deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-41660
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPSynchro WP Synchro plugin <= 1.9.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wpsynchro/wordpress-wordpress-migration-plugin-db-files-wp-synchro-plugin-1-9-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpsynchro/wordpress-wordpress-migration-plugin-db-files-wp-synchro-plugin-1-9-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-43643
Published: 2023-10-09
Description: AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later. 
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nahsra/antisamy/releases/tag/v1.7.4; https://github.com/nahsra/antisamy/security/advisories/GHSA-pcf2-gh6g-h5r2; https://github.com/nahsra/antisamy/releases/tag/v1.7.4
CVE: CVE-2023-44378
Published: 2023-10-09
Description: gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of `a`, for small values there exists a second decomposition for `a+r` (where `r` is the modulus the values are being reduced by). The second decomposition was possible due to overflowing the field where the values are defined. Upgrading to version 0.9.0 should fix the issue without needing to change the calls to value comparison methods.
CVSS Score: 7.1 (HIGH)
CWE: CWE-191, CWE-697
References: https://github.com/Consensys/gnark/commit/59a4087261a6c73f13e80d695c17b398c3d0934f; https://github.com/Consensys/gnark/security/advisories/GHSA-498w-5j49-vqjg; https://github.com/zkopru-network/zkopru/issues/116
CVE: CVE-2023-44393
Published: 2023-10-09
Description: Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted `plugin_id` value. When a victim who is logged in as an administrator visits this URL, the malicious code will be injected into the HTML page and executed. This vulnerability can be exploited by any attacker who has access to a malicious URL. However, only users who are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page, which is only accessible to administrators. Version 14.0.0.beta4 contains a patch for this issue.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79, CWE-80
References: https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23; https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg; https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23
CVE: CVE-2023-30910
Published: 2023-10-09
Description: HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. 
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbst04539en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbst04539en_us
CVE: CVE-2023-41047
Published: 2023-10-09
Description: OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract data managed by OctoPrint, or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. OctoPrint versions from 1.9.3 onward have been patched. Administrators of OctoPrint instances are advised to make sure they can trust all other administrators on their instance and to also not blindly configure arbitrary GCODE scripts found online or provided to them by third parties.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1336
References: https://github.com/OctoPrint/OctoPrint/commit/d0072cff894509c77e243d6562245ad3079e17db; https://github.com/OctoPrint/OctoPrint/releases/tag/1.9.3; https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-fwfg-vprh-97ph
CVE: CVE-2023-44400
Published: 2023-10-09
Description: Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-384
References: https://github.com/louislam/uptime-kuma/commit/88afab6571ef7d4d41bb395cdb6ecd3968835a4a; https://github.com/louislam/uptime-kuma/issues/3481; https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g
CVE: CVE-2023-5365
Published: 2023-10-09
Description: HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://support.hp.com/us-en/document/ish_9[PII_REDACTED]961-16/hpsbgn03870; https://support.hp.com/us-en/document/ish_9[PII_REDACTED]961-16/hpsbgn03870
CVE: CVE-2023-42455
Published: 2023-10-09
Description: Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the API, even if their dashboard role is not. Version 4.4.2 contains a fix. There are no known workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427; https://github.com/wazuh/wazuh-kibana-app/pull/5428; https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf
CVE: CVE-2023-39189
Published: 2023-10-09
Description: A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:2394; https://access.redhat.com/errata/RHSA-2024:2950; https://access.redhat.com/errata/RHSA-2024:3138
CVE: CVE-2023-39192
Published: 2023-10-09
Description: A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:2950; https://access.redhat.com/errata/RHSA-2024:3138; https://access.redhat.com/security/cve/CVE-2023-39192
CVE: CVE-2023-39193
Published: 2023-10-09
Description: A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:2394; https://access.redhat.com/errata/RHSA-2024:2950; https://access.redhat.com/errata/RHSA-2024:3138
CVE: CVE-2023-39194
Published: 2023-10-09
Description: A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.
CVSS Score: 3.2 (LOW)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:2394; https://access.redhat.com/errata/RHSA-2024:2950; https://access.redhat.com/errata/RHSA-2024:3138
CVE: CVE-2023-41667
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-dtree-30/wordpress-wp-dtree-plugin-4-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-dtree-30/wordpress-wp-dtree-plugin-4-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-41668
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/leadster-marketing-conversacional/wordpress-leadster-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/leadster-marketing-conversacional/wordpress-leadster-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-3431
Published: 2023-10-09
Description: A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-94952; https://support.lenovo.com/us/en/product_security/LEN-94952
CVE: CVE-2023-41669
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <= 1.06 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/live-news-lite/wordpress-live-news-plugin-1-06-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/live-news-lite/wordpress-live-news-plugin-1-06-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-41670
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel (in person: Edward Bock) Use Memcached plugin <= 1.0.4 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/use-memcached/wordpress-use-memcached-plugin-1-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/use-memcached/wordpress-use-memcached-plugin-1-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-41672
Published: 2023-10-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rémi Leclercq Hide admin notices – Admin Notification Center plugin <= 2.3.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-admin-notification-center/wordpress-hide-admin-notices-admin-notification-center-plugin-2-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-admin-notification-center/wordpress-hide-admin-notices-admin-notification-center-plugin-2-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-5459
Published: 2023-10-09
Description: A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. VDB-241582 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/drive/folders/1mUKkl_NPoUENpPUq-pdQQaEEGvKAaIFB; https://vuldb.com/?ctiid.241582; https://vuldb.com/?id.241582
CVE: CVE-2023-5460
Published: 2023-10-09
Description: A vulnerability was found in Delta Electronics WPLSoft up to 2.51 and classified as problematic. This issue affects some unknown processing of the component Modbus Data Packet Handler. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241583. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-122
References: https://drive.google.com/drive/folders/1oYxs_KxK4Ftd7OsexGk6upkxhJ3-m8M3; https://vuldb.com/?ctiid.241583; https://vuldb.com/?id.241583
CVE: CVE-2023-44392
Published: 2023-10-09
Description: Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes `ConfigMap` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are stored either in the `garden-system` namespace or the configured user namespace. When a user invokes the command `garden test` or `garden run` objects stored in the `ConfigMap` are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the `ConfigMap`, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a `garden test` or `garden run` which has previously cached results. The issue has been patched in Garden versions `0.13.17` (Bonsai) and `0.12.65` (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available.
CVSS Score: 8.2 (HIGH)
CWE: CWE-94, CWE-502
References: https://github.com/garden-io/garden/commit/3117964da40d3114f129a6131b4ada89eaa4eb8c; https://github.com/garden-io/garden/security/advisories/GHSA-hm75-6vc9-8rpr; https://github.com/garden-io/garden/commit/3117964da40d3114f129a6131b4ada89eaa4eb8c
CVE: CVE-2023-44467
Published: 2023-10-09
Description: langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which is not prohibited by pal_chain/base.py.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483; https://github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483
CVE: CVE-2023-44811
Published: 2023-10-09
Description: Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/ahrixia/CVE-2023-44811; https://github.com/ahrixia/CVE-2023-44811
CVE: CVE-2023-44821
Published: 2023-10-09
Description: Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/kohler/gifsicle/issues/195; https://github.com/kohler/gifsicle/issues/65; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5/
CVE: CVE-2023-5461
Published: 2023-10-09
Description: A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Handler. The manipulation leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241584. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-319
References: https://drive.google.com/drive/folders/17nBJt3tejqipE_L-lMEhYXeGhG0eii-_; https://vuldb.com/?ctiid.241584; https://vuldb.com/?id.241584
CVE: CVE-2022-36228
Published: 2023-10-09
Description: Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the Nokelock app.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://gist.github.com/YTrick/59c06611052d3fdae034e7087293bbc0; https://gist.github.com/YTrick/59c06611052d3fdae034e7087293bbc0
CVE: CVE-2022-3728
Published: 2023-10-09
Description: 
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. 


