deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22443
Published: 2023-05-10
Description: Integer overflow in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable denial of service via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-680, CWE-190
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html
CVE: CVE-2023-22447
Published: 2023-05-10
Description: Insertion of sensitive information into log file in the Open CAS software for Linux maintained by Intel before version 22.6.2 may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 2.0 (LOW)
CWE: CWE-532, CWE-532
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00827.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00827.html
CVE: CVE-2023-22661
Published: 2023-05-10
Description: Buffer overflow in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html
CVE: CVE-2023-23569
Published: 2023-05-10
Description: Stack-based buffer overflow for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00805.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00805.html
CVE: CVE-2023-23573
Published: 2023-05-10
Description: Improper access control in the Intel(R) Unite(R) android application before Release 17 may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00825.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00825.html
CVE: CVE-2023-23580
Published: 2023-05-10
Description: Stack-based buffer overflow for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an authenticated user to potentially escalation of privilege via local access.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00805.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00805.html
CVE: CVE-2023-23909
Published: 2023-05-10
Description: Out-of-bounds read for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 2.8 (LOW)
CWE: CWE-125, CWE-125
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00805.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00805.html
CVE: CVE-2023-23910
Published: 2023-05-10
Description: Out-of-bounds write for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an authenticated user to potentially escalation of privilege via local access.
CVSS Score: 3.9 (LOW)
CWE: CWE-787, CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00805.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00805.html
CVE: CVE-2023-24475
Published: 2023-05-10
Description: Out of bounds read in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html
CVE: CVE-2023-25175
Published: 2023-05-10
Description: Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html
CVE: CVE-2023-25179
Published: 2023-05-10
Description: Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00825.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00825.html
CVE: CVE-2023-25545
Published: 2023-05-10
Description: Improper buffer restrictions in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-92, CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html
CVE: CVE-2023-25568
Published: 2023-05-10
Description: Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection is closed. This affects users accepting untrusted connections with the Bitswap server and also affects users using the old API stubs at `github.com/ipfs/go-libipfs/bitswap` because users then transitively import `github.com/ipfs/go-libipfs/bitswap/server`. Boxo versions 0.6.0 and 0.4.1 contain a patch for this issue. As a workaround, those who are using the stub object at `github.com/ipfs/go-libipfs/bitswap` not taking advantage of the features provided by the server can refactor their code to use the new split API that will allow them to run in a client only mode: `github.com/ipfs/go-libipfs/bitswap/client`.
CVSS Score: 8.2 (HIGH)
CWE: CWE-400, CWE-770, CWE-770
References: https://github.com/ipfs/boxo/commit/62cbac40b96f49e39cd7fedc77ee6b56adce4916; https://github.com/ipfs/boxo/commit/9cb5cb54d40b57084d1221ba83b9e6bb3fcc3197; https://github.com/ipfs/boxo/commit/baa748b682fabb21a4c1f7628a8af348d4645974
CVE: CVE-2023-25771
Published: 2023-05-10
Description: Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00777.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00777.html
CVE: CVE-2023-25772
Published: 2023-05-10
Description: Improper input validation in the Intel(R) Retail Edge Mobile Android application before version 3.0.301126-RELEASE may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00847.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00847.html
CVE: CVE-2023-25776
Published: 2023-05-10
Description: Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html
CVE: CVE-2023-27298
Published: 2023-05-10
Description: Uncontrolled search path in the WULT software maintained by Intel(R) before version 1.0.0 (commit id 592300b) may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427, CWE-428
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00853.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00853.html
CVE: CVE-2023-27382
Published: 2023-05-10
Description: Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.0.0.156 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00802.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00802.html
CVE: CVE-2023-27386
Published: 2023-05-10
Description: Uncontrolled search path in some Intel(R) Pathfinder for RISC-V software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-428
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00855.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00855.html
CVE: CVE-2023-28410
Published: 2023-05-10
Description: Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00886.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-28411
Published: 2023-05-10
Description: Double free in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html
CVE: CVE-2023-27562
Published: 2023-05-10
Description: The n8n package 0.218.0 for Node.js allows Directory Traversal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/n8n-io/n8n/releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.synacktiv.com/sites/default/files/2023-05/Synacktiv-N8N-Multiple-Vulnerabilities_0.pdf
CVE: CVE-2023-27563
Published: 2023-05-10
Description: The n8n package 0.218.0 for Node.js allows Escalation of Privileges.
