deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-0242
Published: 2023-01-18
Description: Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writing or modifying files on the server.

The VQL copy() function applies permission checks for reading files but does not check for permission to write files. This allows a low privilege user (usually, users with the Velociraptor "investigator" role) to overwrite files on the server, including Velociraptor configuration files.

To exploit this vulnerability, the attacker must already have a Velociraptor user account at a low privilege level (at least "analyst") and be able to log into the GUI and create a notebook where they can run the VQL query invoking the copy() VQL function. Typically, most users deploy Velociraptor with limited access to a trusted group (most users will be administrators within the GUI).
This vulnerability is associated with program files  https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go  and program routines copy().

This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.


CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-862
References: https://docs.velociraptor.app/announcements/2023-cves/#:~:text=to%20upgrade%20clients.-,CVE%2D2023%2D0242,-Insufficient%20Permission%20Check; https://docs.velociraptor.app/announcements/2023-cves/#:~:text=to%20upgrade%20clients.-,CVE%2D2023%2D0242,-Insufficient%20Permission%20Check
CVE: CVE-2022-45923
Published: 2023-01-18
Description: An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Common Gateway Interface (CGI) program cs.exe allows an attacker to increase/decrease an arbitrary memory address by 1 and trigger a call to a method of a vftable with a vftable pointer value chosen by the attacker.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/170613/OpenText-Extended-ECM-22.3-cs.exe-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2023/Jan/10; https://sec-consult.com/vulnerability-lab/advisory/pre-authenticated-remote-code-execution-in-csexe-opentext-server-component/
CVE: CVE-2022-45927
Published: 2023-01-18
Description: An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Java application server can be used to bypass the authentication of the QDS endpoints of the Content Server. These endpoints can be used to create objects and execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: http://packetstormsecurity.com/files/170614/OpenText-Extended-ECM-22.3-Java-Frontend-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2023/Jan/13; https://sec-consult.com/vulnerability-lab/advisory/pre-authenticated-remote-code-execution-via-java-frontend-qds-endpoint-opentext-extended-ecm/
CVE: CVE-2022-4235
Published: 2023-01-18
Description: RushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible because the application exposes an activity and does not properly validate the data it receives.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/miller/; https://fluidattacks.com/advisories/miller/
CVE: CVE-2023-0164
Published: 2023-01-18
Description: OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://fluidattacks.com/advisories/queen/; https://github.com/Orangescrum/orangescrum; https://fluidattacks.com/advisories/queen/
CVE: CVE-2023-0290
Published: 2023-01-18
Description: Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client.

Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to "administrator" role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the "investigator" role.
To exploit this vulnerability, the attacker must already have a Velociraptor user account at least "investigator" level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI.

This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22, CWE-22
References: https://github.com/Velocidex/velociraptor; https://github.com/Velocidex/velociraptor
CVE: CVE-2022-3085
Published: 2023-01-19
Description: 
Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code.


CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-354-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-354-01
CVE: CVE-2023-0397
Published: 2023-01-19
Description: A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-703, CWE-665
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wc2h-h868-q7hj; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wc2h-h868-q7hj
CVE: CVE-2015-10069
Published: 2023-01-19
Description: A vulnerability was found in viakondratiuk cash-machine. It has been declared as critical. This vulnerability affects the function is_card_pin_at_session/update_failed_attempts of the file machine.py. The manipulation leads to sql injection. The name of the patch is 62a6e24efdfa195b70d7df140d8287fdc38eb66d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218896.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/viakondratiuk/cash-machine/commit/62a6e24efdfa195b70d7df140d8287fdc38eb66d; https://vuldb.com/?ctiid.218896; https://vuldb.com/?id.218896
CVE: CVE-2017-20174
Published: 2023-01-19
Description: A vulnerability was found in bastianallgeier Kirby Webmentions Plugin and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as 55bedea78ae9af916a9a41497bd[PII_REDACTED]502. It is recommended to apply a patch to fix this issue. VDB-218894 is the identifier assigned to this vulnerability.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-74
References: https://github.com/bastianallgeier/kirby-webmentions/commit/55bedea78ae9af916a9a41497bd[PII_REDACTED]502; https://vuldb.com/?ctiid.218894; https://vuldb.com/?id.218894
CVE: CVE-2022-4892
Published: 2023-01-19
Description: A vulnerability was found in MyCMS. It has been classified as problematic. This affects the function build_view of the file lib/gener/view.php of the component Visitors Module. The manipulation of the argument original/converted leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named d64fcba4882a50e21cdbec3eb4a080cb694d26ee. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218895.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/andrzuk/MyCMS/commit/d64fcba4882a50e21cdbec3eb4a080cb694d26ee; https://vuldb.com/?ctiid.218895; https://vuldb.com/?id.218895
CVE: CVE-2023-0398
Published: 2023-01-19
Description: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/modoboa/modoboa/commit/8e14ac93669df4f35fcdebd55dc9d2f0fed3ed48; https://huntr.dev/bounties/0a852351-00ed-44d2-a650-9055b7beed58; https://github.com/modoboa/modoboa/commit/8e14ac93669df4f35fcdebd55dc9d2f0fed3ed48
CVE: CVE-2013-10014
Published: 2023-01-19
Description: A vulnerability classified as critical has been found in oktora24 2moons. Affected is an unknown function. The manipulation leads to sql injection. The patch is identified as 1b09cf7672eb85b5b0c8a4de321f7a4ad87b09a7. It is recommended to apply a patch to fix this issue. VDB-218898 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/oktora24/2moons/commit/1b09cf7672eb85b5b0c8a4de321f7a4ad87b09a7; https://vuldb.com/?ctiid.218898; https://vuldb.com/?id.218898
CVE: CVE-2014-125083
Published: 2023-01-19
Description: A vulnerability has been found in Anant Labs google-enterprise-connector-dctm up to 3.2.3 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/domain leads to sql injection. The patch is named 6fba04f18ab7764002a1da308e7cd9712b501cb7. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218911.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/AnantLabs/google-enterprise-connector-dctm/commit/6fba04f18ab7764002a1da308e7cd9712b501cb7; https://vuldb.com/?ctiid.218911; https://vuldb.com/?id.218911
CVE: CVE-2015-10070
Published: 2023-01-19
Description: A vulnerability was found in copperwall Twiddit. It has been rated as critical. This issue affects some unknown processing of the file index.php. The manipulation leads to sql injection. The identifier of the patch is 2203d4ce9810bdaccece5c48ff4888658a01acfc. It is recommended to apply a patch to fix this issue. The identifier VDB-218897 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/copperwall/twiddit/commit/2203d4ce9810bdaccece5c48ff4888658a01acfc; https://vuldb.com/?ctiid.218897; https://vuldb.com/?id.218897
CVE: CVE-2015-10071
Published: 2023-01-19
Description: A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is named 5908d5ee65fec61ce0e321d586530461a210bf2a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218951.
CVSS Score: 2.6 (LOW)
CWE: CWE-640
References: https://github.com/gitter-badger/ezpublish-modern-legacy/commit/5908d5ee65fec61ce0e321d586530461a210bf2a; https://github.com/gitter-badger/ezpublish-modern-legacy/releases/tag/1.0; https://vuldb.com/?ctiid.218951
CVE: CVE-2022-3738
Published: 2023-01-19
Description: The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2022-054/; https://cert.vde.com/en/advisories/VDE-2022-054/
CVE: CVE-2023-23690
Published: 2023-01-19
Description: 
Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability. A threat actor does not need any specific privileges to potentially exploit this vulnerability. An attacker could perform a man-in-the-middle attack and eavesdrop on encrypted communications from Cloud Mobility to Cloud Storage devices. Exploitation could lead to the compromise of secret and sensitive information, cloud storage connection downtime, and the integrity of the connection to the Cloud devices.


