deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49994
Published: 2023-12-12
Description: Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-697
References: https://github.com/espeak-ng/espeak-ng/issues/1823; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/
CVE: CVE-2023-6193
Published: 2023-12-12
Description: quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption.
QUIC path validation (RFC 9000 Section 8.2) requires that the recipient of a PATH_CHALLENGE frame responds by sending a PATH_RESPONSE. An unauthenticated remote attacker can exploit the vulnerability by sending PATH_CHALLENGE frames and manipulating the connection (e.g. by restricting the peer's congestion window size) so that PATH_RESPONSE frames can only be sent at the slower rate than they are received; leading to storage of path validation data in an unbounded queue. 
Quiche versions greater than 0.19.0 address this problem.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://datatracker.ietf.org/doc/html/rfc9000#section-8.2; https://github.com/cloudflare/quiche/security/advisories/GHSA-w3vp-jw9m-f9pm; https://datatracker.ietf.org/doc/html/rfc9000#section-8.2
CVE: CVE-2020-12614
Published: 2023-12-12
Description: An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. If the publisher criteria is selected, it defines the name of a publisher that must be present in the certificate (and also requires that the certificate is valid). If an Add Admin token is protected by this criteria, it can be leveraged by a malicious actor to achieve Elevation of Privileges from standard user to administrator.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1; https://www.beyondtrust.com/trust-center/security-advisories/bt22-10; https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1
CVE: CVE-2020-28369
Published: 2023-12-12
Description: In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.beyondtrust.com/privilege-management/windows-mac; https://www.beyondtrust.com/trust-center/security-advisories/bt22-08; https://www.beyondtrust.com/privilege-management/windows-mac
CVE: CVE-2023-46454
Published: 2023-12-12
Description: In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://cyberaz0r.info/2023/11/glinet-multiple-vulnerabilities/; https://cyberaz0r.info/2023/11/glinet-multiple-vulnerabilities/
CVE: CVE-2023-46455
Published: 2023-12-12
Description: In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://cyberaz0r.info/2023/11/glinet-multiple-vulnerabilities/; https://www.gl-inet.com/; https://cyberaz0r.info/2023/11/glinet-multiple-vulnerabilities/
CVE: CVE-2023-46456
Published: 2023-12-12
Description: In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://cyberaz0r.info/2023/11/glinet-multiple-vulnerabilities/; https://www.gl-inet.com/; https://cyberaz0r.info/2023/11/glinet-multiple-vulnerabilities/
CVE: CVE-2023-50495
Published: 2023-12-12
Description: NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().
CVSS Score: 6.5 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/; https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html; https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html
CVE: CVE-2023-6593
Published: 2023-12-12
Description: 

Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.



CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://devolutions.net/security/advisories/DEVO-2023-0023/; https://devolutions.net/security/advisories/DEVO-2023-0023/
CVE: CVE-2009-4123
Published: 2023-12-12
Description: The jruby-openssl gem before 0.6 for JRuby mishandles SSL certificate validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://jruby.org/2009/12/07/vulnerability-in-jruby-openssl; https://github.com/advisories/GHSA-xgv7-pqqh-h2w9; https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jruby-openssl/CVE-2009-4123.yml
CVE: CVE-2013-2513
Published: 2023-12-12
Description: The flash_tool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/advisories/GHSA-6325-6g32-7p35; https://github.com/rubysec/ruby-advisory-db/blob/master/gems/flash_tool/CVE-2013-2513.yml; https://github.com/advisories/GHSA-6325-6g32-7p35
CVE: CVE-2015-2179
Published: 2023-12-12
Description: The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments.
CVSS Score: 5.5 (MEDIUM)
References: http://www.vapid.dhs.org/advisory.php?v=115; http://www.vapid.dhs.org/advisory.php?v=115
CVE: CVE-2015-8314
Published: 2023-12-12
Description: The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://github.com/advisories/GHSA-746g-3gfp-hfhw; https://github.com/heartcombo/devise/commit/c92996646aba2d25b2c3e235fe0c4f1a84b70d24; https://rubysec.com/advisories/CVE-2015-8314/
CVE: CVE-2018-16153
Published: 2023-12-12
Description: An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://docs.opencast.org/r/10.x/admin/#changelog; https://github.com/advisories/GHSA-hcxx-mp6g-6gr9; https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51
CVE: CVE-2020-10676
Published: 2023-12-12
Description: In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://forums.rancher.com/c/announcements; https://github.com/advisories/GHSA-8vhc-hwhc-cpj4; https://github.com/rancher/rancher/releases/tag/v2.6.13
CVE: CVE-2022-44543
Published: 2023-12-12
Description: The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled.
