deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-24867
Published: 2023-03-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24867; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24867
CVE: CVE-2023-24868
Published: 2023-03-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24868; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24868
CVE: CVE-2023-24869
Published: 2023-03-14
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24869; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24869
CVE: CVE-2023-24870
Published: 2023-03-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126, CWE-668
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24870; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24870
CVE: CVE-2023-24871
Published: 2023-03-14
Description: Windows Bluetooth Service Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24871; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24871
CVE: CVE-2023-24872
Published: 2023-03-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24872; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24872
CVE: CVE-2023-24876
Published: 2023-03-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24876; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24876
CVE: CVE-2023-24879
Published: 2023-03-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24879; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24879
CVE: CVE-2023-24880
Published: 2023-03-14
Description: Windows SmartScreen Security Feature Bypass Vulnerability
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24880; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24880; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24880
CVE: CVE-2023-24882
Published: 2023-03-14
Description: Microsoft OneDrive for Android Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24882; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24882
CVE: CVE-2023-24890
Published: 2023-03-14
Description: Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1390
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24890; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24890
CVE: CVE-2023-24891
Published: 2023-03-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24891; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24891
CVE: CVE-2023-24892
Published: 2023-03-14
Description: Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
CVSS Score: 8.2 (HIGH)
CWE: CWE-601, CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24892; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24892
CVE: CVE-2023-24906
Published: 2023-03-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-668
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24906; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24906
CVE: CVE-2023-24907
Published: 2023-03-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24907; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24907
CVE: CVE-2023-24908
Published: 2023-03-14
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24908; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24908
CVE: CVE-2023-24909
Published: 2023-03-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24909; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24909
CVE: CVE-2023-24910
Published: 2023-03-14
Description: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24910; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24910
CVE: CVE-2023-24911
Published: 2023-03-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24911; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24911
CVE: CVE-2023-24913
Published: 2023-03-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24913; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24913
CVE: CVE-2023-24919
Published: 2023-03-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24919; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24919
CVE: CVE-2023-24920
Published: 2023-03-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24920; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24920
CVE: CVE-2023-24921
Published: 2023-03-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24921; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24921
CVE: CVE-2023-24922
Published: 2023-03-14
Description: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-643
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24922; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24922
CVE: CVE-2023-24923
Published: 2023-03-14
Description: Microsoft OneDrive for Android Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24923; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24923
CVE: CVE-2023-24930
Published: 2023-03-14
Description: Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24930; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24930
CVE: CVE-2023-25206
Published: 2023-03-14
Description: PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://addons.prestashop.com/en/customer-reviews/22373-advanced-reviews-photos-reminder-google-snippets.html; https://friends-of-presta.github.io/security-advisories/modules/2023/03/14/ws_productreviews.html; https://addons.prestashop.com/en/customer-reviews/22373-advanced-reviews-photos-reminder-google-snippets.html
CVE: CVE-2023-27585
Published: 2023-03-14
Description: PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-122
References: https://github.com/pjsip/pjproject/commit/d1c5e4da5bae7f220bc30719888bb389c905c0c5; https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4; https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr
CVE: CVE-2023-27588
Published: 2023-03-14
Description: Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-27, CWE-22
References: https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158; https://github.com/hasura/graphql-engine/releases/tag/v1.3.4; https://github.com/hasura/graphql-engine/releases/tag/v2.11.5
CVE: CVE-2023-27589
Published: 2023-03-14
Description: Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via `mc admin policy set`.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://github.com/minio/minio/pull/16803; https://github.com/minio/minio/security/advisories/GHSA-9wfv-wmf7-6753; https://github.com/minio/minio/pull/16803
CVE: CVE-2023-28144
Published: 2023-03-14
Description: KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://github.com/KDAB/hotspot/releases; https://www.openwall.com/lists/oss-security/2023/03/14/8; https://github.com/KDAB/hotspot/releases
CVE: CVE-2023-28339
Published: 2023-03-14
Description: OpenDoas through 6.8.2, when TIOCSTI is available, allows privilege escalation because of sharing a terminal with the original session. NOTE: TIOCSTI is unavailable in OpenBSD 6.0 and later, and can be made unavailable in the Linux kernel 6.2 and later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/Duncaen/OpenDoas/issues/106; https://github.com/Duncaen/OpenDoas/issues/106; https://github.com/Duncaen/OpenDoas/issues/106
CVE: CVE-2023-28343
Published: 2023-03-14
Description: OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/171775/Altenergy-Power-Control-Software-C1.2.5-Command-Injection.html; https://apsystems.com; https://github.com/ahmedalroky/Disclosures/blob/main/apesystems/os_command_injection.md
CVE: CVE-2023-26262
Published: 2023-03-14
Description: An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/istern/CVE-2023-26262; https://www.sitecore.com/trust; https://github.com/istern/CVE-2023-26262
