deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-4811
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4812
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4813
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4814
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4815
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4816
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4817
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4818
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4819
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4820
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4821
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4822
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4823
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4824
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4825
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4826
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4827
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4828
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4829
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4830
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2018-4831
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-25079
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-25080
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-25081
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-25082
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-25083
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8843
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8845
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8859
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8860
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8861
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8862
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8863
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8864
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8865
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8866
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8867
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8868
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8869
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8870
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8871
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8872
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8873
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8874
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8875
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8876
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8877
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8878
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8879
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8880
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8881
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8882
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8883
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8884
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8885
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8886
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8887
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8888
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8889
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8890
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8891
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8892
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8893
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8894
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8895
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8896
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8897
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2019-8899
Published: 2023-09-14
Description: Rejected reason: This candidate is unused by its CNA.
CVE: CVE-2023-39285
Published: 2023-09-14
Description: A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0014; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0014
CVE: CVE-2023-39286
Published: 2023-09-14
Description: A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0015; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0015
CVE: CVE-2023-41011
Published: 2023-09-14
Description: Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the shortcut_telnet.cg component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/te5tb99/For-submitting/wiki/Command-Execution-Vulnerability-in-China-Mobile-Intelligent-Home-Gateway-HG6543C4; https://github.com/te5tb99/For-submitting/wiki/Command-Execution-Vulnerability-in-China-Mobile-Intelligent-Home-Gateway-HG6543C4
CVE: CVE-2023-4669
Published: 2023-09-14
Description: Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass.This issue affects SYSGuard 3001: before 3.2.20.0.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-302, CWE-287
References: https://www.usom.gov.tr/bildirim/tr-23-0525; https://www.usom.gov.tr/bildirim/tr-23-0525
CVE: CVE-2023-4766
Published: 2023-09-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Movus allows SQL Injection.This issue affects Movus: before 20230913.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0524; https://www.usom.gov.tr/bildirim/tr-23-0524
CVE: CVE-2023-29499
Published: 2023-09-14
Description: A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://access.redhat.com/security/cve/CVE-2023-29499; https://bugzilla.redhat.com/show_bug.cgi?id=2211828; https://gitlab.gnome.org/GNOME/glib/-/issues/2794
CVE: CVE-2023-32611
Published: 2023-09-14
Description: A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://access.redhat.com/security/cve/CVE-2023-32611; https://bugzilla.redhat.com/show_bug.cgi?id=2211829; https://gitlab.gnome.org/GNOME/glib/-/issues/2797
CVE: CVE-2023-32636
Published: 2023-09-14
Description: A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-400, CWE-502
References: https://gitlab.gnome.org/GNOME/glib/-/issues/2841; https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-32643
Published: 2023-09-14
Description: A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://gitlab.gnome.org/GNOME/glib/-/issues/2840; https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-32665
Published: 2023-09-14
Description: A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-502
References: https://access.redhat.com/security/cve/CVE-2023-32665; https://bugzilla.redhat.com/show_bug.cgi?id=2211827; https://gitlab.gnome.org/GNOME/glib/-/issues/2121
CVE: CVE-2023-37739
Published: 2023-09-14
Description: i-doit Pro v25 and below was discovered to be vulnerable to path traversal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/leekenghwa/CVE-2023-37739---Path-Traversal-in-i-doit-Pro-25-and-below/blob/main/README.md; https://medium.com/%40ray.999/i-doit-pro-v25-path-traversal-cve-2023-37739-4ebb695664bb; https://github.com/leekenghwa/CVE-2023-37739---Path-Traversal-in-i-doit-Pro-25-and-below/blob/main/README.md
CVE: CVE-2023-37755
Published: 2023-09-14
Description: i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/leekenghwa/CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below/blob/main/README.md; https://medium.com/%40ray.999/d7a54030e055; https://medium.com/%40ray.999/i-doit-v25-and-below-incorrect-access-control-issue-cve-2023-37755-d7a54030e055
CVE: CVE-2023-41588
Published: 2023-09-14
Description: A cross-site scripting (XSS) vulnerability in Time to SLA plugin v10.13.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the durationFormat parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xsn1210/poc2; https://github.com/xsn1210/poc2/blob/main/xss%5BTime%20to%20SLA%5D.md; https://github.com/xsn1210/poc2
CVE: CVE-2023-4563
Published: 2023-09-14
Description: Rejected reason: This was assigned as a duplicate of CVE-2023-4244.
CVE: CVE-2023-4676
Published: 2023-09-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yordam MedasPro allows Reflected XSS.This issue affects MedasPro: before 28.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0527; https://www.usom.gov.tr/bildirim/tr-23-0527
CVE: CVE-2023-4702
Published: 2023-09-14
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass.This issue affects Digital Yepas: before 1.0.1.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://www.usom.gov.tr/bildirim/tr-23-0526; https://www.usom.gov.tr/bildirim/tr-23-0526
CVE: CVE-2023-4965
Published: 2023-09-14
Description: A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239732.
