: 2023-07-13
Description: An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://gitlab.com/gitlab-org/gitlab/-/issues/415131; https://gitlab.com/gitlab-org/gitlab/-/issues/415131
CVE: CVE-2023-3363
Published: 2023-07-13
Description: An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`.
CVSS Score: 3.9 (LOW)
CWE: CWE-532, CWE-532
References: https://gitlab.com/gitlab-org/gitlab/-/issues/409034; https://gitlab.com/gitlab-org/gitlab/-/issues/409034
CVE: CVE-2023-3424
Published: 2023-07-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/gitlab/-/issues/409802; https://hackerone.com/reports/1960970; https://gitlab.com/gitlab-org/gitlab/-/issues/409802
CVE: CVE-2023-3444
Published: 2023-07-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/406803; https://hackerone.com/reports/1928709; https://gitlab.com/gitlab-org/gitlab/-/issues/406803
CVE: CVE-2023-37564
Published: 2023-07-13
Description: OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a root privilege by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, and WRC-1167FEBK-A v1.18 and earlier.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN05223215/; https://www.elecom.co.jp/news/security/20230711-01/; https://jvn.jp/en/jp/JVN05223215/
CVE: CVE-2023-37565
Published: 2023-07-13
Description: Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, and WRC-1167FEBK-A v1.18 and earlier.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://jvn.jp/en/jp/JVN05223215/; https://www.elecom.co.jp/news/security/20230711-01/; https://jvn.jp/en/jp/JVN05223215/
CVE: CVE-2023-1547
Published: 2023-07-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Elra Parkmatik allows SQL Injection through SOAP Parameter Tampering, Command Line Execution through SQL Injection.This issue affects Parkmatik: before 02.01-a51.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0404; https://www.usom.gov.tr/bildirim/tr-23-0404
CVE: CVE-2023-2957
Published: 2023-07-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisa Software Florist Site allows SQL Injection.This issue affects Florist Site: before 3.0.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0403; https://www.usom.gov.tr/bildirim/tr-23-0403
CVE: CVE-2023-35069
Published: 2023-07-13
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bullwark allows Path Traversal.This issue affects Bullwark: before BLW-2016E-960H.


CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.usom.gov.tr/bildirim/tr-23-0401; https://www.usom.gov.tr/bildirim/tr-23-0401
CVE: CVE-2023-37415
Published: 2023-07-13
Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider.

Patching on top of CVE-2023-35797
Before 6.1.2 the proxy_user option can also inject semicolon.

This issue affects Apache Airflow Apache Hive Provider: before 6.1.2.

It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2023/07/12/3; https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k; http://www.openwall.com/lists/oss-security/2023/07/12/3
CVE: CVE-2023-3319
Published: 2023-07-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iDisplay PlatPlay DS allows Stored XSS.This issue affects PlatPlay DS: before 3.14.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0402; https://www.usom.gov.tr/bildirim/tr-23-0402
CVE: CVE-2023-29449
Published: 2023-07-13
Description: JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access. 
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://support.zabbix.com/browse/ZBX-22589; https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html; https://support.zabbix.com/browse/ZBX-22589
CVE: CVE-2023-29450
Published: 2023-07-13
Description: JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
CVSS Score: 8.5 (HIGH)
CWE: CWE-200, CWE-552, CWE-552
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html; https://support.zabbix.com/browse/ZBX-22588; https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE: CVE-2023-29451
Published: 2023-07-13
Description: Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20, CWE-787
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html; https://support.zabbix.com/browse/ZBX-22587; https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE: CVE-2023-29452
Published: 2023-07-13
Description: 
Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://support.zabbix.com/browse/ZBX-22981; https://support.zabbix.com/browse/ZBX-22981
CVE: CVE-2023-29454
Published: 2023-07-13
Description: Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html; https://support.zabbix.com/browse/ZBX-22985; https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE: CVE-2023-29455
Published: 2023-07-13
Description: Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html; https://support.zabbix.com/browse/ZBX-22986; https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE: CVE-2023-29456
Published: 2023-07-13
Description: URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html; https://support.zabbix.com/browse/ZBX-22987; https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE: CVE-2023-29457
Published: 2023-07-13
Description: Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html; https://support.zabbix.com/browse/ZBX-22988; https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE: CVE-2023-29458
Published: 2023-07-13
Description: Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-129, CWE-129
References: https://support.zabbix.com/browse/ZBX-22989; https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html; https://support.zabbix.com/browse/ZBX-22989
CVE: CVE-2023-3657
Published: 2023-07-13
Description: A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. This issue affects some unknown processing of the file Master.php?f=save_book of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-234011.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234011; https://vuldb.com/?id.234011; https://vuldb.com/?ctiid.234011
CVE: CVE-2023-22435
Published: 2023-07-13
Description: Experion server may experience a DoS due to a stack overflow when handling a specially crafted message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697, CWE-787
References: https://process.honeywell.com; https://process.honeywell.com
CVE: CVE-2023-23585
Published: 2023-07-13
Description: Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. 

See Honeywell Security Notification for recommendations on upgrading and versioning. 


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://process.honeywell.com; https://process.honeywell.com