deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-29530
Published: 2023-04-24
Description: Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/advisories/GHSA-wxmh-65f7-jcvw; https://github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPW54QK7ISDALPLP2CKODU4ZIVRYS336/
CVE: CVE-2022-28354
Published: 2023-04-24
Description: In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171402/MyBB-Active-Threads-1.3.0-Cross-Site-Scripting.html; https://community.mybb.com/mods.php?action=view&pid=1336; http://packetstormsecurity.com/files/171402/MyBB-Active-Threads-1.3.0-Cross-Site-Scripting.html
CVE: CVE-2023-28484
Published: 2023-04-24
Description: In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://gitlab.gnome.org/GNOME/libxml2/-/issues/491; https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4; https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html
CVE: CVE-2023-29469
Published: 2023-04-24
Description: An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://gitlab.gnome.org/GNOME/libxml2/-/issues/510; https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4; https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html
CVE: CVE-2023-2006
Published: 2023-04-24
Description: A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=2189112; https://github.com/torvalds/linux/commit/3bcd6c7eaa53; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-2019
Published: 2023-04-24
Description: A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-911
References: https://bugzilla.redhat.com/show_bug.cgi?id=2189137; https://github.com/torvalds/linux/commit/180a6a3ee60a; https://www.zerodayinitiative.com/advisories/ZDI-CAN-17811/
CVE: CVE-2023-2250
Published: 2023-04-24
Description: A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registration-controller or cluster-manager deployments. A malicious user can take advantage of this and bind the cluster-admin to any service account or using the service account to list all secrets for all kubernetes namespaces, leading into a cluster-level privilege escalation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-268
References: https://github.com/open-cluster-management-io/registration-operator/pull/344; https://github.com/open-cluster-management-io/registration-operator/pull/344
CVE: CVE-2023-2258
Published: 2023-04-24
Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://github.com/alfio-event/alf.io/commit/94e2923a317452e337393789c9f3192dfc1ddac2; https://huntr.dev/bounties/31eaf0fe-4d91-4022-aa9b-802bc6eafb8f; https://github.com/alfio-event/alf.io/commit/94e2923a317452e337393789c9f3192dfc1ddac2
CVE: CVE-2023-2259
Published: 2023-04-24
Description: Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1336, CWE-94
References: https://github.com/alfio-event/alf.io/commit/94e2923a317452e337393789c9f3192dfc1ddac2; https://huntr.dev/bounties/e753bce0-ce82-463b-b344-2f67b39b60ff; https://github.com/alfio-event/alf.io/commit/94e2923a317452e337393789c9f3192dfc1ddac2
CVE: CVE-2023-2260
Published: 2023-04-24
Description: Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/alfio-event/alf.io/commit/c9a16ab93d42b2beb06d529b57890121f85be6ef; https://huntr.dev/bounties/649badc8-c935-4a84-8aa8-d3269ac54377; https://github.com/alfio-event/alf.io/commit/c9a16ab93d42b2beb06d529b57890121f85be6ef
CVE: CVE-2023-30626
Published: 2023-04-24
Description: Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the `ClientLogController`, specifically `/ClientLog/Document`. When combined with a cross-site scripting vulnerability (CVE-2023-30627), this can result in file write and arbitrary code execution. Version 10.8.10 has a patch for this issue. There are no known workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pq; https://github.com/jellyfin/jellyfin/blob/22d[PII_REDACTED]80dec994cd7d35fe269613bfce3/Jellyfin.Api/Controllers/ClientLogController.cs#L44; https://github.com/jellyfin/jellyfin/commit/82ad2633fdfb1c37a158057c7935f83e1129eda7
CVE: CVE-2023-30627
Published: 2023-04-24
Description: jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the `REST` endpoints with admin privileges. When combined with CVE-2023-30626, this results in remote code execution on the Jellyfin instance in the context of the user who's running it. This issue is patched in version 10.8.10. There are no known workarounds.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/jellyfin/jellyfin-web/commit/b88a5951e1a517ff4c820e693d9c0da981cf68ee; https://github.com/jellyfin/jellyfin-web/releases/tag/v10.8.10; https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pq
CVE: CVE-2023-30406
Published: 2023-04-24
Description: Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/jerryscript-project/jerryscript/issues/5058; https://github.com/jerryscript-project/jerryscript/issues/5058
CVE: CVE-2023-30408
Published: 2023-04-24
Description: Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/jerryscript-project/jerryscript/issues/5057; https://github.com/jerryscript-project/jerryscript/issues/5057
CVE: CVE-2023-30410
Published: 2023-04-24
Description: Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component ecma_op_function_construct at /operations/ecma-function-object.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/5052; https://github.com/jerryscript-project/jerryscript/issues/5052
CVE: CVE-2023-30414
Published: 2023-04-24
Description: Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component vm_loop at /jerry-core/vm/vm.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/5051; https://github.com/jerryscript-project/jerryscript/issues/5051
CVE: CVE-2023-30623
Published: 2023-04-24
Description: `embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the  `embano1/wip` action uses the `github.event.pull_request.title` parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation. This vulnerability can be triggered by any user on GitHub. They just need to create a pull request with a commit message containing an exploit. (Note that first-time PR requests will not be run - but the attacker can submit a valid PR before submitting an invalid PR). The commit can be genuine, but the commit message can be malicious. This can be used to execute code on the GitHub runners and can be used to exfiltrate any secrets used in the CI pipeline, including repository tokens. Version 2 has a fix for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/embano1/wip/commit/c25450f77ed02c20d00b76ee3b33ff43838739a2; https://github.com/embano1/wip/security/advisories/GHSA-rg3q-prf8-qxmp; https://securitylab.github.com/research/github-actions-untrusted-input/
CVE: CVE-2023-30628
Published: 2023-04-24
Description: Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior,