CVSS Score: 2.7 (LOW)
CWE: CWE-601
References: https://github.com/ctflearner/Vulnerability/blob/main/PHPIPAM/Open_Redirect.md; https://vuldb.com/?ctiid.239732; https://vuldb.com/?id.239732
CVE: CVE-2023-4972
Published: 2023-09-14
Description: Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users.This issue affects Digital Yepas: before 1.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-648
References: https://www.usom.gov.tr/bildirim/tr-23-0526; https://www.usom.gov.tr/bildirim/tr-23-0526
CVE: CVE-2023-25584
Published: 2023-09-14
Description: An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/security/cve/CVE-2023-25584; https://bugzilla.redhat.com/show_bug.cgi?id=2167467; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-25585
Published: 2023-09-14
Description: A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-457, CWE-908
References: https://access.redhat.com/security/cve/CVE-2023-25585; https://bugzilla.redhat.com/show_bug.cgi?id=2167498; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-25586
Published: 2023-09-14
Description: A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-457, CWE-908
References: https://access.redhat.com/security/cve/CVE-2023-25586; https://bugzilla.redhat.com/show_bug.cgi?id=2167502; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-25588
Published: 2023-09-14
Description: A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-457, CWE-908
References: https://access.redhat.com/security/cve/CVE-2023-25588; https://bugzilla.redhat.com/show_bug.cgi?id=2167505; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-37756
Published: 2023-09-14
Description: I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://github.com/leekenghwa/CVE-2023-37756-CWE-521-lead-to-malicious-plugin-upload-in-the-i-doit-Pro-25-and-below/blob/main/README.md; https://medium.com/%40ray.999/idoit-pro-v25-and-below-weak-password-add-on-upload-to-rce-cve-2023-37756-fa1b18433ca3; https://github.com/leekenghwa/CVE-2023-37756-CWE-521-lead-to-malicious-plugin-upload-in-the-i-doit-Pro-25-and-below/blob/main/README.md
CVE: CVE-2023-38912
Published: 2023-09-14
Description: SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://codecanyon.net/item/super-store-finder/3630922; https://packetstormsecurity.com/files/173302/Super-Store-Finder-PHP-Script-3.6-SQL-Injection.html; https://codecanyon.net/item/super-store-finder/3630922
CVE: CVE-2023-41156
Published: 2023-09-14
Description: A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the save to new folder named field while creating a new filter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/shindeanik/Usermin-2.001/blob/main/CVE-2023-41156; https://webmin.com/tags/webmin-changelog/; https://github.com/shindeanik/Usermin-2.001/blob/main/CVE-2023-41156
CVE: CVE-2023-41159
Published: 2023-09-14
Description: A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML by editing the forward file manually.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41159; https://webmin.com/tags/webmin-changelog/; https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41159
CVE: CVE-2023-41160
Published: 2023-09-14
Description: A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the key name field while adding an authorized key.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/shindeanik/Usermin-2.001/blob/main/CVE-2023-41160; https://webmin.com/tags/webmin-changelog/; https://github.com/shindeanik/Usermin-2.001/blob/main/CVE-2023-41160
CVE: CVE-2023-42362
Published: 2023-09-14
Description: An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive information via uploading a crafted file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mr-n0b3dy/CVE-2023-42362; https://github.com/Mr-n0b3dy/CVE-2023-42362
CVE: CVE-2022-47631
Published: 2023-09-14
Description: Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if it detects malicious DLLs in this directory, attackers can exploit a race condition and replace a valid DLL (i.e., a copy of a legitimate Razer DLL) with a malicious DLL after the service has already checked the file. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: http://packetstormsecurity.com/files/174696/Razer-Synapse-Race-Condition-DLL-Hijacking.html; http://seclists.org/fulldisclosure/2023/Sep/6; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-002.txt
CVE: CVE-2023-39638
Published: 2023-09-14
Description: D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-859; https://github.com/mmmmmx1/dlink/blob/main/dir-859/readme.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2023-40868
Published: 2023-09-14
Description: Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/MinoTauro2020/CVE-2023-40868; https://github.com/MinoTauro2020/CVE-2023-40868
CVE: CVE-2023-40869
Published: 2023-09-14
Description: Cross Site Scripting vulnerability in mooSocial mooSocial Software 3.1.6 and 3.1.7 allows a remote attacker to execute arbitrary code via a crafted script to the edit_menu, copuon, and group_categorias functions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MinoTauro2020/CVE-2023-40869; https://github.com/MinoTauro2020/CVE-2023-40869
CVE: CVE-2023-38891
Published: 2023-09-14
Description: SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Reports/ReportRun.php#L395; https://github.com/jselliott/CVE-2023-38891; https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Reports/ReportRun.php#L395
CVE: CVE-2023-41592
Published: 2023-09-14
Description: Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://hacker.soarescorp.com/cve/2023-41592/; https://owasp.org/Top10/A03_2021-Injection/; https://owasp.org/www-project-top-ten/