deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-44273
Published: 2023-09-28
Description: Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/Consensys/gnark-crypto/pull/449; https://github.com/Consensys/gnark-crypto/releases; https://verichains.io
CVE: CVE-2023-26145
Published: 2023-09-28
Description: This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.**Note:**The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-77, CWE-94
References: https://gist.github.com/CalumHutton/45d33e9ea55bf4953b3b31c84703dfca; https://github.com/dgilland/pydash/commit/6ff0831ad285fff937cafd2a853f20cc9ae92021; https://security.snyk.io/vuln/SNYK-PYTHON-PYDASH-5916518
CVE: CVE-2023-26149
Published: 2023-09-28
Description: Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. **Note:**If the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection attack when a Quill user hits @.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://codepen.io/ALiangLiang/pen/mdQMJXK; https://github.com/quill-mention/quill-mention/blob/0aa[PII_REDACTED]496b14ac5401872c4e2ffcbc3d1/src/quill.mention.js%23L391; https://github.com/quill-mention/quill-mention/commit/e85262ddced0a7f0b6fc8350d236a68bd1e28385
CVE: CVE-2023-44275
Published: 2023-09-28
Description: OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/opnsense/core/commit/484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7; https://github.com/opnsense/core/compare/23.7.4...23.7.5; https://www.x41-dsec.de/lab/advisories/x41-2023-001-opnsense
CVE: CVE-2023-44276
Published: 2023-09-28
Description: OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/opnsense/core/commit/484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7; https://github.com/opnsense/core/compare/23.7.4...23.7.5; https://www.x41-dsec.de/lab/advisories/x41-2023-001-opnsense
CVE: CVE-2023-5230
Published: 2023-09-28
Description: The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcode in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/tm-woocommerce-compare-wishlist/tags/1.1.7/includes/wishlist/wishlist.php#L339; https://www.wordfence.com/threat-intel/vulnerabilities/id/771ecb8c-feb1-40ea-b47b-a2ae033b3c87?source=cve; https://plugins.trac.wordpress.org/browser/tm-woocommerce-compare-wishlist/tags/1.1.7/includes/wishlist/wishlist.php#L339
CVE: CVE-2023-5232
Published: 2023-09-28
Description: The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/font-awesome-more-icons/tags/3.5/plugin.php#L82; https://www.wordfence.com/threat-intel/vulnerabilities/id/15947764-a070-4715-bd44-cb79b62ed59d?source=cve; https://plugins.trac.wordpress.org/browser/font-awesome-more-icons/tags/3.5/plugin.php#L82
CVE: CVE-2023-5233
Published: 2023-09-28
Description: The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/font-awesome-integration/tags/5.0/font-awesome-integration.php#L48; https://www.wordfence.com/threat-intel/vulnerabilities/id/a2791f48-895f-4099-87ec-41aaac2494a2?source=cve; https://plugins.trac.wordpress.org/browser/font-awesome-integration/tags/5.0/font-awesome-integration.php#L48
CVE: CVE-2023-43869
Published: 2023-09-28
Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard56 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE: CVE-2022-47186
Published: 2023-09-28
Description: There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.generex.de/support/changelogs/cs141/page:2; https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141; https://www.generex.de/support/changelogs/cs141/page:2
CVE: CVE-2022-47187
Published: 2023-09-28
Description: There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.generex.de/support/changelogs/cs141/2-12; https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141; https://www.generex.de/support/changelogs/cs141/2-12
CVE: CVE-2023-40307
Published: 2023-09-28
Description: An attacker with standard privileges on macOS when requesting administrator privileges from the application can submit input which causes a buffer overflow resulting in a crash of the application. This could make the application unavailable and allow reading or modification of data.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787
References: https://github.com/SAP/macOS-enterprise-privileges/security/advisories/GHSA-rgq4-wxpj-5jv9; https://github.com/SAP/macOS-enterprise-privileges/security/advisories/GHSA-rgq4-wxpj-5jv9
CVE: CVE-2023-42756
Published: 2023-09-28
Description: A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://access.redhat.com/errata/RHSA-2024:2394; https://access.redhat.com/security/cve/CVE-2023-42756; https://bugzilla.redhat.com/show_bug.cgi?id=2239848
CVE: CVE-2023-43860
Published: 2023-09-28
Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanNonLogin function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE: CVE-2023-43861
Published: 2023-09-28
Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPPoE function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE: CVE-2023-43862
Published: 2023-09-28
Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formLanguageChange function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE: CVE-2023-43863
Published: 2023-09-28
Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanDhcpplus function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE: CVE-2023-43864
Published: 2023-09-28
Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard55 function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE: CVE-2023-43865
Published: 2023-09-28
Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPTP function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE: CVE-2023-43866
Published: 2023-09-28
Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard7 function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE: CVE-2023-43867
Published: 2023-09-28
Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanL2TP function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE: CVE-2023-43868
Published: 2023-09-28
Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via websGetVar function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE: CVE-2023-43871
Published: 2023-09-28
Description: A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media/blob/main/README.md; https://github.com/sromanhu/WBCE-File-Upload--XSS---Media/blob/main/README.md; https://github.com/sromanhu/CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media/blob/main/README.md
CVE: CVE-2023-43872
Published: 2023-09-28
