deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41941
Published: 2023-01-26
Description: GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-qqqm-7h6v-7cf4; https://github.com/glpi-project/glpi/security/advisories/GHSA-qqqm-7h6v-7cf4
CVE: CVE-2022-42330
Published: 2023-01-26
Description: Guests can cause Xenstore crash via soft reset When a guest issues a "Soft Reset" (e.g. for performing a kexec) the libxl based Xen toolstack will normally perform a XS_RELEASE Xenstore operation. Due to a bug in xenstored this can result in a crash of xenstored. Any other use of XS_RELEASE will have the same impact.
CVSS Score: 7.5 (HIGH)
References: https://security.gentoo.org/glsa/202402-07; https://xenbits.xenproject.org/xsa/advisory-425.txt; http://xenbits.xen.org/xsa/advisory-425.html
CVE: CVE-2022-43864
Published: 2023-01-26
Description: 
IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 239427.


CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239427; https://www.ibm.com/support/pages/node/6857223; https://www.ibm.com/support/pages/node/6857239
CVE: CVE-2022-43917
Published: 2023-01-26
Description: 
IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/241045; https://www.ibm.com/support/pages/node/6857007; https://exchange.xforce.ibmcloud.com/vulnerabilities/241045
CVE: CVE-2022-43997
Published: 2023-01-26
Description: Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation. There is an insufficiently protected handle to the A180AG.exe SYSTEM process with PROCESS_ALL_ACCESS rights.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://gist.github.com/jackullrich/21fcfe75aeb5e18c60b80e684b83d741; https://winternl.com/cve-2022-43997/; https://gist.github.com/jackullrich/21fcfe75aeb5e18c60b80e684b83d741
CVE: CVE-2022-44018
Published: 2023-01-26
Description: In Softing uaToolkit Embedded before 1.40.1, a malformed PubSub discovery announcement message can cause a NULL pointer dereference or out-of-bounds memory access in the subscriber application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-10.html; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-10.html
CVE: CVE-2022-44297
Published: 2023-01-26
Description: SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/siteserver/cms/issues/3490; https://github.com/siteserver/cms/issues/3490
CVE: CVE-2022-45730
Published: 2023-01-26
Description: A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45730; https://phpgurukul.com/doctor-appointment-management-system-using-php-and-mysql/; https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45730
CVE: CVE-2022-45808
Published: 2023-01-26
Description: SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/; https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-wordpress-lms-plugin-plugin-4-1-7-3-2-sql-injection?_s_id=cve; https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/
CVE: CVE-2022-45820
Published: 2023-01-26
Description: SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/; https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-plugin-4-1-7-3-2-auth-sql-injection-sqli-vulnerability?_s_id=cve; https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/
CVE: CVE-2022-45920
Published: 2023-01-26
Description: In Softing uaToolkit Embedded before 1.41, a malformed CreateMonitoredItems request may cause a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-10.html; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-10.html
CVE: CVE-2022-46128
Published: 2023-01-26
Description: phpgurukul Doctor Appointment Management System V 1.0.0 is vulnerable to Cross Site Scripting (XSS) via searchdata=.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Rajeshwar40/CVE/blob/main/2022-46128; https://phpgurukul.com/projects/Doctor-Appointment-System_PHP.zip; https://github.com/Rajeshwar40/CVE/blob/main/2022-46128
CVE: CVE-2022-46624
Published: 2023-01-26
Description: A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-46624; https://www.sourcecodester.com/php/15904/online-graduate-tracer-system-college-ict-alumni.html; https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-46624
CVE: CVE-2022-46957
Published: 2023-01-26
Description: Sourcecodester.com Online Graduate Tracer System V 1.0.0 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-46957; https://www.sourcecodester.com/sites/default/files/download/oretnom23/tracking.zip; https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-46957
CVE: CVE-2022-46998
Published: 2023-01-26
Description: An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://www.yuque.com/shiyi-5yjak/hx4unh/kgnanw3lt8wg1tx2#%20%E3%80%8Ataocms-3.0.2-ssrf%E3%80%8B; https://www.yuque.com/shiyi-5yjak/hx4unh/kgnanw3lt8wg1tx2#%20%E3%80%8Ataocms-3.0.2-ssrf%E3%80%8B
CVE: CVE-2022-46999
Published: 2023-01-26
Description: Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.yuque.com/shiyi-5yjak/hx4unh/lvalegwh46r4dgcp?singleDoc; https://www.yuque.com/shiyi-5yjak/hx4unh/lvalegwh46r4dgcp?singleDoc
CVE: CVE-2022-47040
Published: 2023-01-26
