deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49403
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setFixTools.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_setFixTools/w30e_setFixTools.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_setFixTools/w30e_setFixTools.md
CVE: CVE-2023-49410
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function via the function set_wan_status.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_setIPv6Status/w30e_setIPv6Status.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_setIPv6Status/w30e_setIPv6Status.md
CVE: CVE-2023-49999
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setUmountUSBPartition.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_setUmountUSBPartition/w30e_setUmountUSBPartition.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_setUmountUSBPartition/w30e_setUmountUSBPartition.md
CVE: CVE-2023-50000
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_resetMesh/w30e_resetMesh.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_resetMesh/w30e_resetMesh.md
CVE: CVE-2023-50001
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_upgradeMeshOnline/w30e_upgradeMeshOnline.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_upgradeMeshOnline/w30e_upgradeMeshOnline.md
CVE: CVE-2023-50002
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_rebootMesh/w30e_rebootMesh.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_rebootMesh/w30e_rebootMesh.md
CVE: CVE-2023-33411
Published: 2023-12-07
Description: A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://supermicro.com; https://www.supermicro.com/en/support/security_BMC_Dec_2023; http://supermicro.com
CVE: CVE-2023-33412
Published: 2023-12-07
Description: The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints.
CVSS Score: 8.8 (HIGH)
References: http://supermicro.com; https://www.supermicro.com/en/support/security_BMC_Dec_2023; http://supermicro.com
CVE: CVE-2023-33413
Published: 2023-12-07
Description: The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: http://supermicro.com; https://www.supermicro.com/en/support/security_BMC_Dec_2023; http://supermicro.com
CVE: CVE-2023-39909
Published: 2023-12-07
Description: Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application.
CVSS Score: 8.8 (HIGH)
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2023-40300
Published: 2023-12-07
Description: NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2023-40301
Published: 2023-12-07
Description: NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2023-40302
Published: 2023-12-07
Description: NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2023-41168
Published: 2023-12-07
Description: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 1 of 4).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2023-41169
Published: 2023-12-07
Description: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 2 of 4).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2023-41170
Published: 2023-12-07
Description: NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2023-41171
Published: 2023-12-07
Description: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 3 of 4).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2023-41172
Published: 2023-12-07
Description: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 4 of 4).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2023-41905
Published: 2023-12-07
Description: NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2023-46871
Published: 2023-12-07
Description: GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300. This vulnerability may lead to a denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401
References: https://gist.github.com/ReturnHere/d0899bb03b8f5e8fae118f2b76888486; https://github.com/gpac/gpac/issues/2658; https://gist.github.com/ReturnHere/d0899bb03b8f5e8fae118f2b76888486
CVE: CVE-2023-47440
Published: 2023-12-07
Description: Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://blog.moku.fr/cve/; https://blog.moku.fr/cves/CVE-2023-47440/; https://github.com/GladysAssistant/Gladys/pull/1918/commits/4f56ba250ff9f46578f1afa6a97e62e74bad83b7
CVE: CVE-2023-48958
Published: 2023-12-07
Description: gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url media_tools/mpd.c:4589.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://gist.github.com/dr0v/1204f7a5f1e1497e7bca066638acfbf5; https://github.com/gpac/gpac/issues/2689; https://gist.github.com/dr0v/1204f7a5f1e1497e7bca066638acfbf5
CVE: CVE-2023-49404
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_setAdvancedSetList/w30e_setAdvancedSetList.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_setAdvancedSetList/w30e_setAdvancedSetList.md
CVE: CVE-2023-49405
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function UploadCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_UploadCfg/w30e_UploadCfg.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_UploadCfg/w30e_UploadCfg.md
CVE: CVE-2023-49406
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_telnet/w30e_telnet.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_telnet/w30e_telnet.md
CVE: CVE-2023-49408
Published: 2023-12-07
Description: Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the function set_device_name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/TENDA/blob/main/AX3/tenda_AX3_setBlackRule/AX3-setBlackRule.md; https://github.com/GD008/TENDA/blob/main/AX3/tenda_AX3_setBlackRule/AX3-setBlackRule.md
CVE: CVE-2023-49409
Published: 2023-12-07
Description: Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/GD008/TENDA/blob/main/AX3/tenda_AX3_telnet/AX3_telnet.md; https://github.com/GD008/TENDA/blob/main/AX3/tenda_AX3_telnet/AX3_telnet.md
CVE: CVE-2023-49411
Published: 2023-12-07
Description: Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_deleteMesh/w30e_deleteMesh.md; https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_deleteMesh/w30e_deleteMesh.md
CVE: CVE-2023-49787
Published: 2023-12-07
Description: Rejected reason: CVE request originates from private repository
CVE: CVE-2023-6333
Published: 2023-12-07
Description: 
The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session.





CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-05
CVE: CVE-2023-49460
Published: 2023-12-07
Description: libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image.
CVSS Score: 8.8 (HIGH)
References: https://github.com/strukturag/libheif/issues/1046; https://github.com/strukturag/libheif/issues/1046
CVE: CVE-2023-49462
Published: 2023-12-07
Description: libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc.
CVSS Score: 8.8 (HIGH)
References: https://github.com/strukturag/libheif/issues/1043; https://github.com/strukturag/libheif/issues/1043
CVE: CVE-2023-49463
Published: 2023-12-07
Description: libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.
CVSS Score: 8.8 (HIGH)
References: https://github.com/strukturag/libheif; https://github.com/strukturag/libheif/issues/1042; https://github.com/strukturag/libheif
CVE: CVE-2023-49464
Published: 2023-12-07
Description: libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci.
CVSS Score: 8.8 (HIGH)
References: https://github.com/strukturag/libheif/issues/1044; https://github.com/strukturag/libheif/issues/1044
CVE: CVE-2023-49465
Published: 2023-12-07
Description: Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function at motion.cc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/strukturag/libde265/issues/435; https://lists.debian.org/debian-lts-announce/2023/12/msg00022.html; https://github.com/strukturag/libde265/issues/435
CVE: CVE-2023-49467
Published: 2023-12-07
Description: Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merging_candidates function at motion.cc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/strukturag/libde265/issues/434; https://lists.debian.org/debian-lts-announce/2023/12/msg00022.html; https://github.com/strukturag/libde265/issues/434
CVE: CVE-2023-49468
Published: 2023-12-07
Description: Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit function at slice.cc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-120
References: https://github.com/strukturag/libde265/issues/432; https://lists.debian.org/debian-lts-announce/2023/12/msg00022.html; https://github.com/strukturag/libde265/issues/432
CVE: CVE-2023-4486
Published: 2023-12-07
Description: Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to 

versions 11.0.6 and 12.0.4

 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-03; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-03
CVE: CVE-2023-6574
Published: 2023-12-07
Description: A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php of the component HTTP POST Request Handler. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247154 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/flyyue2001/cve/blob/main/smart_sql_updateos.md; https://vuldb.com/?ctiid.247154; https://vuldb.com/?id.247154
CVE: CVE-2023-6575
Published: 2023-12-07
Description: A vulnerability was found in Byzoro S210 up to 20231121. It has been classified as critical. This affects an unknown part of the file /Tool/repair.php of the component HTTP POST Request Handler. The manipulation of the argument txt leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247155. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/houhuidong/cve/blob/main/rce.md; https://vuldb.com/?ctiid.247155; https://vuldb.com/?id.247155
CVE: CVE-2023-35618
Published: 2023-12-07
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35618; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35618; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-36880
Published: 2023-12-07
Description: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVSS Score: 4.8 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36880; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36880; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-38174
Published: 2023-12-07
Description: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38174; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38174; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-6576
Published: 2023-12-07
Description: A vulnerability was found in Byzoro S210 up to 20231123. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php of the component HTTP POST Request Handler. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247156. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/willchen0011/cve/blob/main/upload.md; https://vuldb.com/?ctiid.247156; https://vuldb.com/?id.247156