Description: A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CMSmadesimple-File-Upload--XSS---File-Manager; https://github.com/sromanhu/CMSmadesimple-File-Upload--XSS---File-Manager
CVE: CVE-2023-43873
Published: 2023-09-28
Description: A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/e107-CMS-Stored-XSS---Manage/blob/main/README.md; https://github.com/sromanhu/e107-CMS-Stored-XSS---Manage/blob/main/README.md
CVE: CVE-2023-43874
Published: 2023-09-28
Description: Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sromanhu/e107-CMS-Stored-XSS---MetaCustomTags/blob/main/README.md; https://github.com/sromanhu/e107-CMS-Stored-XSS---MetaCustomTags/blob/main/README.md
CVE: CVE-2023-5215
Published: 2023-09-28
Description: A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-241, CWE-252
References: https://access.redhat.com/errata/RHSA-2024:2204; https://access.redhat.com/security/cve/CVE-2023-5215; https://bugzilla.redhat.com/show_bug.cgi?id=2241041
CVE: CVE-2023-43876
Published: 2023-09-28
Description: A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/October-CMS-Reflected-XSS---Installation/blob/main/README.md; https://github.com/sromanhu/October-CMS-Reflected-XSS---Installation/blob/main/README.md
CVE: CVE-2023-43878
Published: 2023-09-28
Description: Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a crafted payload into the Main Menu Items in the Administration Menu.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/RiteCMS-Stored-XSS---MainMenu/blob/main/README.md; https://github.com/sromanhu/RiteCMS-Stored-XSS---MainMenu/blob/main/README.md
CVE: CVE-2023-43879
Published: 2023-09-28
Description: Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload into the Global Content Blocks in the Administration Menu.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sromanhu/RiteCMS-Stored-XSS---GlobalContent/tree/main; https://github.com/sromanhu/RiteCMS-Stored-XSS---GlobalContent/tree/main
CVE: CVE-2023-43884
Published: 2023-09-28
Description: A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/dpuenteramirez/XSS-ReferenceID-Subrion_4.2.1; https://github.com/dpuenteramirez/XSS-ReferenceID-Subrion_4.2.1
CVE: CVE-2023-30415
Published: 2023-09-28
Description: Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /inquiries/view_inquiry.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/174758/Packers-And-Movers-Management-System-1.0-SQL-Injection.html; https://robsware.github.io/2023/09/01/firstcve; http://packetstormsecurity.com/files/174758/Packers-And-Movers-Management-System-1.0-SQL-Injection.html
CVE: CVE-2023-5186
Published: 2023-09-28
Description: Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html; https://crbug.com/1478889; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
CVE: CVE-2023-5187
Published: 2023-09-28
Description: Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html; https://crbug.com/1475798; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
CVE: CVE-2023-5217
Published: 2023-09-28
Description: Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2023/Oct/12; http://seclists.org/fulldisclosure/2023/Oct/16; http://www.openwall.com/lists/oss-security/2023/09/28/5
CVE: CVE-2023-39195
Published: 2023-09-28
Description: Rejected reason: CVE-2023-39195 was found to be a duplicate of CVE-2023-42755. Please see https://access.redhat.com/security/cve/CVE-2023-42755 for more information.
CVE: CVE-2023-40375
Published: 2023-09-28
Description: Integrated application server for IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability.  A malicious actor with command line access to the host operating system can elevate privileges to gain root access to the host operating system.  IBM X-Force ID:  263580.
CVSS Score: 7.4 (HIGH)
CWE: CWE-269, CWE-269
References: https://https://exchange.xforce.ibmcloud.com/vulnerabilities/263580; https://www.ibm.com/support/pages/node/7038748; https://https://exchange.xforce.ibmcloud.com/vulnerabilities/263580
CVE: CVE-2023-43044
Published: 2023-09-28
Description: IBM License Metric Tool 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  266893.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266893; https://https://www.ibm.com/support/pages/node/7040605; https://exchange.xforce.ibmcloud.com/vulnerabilities/266893
CVE: CVE-2023-43657
Published: 2023-09-28
Description: discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit `9c75810af9` which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP; https://github.com/discourse/discourse-encrypt/commit/9c75810af9a474d7edaec67dea66f852c0ba1f4e; https://github.com/discourse/discourse-encrypt/security/advisories/GHSA-5fh6-wp7p-xx7v
CVE: CVE-2023-43663
Published: 2023-09-28
Description: PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit `ce1f6708` addresses this issue and is included in version 8.1.2. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269
References: https://github.com/PrestaShop/PrestaShop/commit/ce1f[PII_REDACTED]4e974caf86c57e547a0aaa46cd; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-6jmf-2pfc-q9m7; https://github.com/PrestaShop/PrestaShop/commit/ce1f[PII_REDACTED]4e974caf86c57e547a0aaa46cd
CVE: CVE-2023-43664
Published: 2023-09-28
Description: PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been addressed in commit `15bd281c` which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://github.com/PrestaShop/PrestaShop/commit/15bd281c18f032a5134a8d213b44d24829d45762; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gvrg-62jp-rf7j; https://github.com/PrestaShop/PrestaShop/commit/15bd281c18f032a5134a8d213b44d24829d45762
CVE: CVE-2023-5256
Published: 2023-09-28
Description: In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.

This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.

The core REST and contributed GraphQL modules are not affected.




CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.drupal.org/sa-core-2023-006; https://www.drupal.org/sa-core-2023-006
CVE: CVE-2023-43226
Published: 2023-09-28
Description: An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/zzq66/cve/; https://github.com/zzq66/cve/
CVE: CVE-2023-43323
Published: 2023-09-28
Description: mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, data[wall_photo], data[userShareVideo] and data[userShareLink].
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-15
References: https://github.com/ahrixia/CVE-2023-43323; https://github.com/ahrixia/CVE-2023-43323
CVE: CVE-2023-41911
Published: 2023-09-28
Description: Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-415
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/