Description: An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command after placing a crafted file in the /tmp directory and sending crafted packets through port 80.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/leoservalli/Privilege-escalation-ASKEY; https://github.com/leoservalli/Privilege-escalation-ASKEY
CVE: CVE-2022-47042
Published: 2023-01-26
Description: MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://gitee.com/mingSoft/MCMS/issues/I6592F; https://gitee.com/mingSoft/MCMS/issues/I6592F
CVE: CVE-2022-47052
Published: 2023-01-26
Description: The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS and HTML Injection. A malicious unauthenticated attacker can exploit this vulnerability using a specially crafted URL. This affects firmware versions: V1.1.0.112_1.0.1, V1.1.0.114_1.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://github.com/dest-3/NETGEAR/tree/main/CVE-2022-47052; https://github.com/dest-3/NETGEAR/tree/main/CVE-2022-47052
CVE: CVE-2022-47073
Published: 2023-01-26
Description: A cross-site scripting (XSS) vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/%40shiva.infocop/stored-xss-found-in-small-crm-phpgurukul-7890ea3c04df; https://packetstormsecurity.com; https://medium.com/%40shiva.infocop/stored-xss-found-in-small-crm-phpgurukul-7890ea3c04df
CVE: CVE-2022-47100
Published: 2023-01-26
Description: A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802.15.4 frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/iot-sec23/IoT-CVE/blob/main/Sengled%20Smart%20Bulb%20Vulnerability%20Report.pdf; https://github.com/iot-sec23/IoT-CVE/blob/main/Sengled%20Smart%20Bulb%20Vulnerability%20Report.pdf
CVE: CVE-2022-47615
Published: 2023-01-26
Description: Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/; https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-plugin-4-1-7-3-2-local-file-inclusion?_s_id=cve; https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/
CVE: CVE-2022-47767
Published: 2023-01-26
Description: A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects Solar-Log devices that use firmware version v4.2.7 up to v5.1.1 (included). This does not exist in SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 / 6.0.0 for SL Base.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-912
References: https://www.solar-log.com/en/support/firmware-database-1; https://www.swascan.com/security-advisory-solar-log/; https://www.solar-log.com/en/support/firmware-database-1
CVE: CVE-2022-48199
Published: 2023-01-26
Description: SoftPerfect NetWorx 7.1.1 on Windows allows an attacker to execute a malicious binary with potentially higher privileges via a low-privileged user account that abuses the Notifications function. The Notifications function allows for arbitrary binary execution and can be modified by any user. The resulting binary execution will occur in the context of any user running NetWorx. If an attacker modifies the Notifications function to execute a malicious binary, the binary will be executed by every user running NetWorx on that system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://giuliamelottigaribaldi.com/cve-2022-48199/; https://www.softperfect.com/products/changelog.php?product_id=2; https://giuliamelottigaribaldi.com/cve-2022-48199/
CVE: CVE-2022-4054
Published: 2023-01-26
Description: An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4054.json; https://gitlab.com/gitlab-org/gitlab/-/issues/382260; https://hackerone.com/reports/1758126
CVE: CVE-2022-4092
Published: 2023-01-26
Description: An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4092.json; https://gitlab.com/gitlab-org/gitlab/-/issues/383208; https://hackerone.com/reports/1777934
CVE: CVE-2022-4510
Published: 2023-01-26
Description: A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.
 This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.

This issue affects binwalk from 2.1.2b through 2.3.3 included.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/ReFirmLabs/binwalk/pull/617; https://security.gentoo.org/glsa/202309-07; https://github.com/ReFirmLabs/binwalk/pull/617
CVE: CVE-2023-0229
Published: 2023-01-26
Description: A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=2160349; https://bugzilla.redhat.com/show_bug.cgi?id=2160349
CVE: CVE-2023-0284
Published: 2023-01-26
Description: Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://checkmk.com/werk/15181; https://checkmk.com/werk/15181
CVE: CVE-2023-0321
Published: 2023-01-26
Description: Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200, CWE-200
References: https://www.hackplayers.com/2023/01/cve-2023-0321-info-sensible-campbell.html; https://www.incibe-cert.es/en/early-warning/ics-advisories/disclosure-sensitive-information-campbell-scientific-products; https://www.hackplayers.com/2023/01/cve-2023-0321-info-sensible-campbell.html
CVE: CVE-2023-0356
Published: 2023-01-26
Description: 
SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining sensitive information. 




