deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4161
Published: 2023-08-31
Description: The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can trick an admin into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/trunk/woocommerce-pdf-invoice-ajax.php?rev=2935371#L654; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2953379%40woo-pdf-invoice-builder%2Ftrunk&old=2951617%40woo-pdf-invoice-builder%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7aac1c-6962-49cf-850f-ab7b1d220090?source=cve
CVE: CVE-2023-4245
Published: 2023-08-31
Description: The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/trunk/woocommerce-pdf-invoice-ajax.php#L425; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2955112%40woo-pdf-invoice-builder%2Ftrunk&old=2953379%40woo-pdf-invoice-builder%2Ftrunk&sfp_email=&sfph_mail=#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/200fbfc1-df21-43b0-8eb1-b2ba0cc0c0df?source=cve
CVE: CVE-2023-4315
Published: 2023-08-31
Description: The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemails_edit' parameter in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-45004 appears to be a duplicate of this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-custom-emails/trunk/admin/class-wcemails-admin.php#L335; https://www.wordfence.com/threat-intel/vulnerabilities/id/6782d8b3-32f9-42e1-874c-35a1e93ffde0?source=cve; https://plugins.trac.wordpress.org/browser/woo-custom-emails/trunk/admin/class-wcemails-admin.php#L335
CVE: CVE-2023-4471
Published: 2023-08-31
Description: The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/order-tracking/trunk/includes/Export.class.php#L158; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2959453%40order-tracking%2Ftrunk&old=2949611%40order-tracking%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ed64d0ff-4f49-4c18-86ec-2c6fbd559d2e?source=cve
CVE: CVE-2023-4500
Published: 2023-08-31
Description: The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers (admin or higher) to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2959453%40order-tracking%2Ftrunk&old=2949611%40order-tracking%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/81f9a4c6-971f-4f6d-8bb1-e97bf75cf8d3?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2959453%40order-tracking%2Ftrunk&old=2949611%40order-tracking%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-20900
Published: 2023-08-31
Description: A malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged  Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
CVSS Score: 7.1 (HIGH)
CWE: CWE-294
References: http://www.openwall.com/lists/oss-security/2023/08/31/1; http://www.openwall.com/lists/oss-security/2023/10/27/1; https://lists.debian.org/debian-lts-announce/2023/10/msg00000.html
CVE: CVE-2023-41738
Published: 2023-08-31
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: https://www.synology.com/en-global/security/advisory/Synology_SA_23_10; https://www.synology.com/en-global/security/advisory/Synology_SA_23_10
CVE: CVE-2023-41739
Published: 2023-08-31
Description: Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to conduct denial-of-service attacks via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: https://www.synology.com/en-global/security/advisory/Synology_SA_23_10; https://www.synology.com/en-global/security/advisory/Synology_SA_23_10
CVE: CVE-2023-41740
Published: 2023-08-31
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to read specific files via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
References: https://www.synology.com/en-global/security/advisory/Synology_SA_23_10; https://www.synology.com/en-global/security/advisory/Synology_SA_23_10
CVE: CVE-2023-41741
Published: 2023-08-31
Description: Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
References: https://www.synology.com/en-global/security/advisory/Synology_SA_23_10; https://www.synology.com/en-global/security/advisory/Synology_SA_23_10
CVE: CVE-2023-33833
Published: 2023-08-31
Description: IBM Security Verify Information Queue 10.0.4 and 10.0.5 stores sensitive information in plain clear text which can be read by a local user.  IBM X-Force ID:  256013.
CVSS Score: 2.9 (LOW)
CWE: CWE-311, CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/256013; https://www.ibm.com/support/pages/node/7029584; https://exchange.xforce.ibmcloud.com/vulnerabilities/256013
CVE: CVE-2023-28801
Published: 2023-08-31
Description: An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r.