CVSS Score: 7.0 (HIGH)
CWE: CWE-299, CWE-295
References: https://www.dell.com/support/kbdoc/en-us/000207521/dsa-2023-019-dell-emc-cloud-mobility-security-update-for-certificate-revocation-vulnerability; https://www.dell.com/support/kbdoc/en-us/000207521/dsa-2023-019-dell-emc-cloud-mobility-security-update-for-certificate-revocation-vulnerability
CVE: CVE-2021-37774
Published: 2023-01-19
Description: An issue was discovered in function httpProcDataSrv in TL-WDR7660 2.0.30 that allows attackers to execute arbitrary code.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://github.com/fishykz/TP-POC; https://github.com/fishykz/TP-POC
CVE: CVE-2023-0402
Published: 2023-01-19
Description: The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete post meta information and reset network access tokens.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/social-warfare/trunk/lib/options/SWP_Options_Page.php?rev=2364155#L923; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2844092%40social-warfare&new=2844092%40social-warfare&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc4ba2c-32eb-46c5-bb40-7c0150fc1ca4?source=cve
CVE: CVE-2023-0403
Published: 2023-01-19
Description: The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on several AJAX actions. This makes it possible for unauthenticated attackers to delete post meta information and reset network access tokens, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/social-warfare/trunk/lib/options/SWP_Options_Page.php?rev=2364155#L923; https://www.wordfence.com/threat-intel/vulnerabilities/id/a36d1bb1-9446-4042-a1ec-08a3ffdcb744?source=cve; https://plugins.trac.wordpress.org/browser/social-warfare/trunk/lib/options/SWP_Options_Page.php?rev=2364155#L923
CVE: CVE-2023-0404
Published: 2023-01-19
Description: The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2836308%40events-made-easy&new=2836308%40events-made-easy&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2836308%40events-made-easy&new=2836308%40events-made-easy&sfp_email=&sfph_mail=
CVE: CVE-2022-47105
Published: 2023-01-19
Description: Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/jeecgboot/jeecg-boot/issues/4393; https://github.com/jeecgboot/jeecg-boot/issues/4393
CVE: CVE-2020-1713
Published: 2023-01-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.
CVE: CVE-2022-1676
Published: 2023-01-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-39167
Published: 2023-01-19
Description: 
IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle techniques. IBM X-Force ID: 235408.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235408; https://www.ibm.com/support/pages/node/6622025; https://exchange.xforce.ibmcloud.com/vulnerabilities/235408
CVE: CVE-2022-40697
Published: 2023-01-19
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/3com-asesor-de-cookies/wordpress-3com-asesor-de-cookies-plugin-3-4-3-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/3com-asesor-de-cookies/wordpress-3com-asesor-de-cookies-plugin-3-4-3-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2020-10692
Published: 2023-01-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.
CVE: CVE-2020-10694
Published: 2023-01-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.
CVE: CVE-2020-10764
Published: 2023-01-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.
CVE: CVE-2020-10765
Published: 2023-01-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.
CVE: CVE-2020-1715
Published: 2023-01-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.
CVE: CVE-2020-25679
Published: 2023-01-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.
CVE: CVE-2020-25714
Published: 2023-01-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.
CVE: CVE-2022-47194
Published: 2023-01-19
Description: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `twitter` field for a user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-453, CWE-79, CWE-1188
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1686
CVE: CVE-2022-47195
Published: 2023-01-19
Description: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `facebook` field for a user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-453, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1686
CVE: CVE-2022-47196
Published: 2023-01-19
Description: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_head` for a post.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-453, CWE-79, CWE-1188
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1686
CVE: CVE-2022-47197
Published: 2023-01-19
Description: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_foot` for a post.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-453, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1686
CVE: CVE-2022-47740
Published: 2023-01-19
Description: Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/blockomat2100/PoCs/blob/main/seltmann_gmbh_cms.md; https://github.com/blockomat2100/PoCs/blob/main/seltmann_gmbh_cms.md
CVE: CVE-2022-47745
Published: 2023-01-19
Description: ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a special request and sending it to function importNotice.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/easysoft/zentaopms/issues/106; https://github.com/l3s10n/ZenTaoPMS_SqlInjection; https://github.com/easysoft/zentaopms/issues/106
CVE: CVE-2023-0406
Published: 2023-01-19
Description: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/modoboa/modoboa/commit/7f0573e917227686d2cc127be1364e[PII_REDACTED]; https://huntr.dev/bounties/d7007f76-3dbc-48a7-a2fb-377040fe100c; https://github.com/modoboa/modoboa/commit/7f0573e917227686d2cc127be1364e[PII_REDACTED]