deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3993
Published: 2023-08-02
Description: An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532
References: https://gitlab.com/gitlab-org/gitlab/-/issues/409570; https://gitlab.com/gitlab-org/gitlab/-/issues/409570
CVE: CVE-2023-3994
Published: 2023-08-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/gitlab/-/issues/416225; https://hackerone.com/reports/1963255; https://gitlab.com/gitlab-org/gitlab/-/issues/416225
CVE: CVE-2022-2346
Published: 2023-08-02
Description: In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.
CVSS Score: 5.5 (MEDIUM)
References: https://advisories.octopus.com/post/2023/sa2023-10/; https://advisories.octopus.com/post/2023/sa2023-10/
CVE: CVE-2023-4016
Published: 2023-08-02
Description: Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.
CVSS Score: 2.5 (LOW)
CWE: CWE-122, CWE-787
References: https://gitlab.com/procps-ng/procps; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SUETRRT24OFGPYK6ACPM5VUGHNKH5CQ5/; https://gitlab.com/procps-ng/procps
CVE: CVE-2022-2416
Published: 2023-08-02
Description: In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918
References: https://advisories.octopus.com/post/2023/sa2023-11/; https://advisories.octopus.com/post/2023/sa2023-11/
CVE: CVE-2023-4011
Published: 2023-08-02
Description: An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/409367; https://gitlab.com/gitlab-org/gitlab/-/issues/409367
CVE: CVE-2023-38556
Published: 2023-08-02
Description: Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer.
[Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers via a web browser. Web Config is pre-installed in some printers provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/en/jp/JVN61337171/; https://www.epson.jp/support/misc_t/230802_oshirase.htm; https://jvn.jp/en/jp/JVN61337171/
CVE: CVE-2023-2022
Published: 2023-08-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-262
References: https://gitlab.com/gitlab-org/gitlab/-/issues/407166; https://hackerone.com/reports/1936572; https://gitlab.com/gitlab-org/gitlab/-/issues/407166
CVE: CVE-2023-3401
Published: 2023-08-02
Description: An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://gitlab.com/gitlab-org/gitlab/-/issues/416252; https://hackerone.com/reports/2031845; https://gitlab.com/gitlab-org/gitlab/-/issues/416252
CVE: CVE-2023-4067
Published: 2023-08-02
Description: The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'tab_date_r' parameters in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2945247%40bus-ticket-booking-with-seat-reservation&new=2945247%40bus-ticket-booking-with-seat-reservation&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ff2855cb-e4a8-4412-af24-4cee03ae2d43?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2945247%40bus-ticket-booking-with-seat-reservation&new=2945247%40bus-ticket-booking-with-seat-reservation&sfp_email=&sfph_mail=
CVE: CVE-2023-3426
Published: 2023-08-02
Description: The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425, CWE-862
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3426; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3426
CVE: CVE-2023-26430
Published: 2023-08-02
Description: Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems. No publicly available exploits are known.


CVSS Score: 3.5 (LOW)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26438
Published: 2023-08-02
Description: External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could exploit this weakness to discover the existence of restricted network infrastructure and service availability. Improvements were made to include deny-lists not only during the check of the provided connection data, but also during use. No publicly available exploits are known.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-367, CWE-918
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26439
Published: 2023-08-02
Description: The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached data. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.


CVSS Score: 7.6 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26440
Published: 2023-08-02
Description: The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary SQL queries. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.


CVSS Score: 7.1 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26441
Published: 2023-08-02
Description: Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access to the database and a local or restricted network would be able to read arbitrary local file system resources that are accessible by the services system user account. We have improved path validation and make sure that any access is contained to the defined root directory. No publicly available exploits are known.


CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200, CWE-22
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26442
Published: 2023-08-02
Description: In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources. No publicly available exploits are known.