CVSS Score: 9.6 (CRITICAL)
CWE: CWE-347, CWE-347
References: https://help.zscaler.com/zia/release-upgrade-summary-2023; https://help.zscaler.com/zia/release-upgrade-summary-2023
CVE: CVE-2023-33834
Published: 2023-08-31
Description: IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system.  IBM X-force ID:  256014.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/256014; https://www.ibm.com/support/pages/node/7029584; https://exchange.xforce.ibmcloud.com/vulnerabilities/256014
CVE: CVE-2023-33835
Published: 2023-08-31
Description: IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system.  IBM X-Force ID:  256015.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/256015; https://www.ibm.com/support/pages/node/7029584; https://exchange.xforce.ibmcloud.com/vulnerabilities/256015
CVE: CVE-2023-41635
Published: 2023-08-31
Description: A XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the filesystem via supplying a crafted XML file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-776
References: https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41635%20%7C%20RealGimm%20-%20XML%20External%20Entity%20Injection.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20XML%20External%20Entity%20Injection.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41635%20%7C%20RealGimm%20-%20XML%20External%20Entity%20Injection.md
CVE: CVE-2023-41636
Published: 2023-08-31
Description: A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38 allows attackers to access the database and execute arbitrary commands via a crafted SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41636%20%7C%20RealGimm%20-%20SQL%20Injection%281%29.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20SQL%20Injection%281%29.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41636%20%7C%20RealGimm%20-%20SQL%20Injection%281%29.md
CVE: CVE-2023-41637
Published: 2023-08-31
Description: An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted HTML file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41637%20%7C%20RealGimm%20-%20Stored%20Cross-site%20Scripting.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20Stored%20Cross-site%20Scripting.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41637%20%7C%20RealGimm%20-%20Stored%20Cross-site%20Scripting.md
CVE: CVE-2023-41638
Published: 2023-08-31
Description: An arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41638%20%7C%20RealGimm%20-%20RCE%20via%20Unrestricted%20File%20Upload.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20RCE%20via%20Unrestricted%20File%20Upload.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41638%20%7C%20RealGimm%20-%20RCE%20via%20Unrestricted%20File%20Upload.md
CVE: CVE-2023-41640
Published: 2023-08-31
Description: An improper error handling vulnerability in the component ErroreNonGestito.aspx of GruppoSCAI RealGimm 1.1.37p38 allows attackers to obtain sensitive technical information via a crafted SQL query.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41640%20%7C%20RealGimm%20-%20Information%20disclosure.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20Information%20disclosure.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41640%20%7C%20RealGimm%20-%20Information%20disclosure.md
CVE: CVE-2023-41642
Published: 2023-08-31
Description: Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41642%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41642%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md
CVE: CVE-2022-45451
Published: 2023-08-31
Description: Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173, Acronis Agent (Windows) before build 30600, Acronis Cyber Protect 15 (Windows) before build 30984.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://security-advisory.acronis.com/SEC-5487; https://security-advisory.acronis.com/advisories/SEC-4858; https://security-advisory.acronis.com/SEC-5487
CVE: CVE-2022-46868
Published: 2023-08-31
Description: Local privilege escalation during recovery due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173.
CVSS Score: 7.8 (HIGH)
CWE: CWE-610, CWE-610
References: https://security-advisory.acronis.com/advisories/SEC-2499; https://security-advisory.acronis.com/advisories/SEC-2499
CVE: CVE-2023-41742
Published: 2023-08-31
Description: Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1327, CWE-668
References: https://security-advisory.acronis.com/advisories/SEC-4351; https://security-advisory.acronis.com/advisories/SEC-4351
CVE: CVE-2023-31167
Published: 2023-08-31
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Screen Builder Software on Windows allows Relative Path Traversal.



SEL acSELerator Bay Screen Builder software is distributed by SEL-5033 SEL acSELerator RTAC, SEL-5030 Quickset, and SEL Compass. CVE-2023-31167 and was patched in the acSELerator Bay Screen Builder release available on 20230602. Please contact SEL for additional details.


This issue affects SEL-5036 acSELerator Bay Screen Builder Software: before 1.0.49152.778.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://dragos.com; https://selinc.com/support/security-notifications/external-reports/; https://dragos.com
CVE: CVE-2023-31168
Published: 2023-08-31
Description: 
An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.



See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.






This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-829, CWE-829
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31169
Published: 2023-08-31
Description: 
An Improper Handling of Unicode Encoding vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.
This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


CVSS Score: 4.8 (MEDIUM)
CWE: CWE-176, CWE-755
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31170
Published: 2023-08-31
Description: 
An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.



See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.




This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-829, CWE-829
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31171
Published: 2023-08-31
Description: 
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31172
Published: 2023-08-31
Description: 
An Incomplete Filtering of Special Elements vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-791
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31173
Published: 2023-08-31
Description: Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass.



See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.


CVSS Score: 7.7 (HIGH)
CWE: CWE-798, CWE-798
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31174
Published: 2023-08-31
Description: 
A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.


CVSS Score: 7.4 (HIGH)
CWE: CWE-352, CWE-352
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31175
Published: 2023-08-31
Description: 
An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.


CVSS Score: 8.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-34391
Published: 2023-08-31
Description: Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulating Configuration File Search Paths.

See Instruction Manual Appendix A [Cybersecurity] tag dated 20230522 for more details.
 
This issue affects SEL-5033 AcSELerator RTAC Software: before 1.35.151.21000.


CVSS Score: 7.4 (HIGH)
CWE: CWE-277, CWE-732
References: https://dragos.com; https://selinc.com/support/security-notifications/external-reports/; https://dragos.com
CVE: CVE-2023-34392
Published: 2023-08-31
Description: 
A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run arbitrary commands on managed devices by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.


CVSS Score: 8.2 (HIGH)
CWE: CWE-306, CWE-306
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-41717
Published: 2023-08-31
Description: Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-552
References: https://github.com/federella/CVE-2023-41717; https://github.com/federella/CVE-2023-41717
CVE: CVE-2023-41743
Published: 2023-08-31
Description: Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Cyber Protect Cloud Agent (Windows) before build 31637, Acronis Cyber Protect 15 (Windows) before build 35979, Acronis True Image OEM (Windows) before build 42575.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://security-advisory.acronis.com/SEC-4858; https://security-advisory.acronis.com/advisories/SEC-5487; https://security-advisory.acronis.com/SEC-4858
CVE: CVE-2023-41744
Published: 2023-08-31
Description: Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Agent (macOS) before build 30600, Acronis Cyber Protect 15 (macOS) before build 35979.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347, CWE-347
References: https://security-advisory.acronis.com/advisories/SEC-4728; https://security-advisory.acronis.com/advisories/SEC-4728