CVSS Score: 8.8 (HIGH)
References: https://github.com/n8n-io/n8n/releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.synacktiv.com/sites/default/files/2023-05/Synacktiv-N8N-Multiple-Vulnerabilities_0.pdf
CVE: CVE-2023-27564
Published: 2023-05-10
Description: The n8n package 0.218.0 for Node.js allows Information Disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://github.com/n8n-io/n8n/releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.synacktiv.com/sites/default/files/2023-05/Synacktiv-N8N-Multiple-Vulnerabilities_0.pdf
CVE: CVE-2023-29930
Published: 2023-05-10
Description: An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetials to the TFTP server configuration page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/YSaxon/TFTPlunder; https://help.genesys.com/pureconnect/mergedprojects/wh_tr/mergedprojects/wh_tr_polycom_phones/desktop/configuring_the_tftp_server1.htm; https://github.com/YSaxon/TFTPlunder
CVE: CVE-2023-31471
Published: 2023-05-10
Description: An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install software from the filesystem, the package list, or a URL.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/gl-inet/CVE-issues/blob/main/3.215/Abuse_of_Functionality_leads_to_RCE.md; https://www.gl-inet.com; https://github.com/gl-inet/CVE-issues/blob/main/3.215/Abuse_of_Functionality_leads_to_RCE.md
CVE: CVE-2023-31906
Published: 2023-05-10
Description: Jerryscript 3.0.0(commit 1a2c047) was discovered to contain a heap-buffer-overflow via the component lexer_compare_identifier_to_chars at /jerry-core/parser/js/js-lexer.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/5066; https://github.com/jerryscript-project/jerryscript/issues/5066
CVE: CVE-2023-31907
Published: 2023-05-10
Description: Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via the component scanner_literal_is_created at /jerry-core/parser/js/js-scanner-util.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/5073; https://github.com/jerryscript-project/jerryscript/issues/5073
CVE: CVE-2023-31908
Published: 2023-05-10
Description: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component ecma_builtin_typedarray_prototype_sort.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/5067; https://github.com/jerryscript-project/jerryscript/issues/5067
CVE: CVE-2023-31910
Published: 2023-05-10
Description: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component parser_parse_function_statement at /jerry-core/parser/js/js-parser-statm.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/5076; https://github.com/jerryscript-project/jerryscript/issues/5076
CVE: CVE-2022-41985
Published: 2023-05-10
Description: An authentication bypass vulnerability exists in the Authentication functionality of Weston Embedded uC-FTPs v 1.98.00. A specially crafted set of network packets can lead to authentication bypass and denial of service. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-303, CWE-287
References: https://github.com/weston-embedded/uC-FTPs/pull/1; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1680; https://github.com/weston-embedded/uC-FTPs/pull/1
CVE: CVE-2022-46377
Published: 2023-05-10
Description: An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no IP address argument is provided to the `PORT` command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-823, CWE-125
References: https://github.com/weston-embedded/uC-FTPs/pull/2; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1681; https://github.com/weston-embedded/uC-FTPs/pull/2
CVE: CVE-2022-46378
Published: 2023-05-10
Description: An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no port argument is provided to the `PORT` command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-823, CWE-125
References: https://github.com/weston-embedded/uC-FTPs/pull/2; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1681; https://github.com/weston-embedded/uC-FTPs/pull/2
CVE: CVE-2023-2629
Published: 2023-05-10
Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803; https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01; https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803
CVE: CVE-2023-2630
Published: 2023-05-10
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38; https://huntr.dev/bounties/e1001870-b8d8-4921-8b9c-bbdfb1a1491e; https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38
CVE: CVE-2023-30351
Published: 2023-05-10
Description: Shenzen Tenda Technology IP Camera CP3 V11.10.00[PII_REDACTED] was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service (or UART) by using the exposed credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-798
References: https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_PRA.md; https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_RRA.md; https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_PRA.md
CVE: CVE-2023-30352
Published: 2023-05-10
Description: Shenzen Tenda Technology IP Camera CP3 V11.10.00[PII_REDACTED] was discovered to contain a hard-coded default password for the RTSP feed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_RTSPa.md; https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_RTSPa.md
CVE: CVE-2023-30353
Published: 2023-05-10
Description: Shenzen Tenda Technology IP Camera CP3 V11.10.00[PII_REDACTED] allows unauthenticated remote code execution via an XML document.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_uRCE.md; https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_uRCE.md
CVE: CVE-2023-30354
Published: 2023-05-10
Description: Shenzen Tenda Technology IP Camera CP3 V11.10.00[PII_REDACTED] does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and the hardcoded boot password can be inserted for console access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319, CWE-319, CWE-798
References: https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_NCD.md; https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_PBA.md; https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_NCD.md
CVE: CVE-2023-30356
Published: 2023-05-10
Description: Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00[PII_REDACTED] allows attackers to update the device with crafted firmware
CVSS Score: 7.5 (HIGH)
CWE: CWE-354, CWE-354
References: https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_MU.md; https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_MU.md
CVE: CVE-2023-31554
Published: 2023-05-10
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-2663. Reason: This record is a reservation duplicate of CVE-2023-2663. Notes: All CVE users should reference CVE-2023-2663 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2023-31555
Published: 2023-05-10
Description: podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfObject::DelayedLoad.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/podofo/podofo/issues/67; https://github.com/podofo/podofo/issues/67
CVE: CVE-2023-31556
Published: 2023-05-10
Description: podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/podofo/podofo/issues/66; https://github.com/podofo/podofo/issues/66
CVE: CVE-2023-31557
Published: 2023-05-10
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-2664. Reason: This record is a reservation duplicate of CVE-2023-2664. Notes: All CVE users should reference CVE-2023-2664 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2023-31566
Published: 2023-05-10
Description: Podofo v0.10.0 was discovered to contain a heap-use-after-free via the component PoDoFo::PdfEncrypt::IsMetadataEncrypted().
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/podofo/podofo/issues/70; https://github.com/podofo/podofo/issues/70
CVE: CVE-2023-31567
Published: 2023-05-10
Description: Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/podofo/podofo/issues/71; https://github.com/podofo/podofo/issues/71
CVE: CVE-2023-31568
Published: 2023-05-10
Description: Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptRC4::PdfEncryptRC4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/podofo/podofo/issues/72; https://github.com/podofo/podofo/issues/72
CVE: CVE-2023-0007
Published: 2023-05-10
Description: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://security.paloaltonetworks.com/CVE-2023-0007; https://security.paloaltonetworks.com/CVE-2023-0007
CVE: CVE-2023-0008
Published: 2023-05-10
Description: A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-73, CWE-610
References: https://security.paloaltonetworks.com/CVE-2023-0008; https://security.paloaltonetworks.com/CVE-2023-0008
CVE: CVE-2023-32070
Published: 2023-05-10
Description: XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-83, CWE-79, CWE-79
References: https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1; https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp; https://jira.xwiki.org/browse/XRENDERING-663