CVSS Score: 3.2 (LOW)
CWE: CWE-918, CWE-918
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26443
Published: 2023-08-02
Description: Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single quotes for SQL FULLTEXT queries. No publicly available exploits are known.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26445
Published: 2023-08-02
Description: Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the theme value and use a default fallback if no theme matches. No publicly available exploits are known.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26446
Published: 2023-08-02
Description: The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the user-controllable clientID parameter. No publicly available exploits are known.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26447
Published: 2023-08-02
Description: The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content. No publicly available exploits are known.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26448
Published: 2023-08-02
Description: Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content for those locations to avoid redirects to malicious content. No publicly available exploits are known.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26449
Published: 2023-08-02
Description: The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26450
Published: 2023-08-02
Description: The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2023-26451
Published: 2023-08-02
Description: Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.


CVSS Score: 7.5 (HIGH)
CWE: CWE-330, CWE-330
References: http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Aug/8; https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
CVE: CVE-2022-46485
Published: 2023-08-02
Description: Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details".
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/WodenSec/CVE-2022-46485; https://github.com/WodenSec/CVE-2022-46485
CVE: CVE-2023-26316
Published: 2023-08-02
Description: A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322; https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322
CVE: CVE-2023-26317
Published: 2023-08-02
Description: Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upper-layer routing.
CVSS Score: 7.0 (HIGH)
CWE: CWE-78, CWE-77
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=529; https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=529
CVE: CVE-2023-33257
Published: 2023-08-02
Description: Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://writeup.recoil.nl/verint/; https://writeup.recoil.nl/verint/
CVE: CVE-2023-33383
Published: 2023-08-02
Description: Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: http://packetstormsecurity.com/files/173954/Shelly-PRO-4PM-0.11.0-Authentication-Bypass.html; https://www.exploitsecurity.io/post/cve-2023-33383-authentication-bypass-via-an-out-of-bounds-read-vulnerability; http://packetstormsecurity.com/files/173954/Shelly-PRO-4PM-0.11.0-Authentication-Bypass.html
CVE: CVE-2022-40609
Published: 2023-08-02
Description: IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  236069.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/236069; https://www.ibm.com/support/pages/node/7017032; https://exchange.xforce.ibmcloud.com/vulnerabilities/236069
CVE: CVE-2022-46484
Published: 2023-08-02
Description: Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://github.com/WodenSec/CVE-2022-46484; https://github.com/WodenSec/CVE-2022-46484
CVE: CVE-2023-23476
Published: 2023-08-02
Description: IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some API routes.  IBM X-Force ID:  245425.
CVSS Score: 3.1 (LOW)
CWE: CWE-863, CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/245425; https://www.ibm.com/support/pages/node/7017490; https://exchange.xforce.ibmcloud.com/vulnerabilities/245425
CVE: CVE-2023-38330
Published: 2023-08-02
Description: OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-434
References: https://bugs.oxid-esales.com/view.php?id=7479; https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletin-2023-002; https://bugs.oxid-esales.com/view.php?id=7479
CVE: CVE-2023-36494
Published: 2023-08-02
Description: 
Audit logs on F5OS-A may contain undisclosed sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://my.f5.com/manage/s/article/K000134922; https://my.f5.com/manage/s/article/K000134922
CVE: CVE-2023-36858
Published: 2023-08-02
Description: 
An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured server list.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.1 (HIGH)
CWE: CWE-345
References: https://my.f5.com/manage/s/article/K000132563; https://my.f5.com/manage/s/article/K000132563
CVE: CVE-2023-38138
Published: 2023-08-02
Description: 
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://my.f5.com/manage/s/article/K000133474; https://my.f5.com/manage/s/article/K000133474
CVE: CVE-2023-38418
Published: 2023-08-02
Description: 
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347
References: https://my.f5.com/manage/s/article/K000134746; https://my.f5.com/manage/s/article/K000134746
CVE: CVE-2023-38419
Published: 2023-08-02
Description: An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-755
References: https://my.f5.com/manage/s/article/K000133472; https://my.f5.com/manage/s/article/K000133472