the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz";echo${IFS}"hello";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/kiwitcms/Kiwi/blob/37bfb87696093ce0393160e[PII_REDACTED]cc0651d/.github/workflows/changelog.yml#L18; https://github.com/kiwitcms/Kiwi/commit/834c86dfd1b2492ccad7ebbfd6304bfec895fed2; https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-cw6r-6ccx-5hwx
CVE: CVE-2023-30629
Published: 2023-04-24
Description: Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`. A patch is available and, as of time of publication, anticipated to be part of Vyper 0.3.8. As a workaround, one may always put  `max_outsize>0`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-670
References: https://docs.vyperlang.org/en/v0.3.7/built-in-functions.html#raw_call; https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vy#L164; https://github.com/lidofinance/gate-seals/pull/5/files
CVE: CVE-2023-2007
Published: 2023-04-24
Description: The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-667
References: https://github.com/torvalds/linux/commit/b04e75a4a8a81887386a0d2dbf605a48e779d2a0; https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE: CVE-2023-28771
Published: 2023-04-25
Description: Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls; http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html
CVE: CVE-2023-22665
Published: 2023-04-25
Description: There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-917, CWE-917
References: http://www.openwall.com/lists/oss-security/2023/07/11/11; https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s; http://www.openwall.com/lists/oss-security/2023/07/11/11
CVE: CVE-2022-45837
Published: 2023-04-25
Description: Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/weixin-robot-advanced/wordpress-plugin-6-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/weixin-robot-advanced/wordpress-plugin-6-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25479
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/podlove-subscribe-button/wordpress-podlove-subscribe-button-plugin-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/podlove-subscribe-button/wordpress-podlove-subscribe-button-plugin-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25490
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/archivist-custom-archive-templates/wordpress-archivist-custom-archive-templates-plugin-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/archivist-custom-archive-templates/wordpress-archivist-custom-archive-templates-plugin-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25710
Published: 2023-04-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <= 1.4.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/click-to-call-or-chat-buttons/wordpress-click-to-call-or-chat-buttons-plugin-1-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/click-to-call-or-chat-buttons/wordpress-click-to-call-or-chat-buttons-plugin-1-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26098
Published: 2023-04-25
Description: An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arbitrary code.
CVSS Score: 8.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-26098; https://excellium-services.com/cert-xlm-advisory/CVE-2023-26098; https://www.telindus.lu/fr/produits/apsal
CVE: CVE-2023-27619
Published: 2023-04-25
Description: Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/regina-lite/wordpress-regina-lite-theme-2-0-7-reflected-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/regina-lite/wordpress-regina-lite-theme-2-0-7-reflected-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-42335
Published: 2023-04-25
Description: x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2023/04/25/1; http://xenbits.xen.org/xsa/advisory-430.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PSPFWSY6UOPGMADQGOGN2PAAS5LJRPTG/
CVE: CVE-2023-25346
Published: 2023-04-25
Description: A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25346; https://github.com/ChurchCRM/CRM; https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25346
CVE: CVE-2023-25347
Published: 2023-04-25
Description: A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25347; https://github.com/ChurchCRM/CRM; https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25347
CVE: CVE-2023-25348
Published: 2023-04-25
Description: ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25348; https://github.com/ChurchCRM/CRM; https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25348
CVE: CVE-2023-26057
Published: 2023-04-25
Description: An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://nokia.com; https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2022-01/; https://nokia.com
CVE: CVE-2023-26058
Published: 2023-04-25
Description: An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://nokia.com; https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2022-02/; https://nokia.com
CVE: CVE-2023-26839
Published: 2023-04-25
Description: A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26839; https://github.com/ChurchCRM/CRM; https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26839
CVE: CVE-2023-26840
Published: 2023-04-25
Description: A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26840; https://github.com/ChurchCRM/CRM; https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26840
CVE: CVE-2023-26841
Published: 2023-04-25
Description: A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26841; https://github.com/ChurchCRM/CRM; https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26841
CVE: CVE-2023-26843
Published: 2023-04-25
Description: A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26843; https://github.com/ChurchCRM/CRM; https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26843
CVE: CVE-2023-30417
Published: 2023-04-25
Description: A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitee.com/pear-admin/Pear-Admin-Boot/issues/I6SXHX; https://gitee.com/pear-admin/Pear-Admin-Boot/issues/I6SXHX
CVE: CVE-2023-29779
Published: 2023-04-25
Description: Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. After receiving the malicious command, the device will keep reporting its status and finally drain its battery after receiving the 'Set_short_poll_interval' command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/iot-sec23/IoT-CVE/blob/main/Sengled%20Dimmer%20Switch%20Vulnerability%20Report.pdf; https://us.sengled.com/; https://github.com/iot-sec23/IoT-CVE/blob/main/Sengled%20Dimmer%20Switch%20Vulnerability%20Report.pdf
CVE: CVE-2023-2281
Published: 2023-04-25
Description: When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.



CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/