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1263
References: https://support.lenovo.com/us/en/product_security/LEN-106014; https://support.lenovo.com/us/en/product_security/LEN-106014
CVE: CVE-2022-48182
Published: 2023-10-09
Description: 
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. 


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1263
References: https://support.lenovo.com/us/en/product_security/LEN-106014; https://support.lenovo.com/us/en/product_security/LEN-106014
CVE: CVE-2022-48183
Published: 2023-10-09
Description: 
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. 


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1263
References: https://support.lenovo.com/us/en/product_security/LEN-106014; https://support.lenovo.com/us/en/product_security/LEN-106014
CVE: CVE-2023-43271
Published: 2023-10-09
Description: Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://github.com/Question-h/vuln/blob/master/70mai_a500s_backdoor.md; https://github.com/Question-h/vuln/blob/master/CVE-2023-43271.md; https://github.com/Question-h/vuln/blob/master/70mai_a500s_backdoor.md
CVE: CVE-2023-44812
Published: 2023-10-09
Description: Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ahrixia/CVE-2023-44812; https://github.com/ahrixia/CVE-2023-44812
CVE: CVE-2023-44813
Published: 2023-10-09
Description: Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ahrixia/CVE-2023-44813; https://github.com/ahrixia/CVE-2023-44813
CVE: CVE-2023-43641
Published: 2023-10-09
Description: libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/176128/libcue-2.2.1-Out-Of-Bounds-Access.html; https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/; https://github.com/lipnitsk/libcue/commit/cfb98a060fd79dbc3463d85f0f29c3c335dfa0ea
CVE: CVE-2023-43899
Published: 2023-10-09
Description: hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/len0m0/9cb2e87cb517db297be1b2f110248295; https://github.com/len0m0/hansuncmssqli/blob/main/README.md; https://gist.github.com/len0m0/9cb2e87cb517db297be1b2f110248295
CVE: CVE-2023-5462
Published: 2023-10-09
Description: A vulnerability was found in XINJE XD5E-30R-E 3.5.3b. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Modbus Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier VDB-241585 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://drive.google.com/drive/folders/1jik8hRjD8N2IkxOHP5wsJUEya09jCv2n; https://vuldb.com/?ctiid.241585; https://vuldb.com/?id.241585
CVE: CVE-2023-5463
Published: 2023-10-09
Description: A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfgmgr32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. VDB-241586 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://drive.google.com/drive/folders/1mpRxWOPjxVS980r0qu1IY_Hf0irKO-cu; https://vuldb.com/?ctiid.241586; https://vuldb.com/?id.241586
CVE: CVE-2023-44846
Published: 2023-10-10
Description: An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://blog.csdn.net/2301_79997870/article/details/133365547?spm=1001.2014.3001.5501; https://blog.csdn.net/2301_79997870/article/details/133661890?spm=1001.2014.3001.5502; https://blog.csdn.net/2301_79997870/article/details/133365547?spm=1001.2014.3001.5501