CVE: CVE-2023-26511
Published: 2023-03-14
Description: A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin panel Propiusadmin.php, which allows taking control of the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.propius.de/ms_security.html; https://www.propius.de/ms_security.html
CVE: CVE-2023-27590
Published: 2023-03-14
Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. In version 0.5.1 and prior, converting a GDB registers profile file into a Rizin register profile can result in a stack-based buffer overflow when the `name`, `type`, or `groups` fields have longer values than expected. Users opening untrusted GDB registers files (e.g. with the `drpg` or `arpg` commands) are affected by this flaw. Commit d6196703d89c84467b600ba[PII_REDACTED]dc25ed4 contains a patch for this issue. As a workaround, review the GDB register profiles before loading them with `drpg`/`arpg` commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-121, CWE-787
References: https://github.com/rizinorg/rizin/blob/3a7d5116244beb678ad9950bb9dd27d28ed2691f/librz/reg/profile.c#L514; https://github.com/rizinorg/rizin/blob/3a7d5116244beb678ad9950bb9dd27d28ed2691f/librz/reg/profile.c#L545; https://github.com/rizinorg/rizin/commit/d6196703d89c84467b600ba[PII_REDACTED]dc25ed4
CVE: CVE-2023-1327
Published: 2023-03-14
Description: Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain administrative access to the device's web management interface by resetting the admin password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://drupal9.tenable.com/security/research/tra-2023-10; https://github.com/advisories/GHSA-pvxx-rv48-qw5m; https://drupal9.tenable.com/security/research/tra-2023-10
CVE: CVE-2023-27757
Published: 2023-03-15
Description: An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/perfree/PerfreeBlog/issues/13; https://github.com/perfree/PerfreeBlog/issues/13
CVE: CVE-2023-28371
Published: 2023-03-15
Description: In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/Stellarium/stellarium/commit/1261f74dc4aa6bbd01ab[PII_REDACTED]97f8cf46b7; https://github.com/Stellarium/stellarium/commit/787a894897b7872ae96e6f5804a182210edd5c78; https://github.com/Stellarium/stellarium/commit/eba61df3b38605befcb43687a4c0a159dbc0c5cb
CVE: CVE-2023-27234
Published: 2023-03-15
Description: A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/Cherry-toto/jizhicms/issues/85; https://github.com/Cherry-toto/jizhicms/issues/85
CVE: CVE-2023-27235
Published: 2023-03-15
Description: An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/Cherry-toto/jizhicms/issues/85; https://github.com/Cherry-toto/jizhicms/issues/85
CVE: CVE-2023-27239
Published: 2023-03-15
Description: Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/yjzy00001/CVE/blob/main/vuln/WifiGuestSet/readme.md; https://github.com/yjzy00001/CVE/blob/main/vuln/WifiGuestSet/readme.md
CVE: CVE-2023-27240
Published: 2023-03-15
Description: Tenda AX3 V16.03.12.11 was discovered to contain a command injection vulnerability via the lanip parameter at /goform/AdvSetLanip.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/yjzy00001/CVE/blob/main/vuln/rce/readme.md; https://github.com/yjzy00001/CVE/blob/main/vuln/rce/readme.md
CVE: CVE-2023-1407
Published: 2023-03-15
Description: A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223111.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://s1.ax1x.com/2023/03/15/pp1gd8x.png; https://vuldb.com/?ctiid.223111; https://vuldb.com/?id.223111
CVE: CVE-2023-25695
Published: 2023-03-15
Description: Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/apache/airflow/pull/29501; https://lists.apache.org/thread/z8w6ckzs61ql365tv4d19k82o67r15p2; https://github.com/apache/airflow/pull/29501
CVE: CVE-2022-47427
Published: 2023-03-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.3.24.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/my-calendar/wordpress-my-calendar-plugin-3-3-24-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/my-calendar/wordpress-my-calendar-plugin-3-3-24-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-25708
Published: 2023-03-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wpvr/wordpress-wp-vr-360-panorama-and-virtual-tour-builder-plugin-8-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpvr/wordpress-wp-vr-360-panorama-and-virtual-tour-builder-plugin-8-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25709
Published: 2023-03-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.11 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/locatoraid/wordpress-locatoraid-store-locator-plugin-3-9-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/locatoraid/wordpress-locatoraid-store-locator-plugin-3-9-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25968
Published: 2023-03-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Portal – Private user pages and login plugin <= 1.1.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/client-portal/wordpress-client-portal-plugin-1-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/client-portal/wordpress-client-portal-plugin-1-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-0322
Published: 2023-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS.This issue affects UNIS: before 28376.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0147; https://www.usom.gov.tr/bildirim/tr-23-0147
CVE: CVE-2022-45155
Published: 2023-03-15
Description: An Improper Handling of Exceptional Conditions vulnerability in obs-service-go_modules of openSUSE Factory allows attackers that can influence the call to the service to delete files and directories on the system of the victim. This issue affects: SUSE openSUSE Factory obs-service-go_modules versions prior to 0.6.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://bugzilla.suse.com/show_bug.cgi?id=1201138; https://bugzilla.suse.com/show_bug.cgi?id=1201138
CVE: CVE-2023-24726
Published: 2023-03-15
Description: Art Gallery Management System v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter on the enquiry page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-24726/CVE-2023-24726.txt; https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/; https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
CVE: CVE-2023-24728
Published: 2023-03-15
Description: Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the contact parameter in the user profile update function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-24728/CVE-2023-24728.txt; https://www.sourcecodester.com/php/15895/simple-customer-relationship-management-crm-system-using-php-free-source-coude.html; https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip
CVE: CVE-2023-24729
Published: 2023-03-15
Description: Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-24729/CVE-2023-24729.txt; https://www.sourcecodester.com/php/15895/simple-customer-relationship-management-crm-system-using-php-free-source-coude.html; https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip
CVE: CVE-2023-24730
Published: 2023-03-15
Description: Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the user profile update function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-24730/CVE-2023-24730.txt; https://www.sourcecodester.com/php/15895/simple-customer-relationship-management-crm-system-using-php-free-source-coude.html; https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip