deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-23163
Published: 2023-02-10
Description: Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/171643/Art-Gallery-Management-System-Project-1.0-SQL-Injection.html; https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-23163/CVE-2023-23163.txt; https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/
CVE: CVE-2023-24816
Published: 2023-02-10
Description: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function `IPython.utils.terminal.set_term_title` be called on Windows in a Python environment where ctypes is not available. The dependency on `ctypes` in `IPython.utils._process_win32` prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool `set_term_title` could be called and hence introduce a vulnerability. Should an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. Users of ipython as a library are advised to upgrade. Users unable to upgrade should ensure that any calls to the `IPython.utils.terminal.set_term_title` function are done with trusted or filtered input.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-20, CWE-78, CWE-78
References: https://github.com/ipython/ipython/blob/3f0bf05f072a91b2a3042d23ce250e5e906183fd/IPython/utils/terminal.py#L103-L117; https://github.com/ipython/ipython/blob/56e6925dfa50e2c7f4a6471547b8176275db7c25/IPython/utils/_process_win32.py#L20; https://github.com/ipython/ipython/commit/385d69325319a5972ee9b5983638e3617f21cb1f
CVE: CVE-2022-34384
Published: 2023-02-11
Description: 
Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior), Dell Command | Update, Dell Update, and Alienware Update versions before 4.5 contain a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user may potentially exploit this vulnerability, leading to privilege escalation.






CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://www.dell.com/support/kbdoc/000204114; https://www.dell.com/support/kbdoc/000204114
CVE: CVE-2022-34385
Published: 2023-02-11
Description: 
SupportAssist for Home PCs (version 3.11.4 and prior) and  SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information.






CVSS Score: 5.5 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://www.dell.com/support/kbdoc/000204114; https://www.dell.com/support/kbdoc/000204114
CVE: CVE-2022-34386
Published: 2023-02-11
Description: 
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information.






CVSS Score: 5.5 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://www.dell.com/support/kbdoc/000204114; https://www.dell.com/support/kbdoc/000204114
CVE: CVE-2022-34387
Published: 2023-02-11
Description: 


Dell SupportAssist for Home PCs (version 3.11.4 and prior) and  SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilege escalation vulnerability. A local authenticated malicious user could potentially exploit this vulnerability to elevate privileges and gain total control of the system.








CVSS Score: 6.4 (MEDIUM)
CWE: CWE-377, CWE-668
References: https://www.dell.com/support/kbdoc/000204114; https://www.dell.com/support/kbdoc/000204114
CVE: CVE-2022-34388
Published: 2023-02-11
Description: 
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and  SupportAssist for Business PCs (version 3.2.0 and prior) contain information disclosure vulnerability. A local malicious user with low privileges could exploit this vulnerability to view and modify sensitive information in the database of the affected application.






CVSS Score: 7.1 (HIGH)
CWE: CWE-318, CWE-312
References: https://www.dell.com/support/kbdoc/000204114; https://www.dell.com/support/kbdoc/000204114
CVE: CVE-2022-34389
Published: 2023-02-11
Description: 
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician.






CVSS Score: 3.7 (LOW)
CWE: CWE-307, CWE-307
References: https://www.dell.com/support/kbdoc/000204114; https://www.dell.com/support/kbdoc/000204114
CVE: CVE-2022-34392
Published: 2023-02-11
Description: 
SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An authenticated non-admin user can be able to obtain the refresh token and that leads to reuse the access token and fetch sensitive information.






CVSS Score: 5.5 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://www.dell.com/support/kbdoc/000204114; https://www.dell.com/support/kbdoc/000204114
CVE: CVE-2022-34404
Published: 2023-02-11
Description: 
Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module. A local attacker with high privileges could potentially exploit this vulnerability, leading to credential theft and/or denial of service.






CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://www.dell.com/support/kbdoc/000203733; https://www.dell.com/support/kbdoc/000203733
CVE: CVE-2022-34444
Published: 2023-02-11
Description: 
Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to cause data leak.






CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271; https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271
CVE: CVE-2022-34445
Published: 2023-02-11
Description: 
Dell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password. A malicious local privileged attacker may potentially exploit this vulnerability, leading to information disclosure.