 
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-261
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-024-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-024-02
CVE: CVE-2023-0394
Published: 2023-01-26
Description: A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cb3e9864cdbe35ff[PII_REDACTED]edbcbac955fe17; https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE: CVE-2023-0411
Published: 2023-01-26
Description: Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-834, CWE-834
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0411.json; https://gitlab.com/wireshark/wireshark/-/issues/18711; https://gitlab.com/wireshark/wireshark/-/issues/18720
CVE: CVE-2023-0412
Published: 2023-01-26
Description: TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0412.json; https://gitlab.com/wireshark/wireshark/-/issues/18770; https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html
CVE: CVE-2023-0413
Published: 2023-01-26
Description: Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0413.json; https://gitlab.com/wireshark/wireshark/-/issues/18766; https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html
CVE: CVE-2023-0414
Published: 2023-01-26
Description: Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0414.json; https://gitlab.com/wireshark/wireshark/-/issues/18622; https://www.wireshark.org/security/wnpa-sec-2023-01.html
CVE: CVE-2023-0415
Published: 2023-01-26
Description: iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0415.json; https://gitlab.com/wireshark/wireshark/-/issues/18796; https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html
CVE: CVE-2023-0416
Published: 2023-01-26
Description: GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0416.json; https://gitlab.com/wireshark/wireshark/-/issues/18779; https://www.wireshark.org/security/wnpa-sec-2023-04.html
CVE: CVE-2023-0417
Published: 2023-01-26
Description: Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0417.json; https://gitlab.com/wireshark/wireshark/-/issues/18628; https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html
CVE: CVE-2023-0444
Published: 2023-01-26
Description: A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the 'Read Only User' group, can view the password of another default user 'Administrator', which is in the 'Administrator' group. This allows any lower privileged user to log in as an administrator.
CVSS Score: 8.8 (HIGH)
References: https://www.tenable.com/security/research/tra-2023-4; https://www.tenable.com/security/research/tra-2023-4
CVE: CVE-2023-0448
Published: 2023-01-26
Description: The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.tenable.com/security/research/tra-2023-3; https://www.tenable.com/security/research/tra-2023-3
CVE: CVE-2023-0449
Published: 2023-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2023-0451
Published: 2023-01-26
Description: Econolite EOS versions prior to 3.2.23 lack a password
requirement for gaining “READONLY” access to log files and certain database and
configuration files. One such file contains tables with MD5 hashes and
usernames for all defined users in the control software, including
administrators and technicians.








CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02
CVE: CVE-2023-0452
Published: 2023-01-26
Description: Econolite EOS versions prior to 3.2.23 use a weak hash
algorithm for encrypting privileged user credentials. A configuration file that
is accessible without authentication uses MD5 hashes for encrypting
credentials, including those of administrators and technicians.








CVSS Score: 9.8 (CRITICAL)
CWE: CWE-328, CWE-327
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02
CVE: CVE-2023-0463
Published: 2023-01-26
Description: The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user to save sensitive data on disk.


CVSS Score: 3.3 (LOW)
CWE: CWE-306
References: https://devolutions.net/security/advisories/DEVO-2023-0001; https://devolutions.net/security/advisories/DEVO-2023-0001
CVE: CVE-2023-0468
Published: 2023-01-26
Description: A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race condition of poll_refs. This flaw may cause a NULL pointer dereference.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2164024; https://bugzilla.redhat.com/show_bug.cgi?id=2164024
CVE: CVE-2023-0469
Published: 2023-01-26
Description: A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during call cleanup. This flaw may lead to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191, CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2163723; https://bugzilla.redhat.com/show_bug.cgi?id=2163723
CVE: CVE-2023-0476
Published: 2023-01-26
Description: A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://www.tenable.com/security/tns-2023-03; https://www.tenable.com/security/tns-2023-03
CVE: CVE-2023-0513
Published: 2023-01-26
Description: A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-219334 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/isoftforce/dreamer_cms/issues/I68UYM; https://gitee.com/isoftforce/dreamer_cms/tree/Latest_Stable_Release_4.1.3; https://vuldb.com/?ctiid.219334