deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22117
Published: 2023-10-17
Description: Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).  Supported versions that are affected are 12.3, 12.4, 14.0-14.3 and  14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as  unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22118
Published: 2023-10-17
Description: Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).  Supported versions that are affected are 12.3, 12.4, 14.0-14.3 and  14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as  unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).
CVSS Score: 6.5 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22119
Published: 2023-10-17
Description: Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).  Supported versions that are affected are 12.3, 12.4, 14.0-14.3 and  14.5-14.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data as well as  unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L).
CVSS Score: 5.9 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22121
Published: 2023-10-17
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).  Supported versions that are affected are 14.5-14.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Trade Finance.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data as well as  unauthorized read access to a subset of Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22122
Published: 2023-10-17
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).  Supported versions that are affected are 14.5-14.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data as well as  unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Trade Finance. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L).
CVSS Score: 5.9 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22123
Published: 2023-10-17
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).  Supported versions that are affected are 14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Trade Finance, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data as well as  unauthorized read access to a subset of Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22124
Published: 2023-10-17
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).  Supported versions that are affected are 14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Trade Finance, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data as well as  unauthorized read access to a subset of Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22125
Published: 2023-10-17
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).  Supported versions that are affected are 14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Trade Finance, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data as well as  unauthorized read access to a subset of Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22126
Published: 2023-10-17
Description: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 5.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22127
Published: 2023-10-17
Description: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Content Access SDK, Image Export SDK, PDF Export SDK, HTML Export SDK).   The supported version that is affected is 8.5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
CVSS Score: 6.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22128
Published: 2023-10-17
Description: Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem).  Supported versions that are affected are 10 and  11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via rquota to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
CVSS Score: 3.1 (LOW)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22129
Published: 2023-10-17
Description: Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. Note: This vunlerability only affects SPARC Systems. CVSS 3.1 Base Score 5.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 5.5 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-22130
Published: 2023-10-17
Description: Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core).   The supported version that is affected is 8.8.60. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 5.9 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2023.html; https://www.oracle.com/security-alerts/cpuoct2023.html
CVE: CVE-2023-41629
Published: 2023-10-17
Description: A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-34
References: https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-41629-eSST-Path-Traversal.pdf; https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-41629-eSST-Path-Traversal.pdf
CVE: CVE-2023-41630
Published: 2023-10-17
Description: eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the Gii code generator component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-41630-eSST-Preauth-RCE.pdf; https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-41630-eSST-Preauth-RCE.pdf
CVE: CVE-2023-41631
Published: 2023-10-17
Description: eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-41631-eSST-RCE.pdf; https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-41631-eSST-RCE.pdf
CVE: CVE-2023-36321
Published: 2023-10-17
Description: Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/COVESA/dlt-daemon/issues/436; https://github.com/michael-methner/dlt-daemon/commit/8ac9a080bee25e67e49bd138d81c992ce7b6d899; https://lists.debian.org/debian-lts-announce/2024/06/msg00021.html
CVE: CVE-2023-39276
Published: 2023-10-17
Description: 
SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to a firewall crash.



CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012
CVE: CVE-2023-39277
Published: 2023-10-17
Description: 
SonicOS post-authentication stack-based buffer overflow vulnerability in the sonicflow.csv and appflowsessions.csv URL endpoints leads to a firewall crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012
CVE: CVE-2023-39278
Published: 2023-10-17
Description: SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012
CVE: CVE-2023-39279
Published: 2023-10-17
Description: SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012
CVE: CVE-2023-39280
Published: 2023-10-17
Description: SonicOS p

ost-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoints leads to a firewall crash.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012
CVE: CVE-2023-3042
Published: 2023-10-17
Description: In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is  https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp , which should return a 404 response but didn't. 

The oversight in the default invalid URL character list can be viewed at the provided  GitHub link https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java#L37 . 

To mitigate, users can block URLs with double slashes at firewalls or utilize dotCMS config variables.

Specifically, they can use the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS environmental variable to add // to the list of invalid strings. 

Additionally, the DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variable offers more detailed control, for instance, to block //html.* URLs.

Fix Version:23.06+, LTS 22.03.7+, LTS 23.01.4+
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dotcms.com/security/SI-68; https://www.dotcms.com/security/SI-68
CVE: CVE-2023-41711
Published: 2023-10-17
Description: SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012
CVE: CVE-2023-41712
Published: 2023-10-17
Description: SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012
CVE: CVE-2023-41713
Published: 2023-10-17
Description: SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-259, CWE-798
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012
CVE: CVE-2023-41715
Published: 2023-10-17
Description: SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel.

CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012
CVE: CVE-2023-42506
Published: 2023-10-17
Description: Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information may be disclosed or arbitrary code may be executed by having a user open a specially crafted OnSinView2 project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://jvn.jp/en/vu/JVNVU98392064/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]88/; https://jvn.jp/en/vu/JVNVU98392064/
CVE: CVE-2023-42507
Published: 2023-10-17
Description: Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information may be disclosed or arbitrary code may be executed by having a user open a specially crafted OnSinView2 project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU98392064/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]88/; https://jvn.jp/en/vu/JVNVU98392064/
CVE: CVE-2023-45810
Published: 2023-10-17
Description: OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq; https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq
CVE: CVE-2023-45811
Published: 2023-10-17
Description: Synchrony deobfuscator is a javascript cleaner & deobfuscator.  A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in `deobfuscator@2.4.4`. Users are advised to upgrade. Users unable to upgrade should launch node with the [--disable-proto=delete][disable-proto] or [--disable-proto=throw][disable-proto] flags

CVSS Score: 8.1 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://github.com/relative/synchrony/commit/b583126be94c4db7c5a478f1c5204bfb4162cf40; https://github.com/relative/synchrony/security/advisories/GHSA-jg82-xh3w-rhxx; https://github.com/relative/synchrony/security/advisories/src/transformers/literalmap.ts
CVE: CVE-2023-5552
Published: 2023-10-18
Description: A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200, CWE-522
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20231017-spx-password; https://www.sophos.com/en-us/security-advisories/sophos-sa-20231017-spx-password
CVE: CVE-2023-5626
Published: 2023-10-18
Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/pkp/ojs/commit/99a9f[PII_REDACTED]54aa5ddffedffc89596f6c682; https://huntr.dev/bounties/c99279c1-709a-4e7b-a042-010c2bb44d6b; https://github.com/pkp/ojs/commit/99a9f[PII_REDACTED]54aa5ddffedffc89596f6c682
CVE: CVE-2023-35083
Published: 2023-10-18
Description: Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all previous versions potentially leading to the leakage of sensitive information.
CVSS Score: 6.5 (MEDIUM)
References: https://forums.ivanti.com/s/article/SA-2023-06-20-CVE-2023-35083?language=en_US; https://forums.ivanti.com/s/article/SA-2023-06-20-CVE-2023-35083?language=en_US
CVE: CVE-2023-35084
Published: 2023-10-18
Description: Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US; https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US