CVSS Score: 6.0 (MEDIUM)
CWE: CWE-261, CWE-522
References: https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271; https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271
CVE: CVE-2022-34446
Published: 2023-02-11
Description: 
PowerPath Management Appliance with versions 3.3 & 3.2* contains Authorization Bypass vulnerability. An authenticated remote user with limited privileges (e.g., of role Monitoring) can exploit this issue and gain access to sensitive information, and modify the configuration.






CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://www.dell.com/support/kbdoc/000205404; https://www.dell.com/support/kbdoc/000205404
CVE: CVE-2022-34447
Published: 2023-02-11
Description: 
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains OS Command Injection vulnerability. An authenticated remote attacker with administrative privileges could potentially exploit the issue and execute commands on the system as the root user.






CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/000205404; https://www.dell.com/support/kbdoc/000205404
CVE: CVE-2022-34448
Published: 2023-02-11
Description: 
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Cross-site Request Forgery vulnerability. An unauthenticated non-privileged user could potentially exploit the issue and perform any privileged state-changing actions.






CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.dell.com/support/kbdoc/000205404; https://www.dell.com/support/kbdoc/000205404
CVE: CVE-2022-34449
Published: 2023-02-11
Description: 
PowerPath Management Appliance with versions 3.3 & 3.2* contains a Hardcoded Cryptographic Keys vulnerability. Authenticated admin users can exploit the issue that leads to view and modifying sensitive information stored in the application.






CVSS Score: 6.0 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://www.dell.com/support/kbdoc/000205404; https://www.dell.com/support/kbdoc/000205404
CVE: CVE-2022-34450
Published: 2023-02-11
Description: 
PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin user could potentially exploit this issue and gain unrestricted control/code execution on the system as root.






CVSS Score: 6.7 (MEDIUM)
CWE: CWE-183
References: https://www.dell.com/support/kbdoc/000205404; https://www.dell.com/support/kbdoc/000205404
CVE: CVE-2022-34451
Published: 2023-02-11
Description: 
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Stored Cross-site Scripting Vulnerability. An authenticated admin user could potentially exploit this vulnerability, to hijack user sessions or trick a victim application user into unknowingly send arbitrary requests to the server.






CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/000205404; https://www.dell.com/support/kbdoc/000205404
CVE: CVE-2022-45104
Published: 2023-02-11
Description: 
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain a command execution vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to execute arbitrary commands on the underlying system.






CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-46675
Published: 2023-02-11
Description: 
Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the internal structure of the application and its components and use this information for further vulnerability research.






CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-46676
Published: 2023-02-11
Description: 
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A malicious admin user can disable or delete users under administration and unassigned admins for which the group admin is not authorized.






CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-46677
Published: 2023-02-11
Description: 
Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin can create a subgroup under a group for which the admin is not authorized.






CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-46678
Published: 2023-02-11
Description: 


Wyse Management Suite 

3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy for which the user is not authorized.






CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-46754
Published: 2023-02-11
Description: 
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user might access certain pro license features for which this admin is not authorized in order to configure user controlled external entities.






CVSS Score: 8.7 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-46755
Published: 2023-02-11
Description: 
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy for which the user is not authorized.






CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-4133
Published: 2023-02-11
Description: Rejected reason: We were unable to verify this vulnerbility.
CVE: CVE-2023-0776
Published: 2023-02-11
Description: Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. 



CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-77
References: https://baicells.com/Service/Firmware; https://baicells.com/Service/Firmware
CVE: CVE-2023-25557
Published: 2023-02-11
Description: DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the DataHub Metadata Store (GMS). It has been discovered that the proxy does not adequately construct the URL when forwarding data to GMS, allowing external users to reroute requests from the DataHub Frontend to any arbitrary hosts. As a result attackers may be able to reroute a request from originating from the frontend proxy to any other server and return the result. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-076.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/datahub-project/datahub/security/advisories/GHSA-5w2h-q83m-65xg; https://github.com/datahub-project/datahub/security/advisories/GHSA-5w2h-q83m-65xg
CVE: CVE-2023-25558
Published: 2023-02-11
Description: DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the `id_token` is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the id_token claims value start with the {#sb64} prefix, pac4j considers the value to be a serialized Java object and will deserialize it. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. Users are advised to upgrade. There are no known workarounds. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-086.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://github.com/datahub-project/datahub/commit/2a182f484677d056730d6b4e9f0143e67368359f; https://github.com/datahub-project/datahub/security/advisories/GHSA-hrwp-2q5c-86wv; https://github.com/datahub-project/datahub/commit/2a182f484677d056730d6b4e9f0143e67368359f
CVE: CVE-2023-25559
Published: 2023-02-11
Description: DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (GMS) will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request on behalf of. When the backends retrieves the header, its name is retrieved in a case-insensitive way. This case differential can be abused by an attacker to smuggle an X-DataHub-Actor header with different casing  (eg: X-DATAHUB-ACTOR). This issue may lead to an authorization bypass by allowing any user to impersonate the system user account and perform any actions on its behalf. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-079.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287, CWE-863
References: https://github.com/datahub-project/datahub/security/advisories/GHSA-qgp2-qr66-j8r8; https://github.com/datahub-project/datahub/security/advisories/GHSA-qgp2-qr66-j8r8
CVE: CVE-2023-25560
Published: 2023-02-11
Description: DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be able to augment these JSON strings to be sent to the backend and that can potentially be abused by including new or colliding values. This issue may lead to an authentication bypass and the creation of system accounts, which effectively can lead to full system compromise. Users are advised to upgrade. There are no known workarounds for this vulnerability. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-080.
CVSS Score: 8.2 (HIGH)
CWE: CWE-913
References: https://github.com/datahub-project/datahub/security/advisories/GHSA-6rpf-5cfg-h8f3; https://github.com/datahub-project/datahub/security/advisories/GHSA-6rpf-5cfg-h8f3
CVE: CVE-2023-25561
Published: 2023-02-11
Description: DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any username and password. The reason for this is that while an error is thrown in the `authenticateJaasUser` method it is swallowed without propagating the error. As a result of this issue unauthenticated users may gain access to the system. Users are advised to upgrade. There are no known workarounds for this issue. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-081.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-755
References: https://github.com/datahub-project/datahub/blob/fdf4e48495f083314f59c414bcc7c2601633a2b8/datahub-frontend/app/security/AuthenticationManager.java#L26; https://github.com/datahub-project/datahub/security/advisories/GHSA-7wc6-p6c4-522c; https://github.com/datahub-project/datahub/blob/fdf4e48495f083314f59c414bcc7c2601633a2b8/datahub-frontend/app/security/AuthenticationManager.java#L26
CVE: CVE-2023-25562
Published: 2023-02-11
Description: DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the `AuthUtils.hasValidSessionCookie()` method could be bypassed by using a cookie from a logged out session, as a result any logged out session cookie may be accepted as valid and therefore lead to an authentication bypass to the system. Users are advised to upgrade. There are no known workarounds for this issue. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-083.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-613
References: https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/datahub-frontend/app/auth/AuthUtils.java#L78; https://github.com/datahub-project/datahub/security/advisories/GHSA-3974-hxjh-m3jj; https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/datahub-frontend/app/auth/AuthUtils.java#L78
CVE: CVE-2023-0780
Published: 2023-02-11
Description: Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://github.com/cockpit-hq/cockpit/commit/8450bdf7e1dc23e9d88adf30a2aa9101c0c41720; https://huntr.dev/bounties/801efd0b-404b-4670-961a-12a986252fa4; https://github.com/cockpit-hq/cockpit/commit/8450bdf7e1dc23e9d88adf30a2aa9101c0c41720
CVE: CVE-2023-0781
Published: 2023-02-11
Description: A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file removeOrder.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220624.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/weixin_43864034/article/details/128986083; https://vuldb.com/?ctiid.220624; https://vuldb.com/?id.220624
CVE: CVE-2023-0127
Published: 2023-02-11
Description: A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.tenable.com/security/research/tra-2023-1; https://www.tenable.com/security/research/tra-2023-1
CVE: CVE-2023-0782
Published: 2023-02-11
Description: A vulnerability was found in Tenda AC23 16.03.07.45 and classified as critical. Affected by this issue is the function formSetSysToolDDNS/formGetSysToolDDNS of the file /bin/httpd. The manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220640.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://github.com/jingping911/tendaAC23overflow/blob/main/README.md; https://vuldb.com/?ctiid.220640; https://vuldb.com/?id.220640
CVE: CVE-2023-0783
Published: 2023-02-11
Description: A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220641 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/jingping911/exshopbug/blob/main/README.md; https://vuldb.com/?ctiid.220641; https://vuldb.com/?id.220641