CVSS Score: 5.3 (MEDIUM)
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2022-015; https://typo3.org/help/security-advisories
CVE: CVE-2023-26920
Published: 2023-12-12
Description: fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1321
References: https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7; https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804; https://github.com/advisories/GHSA-793h-6f7r-6qvm
CVE: CVE-2023-28465
Published: 2023-12-12
Description: The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists because of an incomplete fix for CVE-2023-24057.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/advisories/GHSA-9654-pr4f-gh6m; https://www.smilecdr.com/our-blog; https://www.smilecdr.com/our-blog/statement-on-cve-2023-24057-smile-digital-health
CVE: CVE-2023-28604
Published: 2023-12-12
Description: The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases that may be edge cases.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sitegeist/fluid-components/blob/master/Documentation/XssIssue.md; https://typo3.org/security/advisory/typo3-ext-sa-2023-003; https://github.com/sitegeist/fluid-components/blob/master/Documentation/XssIssue.md
CVE: CVE-2023-31048
Published: 2023-12-12
Description: The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-31048.pdf; https://github.com/OPCFoundation/UA-.NETStandard/releases; https://github.com/OPCFoundation/UA-.NETStandard/releases/tag/1.4.371.86
CVE: CVE-2023-38694
Published: 2023-12-12
Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-xxc6-35r7-796w; https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-xxc6-35r7-796w
CVE: CVE-2023-48227
Published: 2023-12-12
Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a patch for this issue. No known workarounds are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2; https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2
CVE: CVE-2023-4421
Published: 2023-12-12
Description: The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS < 3.61.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1651411; https://www.mozilla.org/security/advisories/mfsa2023-53/; https://bugzilla.mozilla.org/show_bug.cgi?id=1651411
CVE: CVE-2023-20275
Published: 2023-12-12
Description: A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to send packets with another VPN user's source IP address. This vulnerability is due to improper validation of the packet's inner source IP address after decryption. An attacker could exploit this vulnerability by sending crafted packets through the tunnel. A successful exploit could allow the attacker to send a packet impersonating another VPN user's IP address. It is not possible for the attacker to receive return packets.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-346
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-vpn-Y88QOm77; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-vpn-Y88QOm77
CVE: CVE-2023-21740
Published: 2023-12-12
Description: Windows Media Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21740; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21740
CVE: CVE-2023-35619
Published: 2023-12-12
Description: Microsoft Outlook for Mac Spoofing Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35619; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35619
CVE: CVE-2023-35621
Published: 2023-12-12
Description: Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-799
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35621; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35621
CVE: CVE-2023-35622
Published: 2023-12-12
Description: Windows DNS Spoofing Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35622; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35622
CVE: CVE-2023-35624
Published: 2023-12-12
Description: Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35624; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35624
CVE: CVE-2023-35625
Published: 2023-12-12
Description: Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35625; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35625
CVE: CVE-2023-35628
Published: 2023-12-12
Description: Windows MSHTML Platform Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35628; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35628
CVE: CVE-2023-35629
Published: 2023-12-12
Description: Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35629; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35629
CVE: CVE-2023-35630
Published: 2023-12-12
Description: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35630; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35630
CVE: CVE-2023-35631
Published: 2023-12-12
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35631; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35631
CVE: CVE-2023-35632
Published: 2023-12-12
Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35632; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35632
CVE: CVE-2023-35633
Published: 2023-12-12
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35633; http://packetstormsecurity.com/files/176451/Microsoft-Windows-Registry-Predefined-Keys-Privilege-Escalation.html; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35633
CVE: CVE-2023-35634
Published: 2023-12-12
Description: Windows Bluetooth Driver Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35634; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35634
CVE: CVE-2023-35635
Published: 2023-12-12
Description: Windows Kernel Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35635; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35635
CVE: CVE-2023-35636
Published: 2023-12-12
Description: Microsoft Outlook Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35636; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35636
CVE: CVE-2023-35638
Published: 2023-12-12
Description: DHCP Server Service Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35638; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35638
CVE: CVE-2023-35639
Published: 2023-12-12
Description: Microsoft ODBC Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35639; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35639
CVE: CVE-2023-35641
Published: 2023-12-12
Description: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-682
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35641; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35641
CVE: CVE-2023-35642
Published: 2023-12-12
Description: Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-682
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35642; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35642
CVE: CVE-2023-35643
Published: 2023-12-12
Description: DHCP Server Service Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35643; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35643
CVE: CVE-2023-35644
Published: 2023-12-12
Description: Windows Sysmain Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35644; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35644
CVE: CVE-2023-36003
Published: 2023-12-12
Description: XAML Diagnostics Elevation of Privilege Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36003; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36003
CVE: CVE-2023-36004
Published: 2023-12-12
Description: Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36004; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36004
CVE: CVE-2023-36005
Published: 2023-12-12
Description: Windows Telephony Server Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36005; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36005
CVE: CVE-2023-36006
Published: 2023-12-12
Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36006; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36006
CVE: CVE-2023-36009
Published: 2023-12-12
Description: Microsoft Word Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36009; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36009
CVE: CVE-2023-36010
Published: 2023-12-12
Description: Microsoft Defender Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36010; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36010
CVE: CVE-2023-36011
Published: 2023-12-12
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36011; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36011
CVE: CVE-2023-36012
Published: 2023-12-12
Description: DHCP Server Service Information Disclosure Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36012; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36012
CVE: CVE-2023-36019
Published: 2023-12-12
Description: Microsoft Power Platform Connector Spoofing Vulnerability
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36019; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36019
CVE: CVE-2023-36020
Published: 2023-12-12
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36020; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36020
CVE: CVE-2023-36391
Published: 2023-12-12
Description: Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36391; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36391
CVE: CVE-2023-36696
Published: 2023-12-12
Description: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36696; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36696
CVE: CVE-2023-43364
Published: 2023-12-12
Description: main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-94
References: https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b; https://github.com/ArjunSharda/Searchor/pull/130; https://github.com/advisories/GHSA-66m2-493m-crh2
CVE: CVE-2023-48313
Published: 2023-12-12
Description: Umbraco is an ASP.NET content management system (CMS).  Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-v98m-398x-269r; https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-v98m-398x-269r