CVE: CVE-2023-6577
Published: 2023-12-07
Description: A vulnerability was found in Byzoro PatrolFlow 2530Pro up to 20231126. It has been rated as problematic. This issue affects some unknown processing of the file /log/mailsendview.php. The manipulation of the argument file with the input /boot/phpConfig/tb_admin.txt leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/kpz-wm/cve/blob/main/Any_file_read.md; https://vuldb.com/?ctiid.247157; https://vuldb.com/?id.247157
CVE: CVE-2023-6578
Published: 2023-12-07
Description: A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch the attack remotely. To access a file like /assets/ a popup may request username and password. By just clicking CANCEL you will be redirected to the directory. If you visited /invoke/wm.server/connect, you'll be able to see details like internal IPs, ports, and versions. In some cases if access to /assets/ is refused, you may enter /assets/x as a wrong value, then come back to /assets/ which we will show the requested data. It appears that insufficient access control is depending on referrer header data. VDB-247158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://vuldb.com/?ctiid.247158; https://vuldb.com/?id.247158; https://vuldb.com/?ctiid.247158
CVE: CVE-2023-46693
Published: 2023-12-07
Description: Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.formalms.org/download/342-forma-lms-4-0-5.html; https://www.formalms.org/download/342-forma-lms-4-0-5.html
CVE: CVE-2023-6579
Published: 2023-12-07
Description: A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-supermarket/shopping-cart of the component POST Parameter Handler. The manipulation of the argument estimate[country_id] leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-247160. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/176124/osCommerce-4-SQL-Injection.html; https://vuldb.com/?ctiid.247160; https://vuldb.com/?id.247160
CVE: CVE-2023-6580
Published: 2023-12-07
Description: A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component QoS POST Handler. The manipulation of the argument smartqos_express_devices/smartqos_normal_devices leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247161 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/c2dc/cve-reported/blob/main/CVE-2023-6580/CVE-2023-6580.md; https://vuldb.com/?ctiid.247161; https://vuldb.com/?id.247161
CVE: CVE-2023-6581
Published: 2023-12-07
Description: A vulnerability has been found in D-Link DAR-7000 up to 20231126 and classified as critical. This vulnerability affects unknown code of the file /user/inc/workidajax.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-247162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000_sql_workidajax.md; https://vuldb.com/?ctiid.247162; https://vuldb.com/?id.247162
CVE: CVE-2023-4122
Published: 2023-12-07
Description: Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://fluidattacks.com/advisories/rubinstein/; https://www.kashipara.com/; https://fluidattacks.com/advisories/rubinstein/
CVE: CVE-2023-5058
Published: 2023-12-07
Description: Improper Input Validation in the processing of user-supplied splash screen during system boot in Phoenix SecureCore™ Technology™ 4 potentially allows denial-of-service attacks or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://phoenixtech.com/phoenix-security-notifications/cve-2023-5058/; https://www.kb.cert.org/vuls/id/811862; https://www.kb.cert.org/vuls/id/811862
CVE: CVE-2023-5008
Published: 2023-12-08
Description: Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/blechacz/; https://www.kashipara.com/; https://fluidattacks.com/advisories/blechacz/
CVE: CVE-2023-6061
Published: 2023-12-08
Description: Rejected reason: This CVE ID has been rejected/withdrawn by its CVE Numbering Authority (Palo Alto Networks) based on discussions with Mitsubishi Electronics Corporation's PSIRT.
CVE: CVE-2023-6599
Published: 2023-12-08
Description: Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-544, CWE-755
References: https://github.com/microweber/microweber/commit/f7eb9e1c6e801346f07f3b0164a01ac5f2ca5cfd; https://huntr.com/bounties/6198785c-bf60-422e-9b80-68a6e658a10e; https://github.com/microweber/microweber/commit/f7eb9e1c6e801346f07f3b0164a01ac5f2ca5cfd