deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3447
Published: 2023-06-29
Description: The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with an existing account on a vulnerable WordPress instance, to extract potentially sensitive information from the LDAP directory.
CVSS Score: 7.6 (HIGH)
CWE: CWE-90
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2928150%40ldap-login-for-intranet-sites&new=2928150%40ldap-login-for-intranet-sites&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7553e8-e43d-4740-b2ee-e3d8dc351e53?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2928150%40ldap-login-for-intranet-sites&new=2928150%40ldap-login-for-intranet-sites&sfp_email=&sfph_mail=
CVE: CVE-2023-22886
Published: 2023-06-29
Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider.
Airflow JDBC Provider Connection’s [Connection URL] parameters had no
restrictions, which made it possible to implement RCE attacks via
different type JDBC drivers, obtain airflow server permission.
This issue affects Apache Airflow JDBC Provider: before 4.0.0.



CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3; https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3
CVE: CVE-2023-36617
Published: 2023-06-29
Description: A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-34486
Published: 2023-06-29
Description: itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote code execution can be achieved by entering malicious code in the date selection box.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/JunyanYip/itsourcecode_justines_xss_vul; https://github.com/JunyanYip/itsourcecode_justines_xss_vul
CVE: CVE-2023-34487
Published: 2023-06-29
Description: itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to SQL Injection. SQL injection points exist in the login password input box. This vulnerability can be exploited through time-based blind injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/JunyanYip/itsourcecode_justines_sql_vul; https://github.com/JunyanYip/itsourcecode_justines_sql_vul
CVE: CVE-2023-34735
Published: 2023-06-29
Description: Property Cloud Platform Management Center 1.0 is vulnerable to error-based SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/prismbreak/vulnerabilities/issues/4; https://github.com/prismbreak/vulnerabilities/issues/4
CVE: CVE-2023-3457
Published: 2023-06-29
Description: A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-232674 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/qwegz/CveList/blob/main/Shopping%20Website%20(E-Commerce)%20%20index.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.232674; https://vuldb.com/?id.232674
CVE: CVE-2023-3458
Published: 2023-06-29
Description: A vulnerability was found in SourceCodester Shopping Website 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file forgot-password.php. The manipulation of the argument contact leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232675.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/AD-Appledog/CveHubList/blob/main/Shopping%20Website%20(E-Commerce)%20forgot-password.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.232675; https://vuldb.com/?id.232675
CVE: CVE-2015-1313
Published: 2023-06-29
Description: JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-425
References: https://beyondbinary.io/articles/teamcity-account-creation/; https://www.jetbrains.com/teamcity/download/; https://beyondbinary.io/articles/teamcity-account-creation/
CVE: CVE-2023-33466
Published: 2023-06-29
Description: Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://discourse.orthanc-server.org/t/security-advisory-for-orthanc-deployments-running-versions-before-1-12-0/3568; https://lists.debian.org/debian-lts-announce/2023/09/msg00009.html; https://www.debian.org/security/2023/dsa-5473
CVE: CVE-2023-34598
Published: 2023-06-29
Description: Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/maddsec/CVE-2023-34598; https://github.com/maddsec/CVE-2023-34598
CVE: CVE-2023-34599
Published: 2023-06-29
Description: Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/maddsec/CVE-2023-34599; https://github.com/maddsec/CVE-2023-34599
CVE: CVE-2023-34656
Published: 2023-06-29
Description: An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system 3.1 thru 4.1 allows attackers to gain escalated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://github.com/kangjinlong1/Kang.github.io/blob/main/README.md; https://github.com/kangjinlong1/Kang.github.io/blob/main/README.md
CVE: CVE-2023-34844
Published: 2023-06-29
Description: Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-273
References: https://hacku.top/wl/?id=MACBtnorZyp6hC3E5bw2CqBAusuWoKe3; https://hacku.top/wl/?id=MACBtnorZyp6hC3E5bw2CqBAusuWoKe3
CVE: CVE-2023-34849
Published: 2023-06-29
Description: An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/cczzmm/IOT-POC/tree/main/Ikuai; https://github.com/cczzmm/IOT-POC/tree/main/Ikuai
CVE: CVE-2023-26612
Published: 2023-06-29
Description: D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the HostName field in SetParentsControlInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1/SetParentsControlInfo; https://www.dlink.com/en/security-bulletin/; https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1/SetParentsControlInfo
CVE: CVE-2023-26613
Published: 2023-06-29
Description: An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands via a crafted GET request to EXCU_SHELL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/excu_shell; https://www.dlink.com/en/security-bulletin/; https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/excu_shell
CVE: CVE-2023-26616
Published: 2023-06-29
Description: D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the URL field in SetParentsControlInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1/SetParentsControlInfo; https://www.dlink.com/en/security-bulletin/; https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1/SetParentsControlInfo
CVE: CVE-2023-31222
Published: 2023-06-29
Description: Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorized user to impact a healthcare delivery organization’s Paceart Optima system cardiac device causing data to be deleted, stolen, or modified, or the Paceart Optima system being used for further network penetration via network connectivity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://global.medtronic.com/xg-en/product-security/security-bulletins/paceart-optima-system.html; https://global.medtronic.com/xg-en/product-security/security-bulletins/paceart-optima-system.html
CVE: CVE-2023-33277
Published: 2023-06-29
Description: The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 allows a remote attacker to read sensitive files via directory-traversal sequences in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.syss.de/en/responsible-disclosure-policy; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-015.txt; https://www.syss.de/en/responsible-disclosure-policy
CVE: CVE-2023-35830
Published: 2023-06-29
Description: STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivity Module DeploymentPackage_v3.04r2-Jellyfish allow an attacker to gain full remote access with root privileges without the need for authentication, giving an attacker arbitrary remote code execution over LTE / 4G network via SMS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.stw-mobile-machines.com/fileadmin/user_upload/content/STW/PSIRT/STW-IR-23-001.pdf; https://www.stw-mobile-machines.com/psirt/; https://www.stw-mobile-machines.com/fileadmin/user_upload/content/STW/PSIRT/STW-IR-23-001.pdf
CVE: CVE-2023-37251
Published: 2023-06-29
Description: An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://phabricator.wikimedia.org/T333980; https://phabricator.wikimedia.org/T333980
CVE: CVE-2023-37254
Published: 2023-06-29
Description: An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default format.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://phabricator.wikimedia.org/T331065; https://phabricator.wikimedia.org/T331065
CVE: CVE-2023-37255
Published: 2023-06-29
Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "get edits" type is vulnerable to HTML injection through the User-Agent HTTP request header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://phabricator.wikimedia.org/T333569; https://phabricator.wikimedia.org/T333569
CVE: CVE-2023-37256
Published: 2023-06-29
Description: An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links these URLs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://phabricator.wikimedia.org/T331311; https://phabricator.wikimedia.org/T331311
CVE: CVE-2023-26085
Published: 2023-06-29
Description: A possible out-of-bounds read and write (due to an improper length check of shared memory) was discovered in Arm NN Android-NN-Driver before 23.02.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://developer.arm.com/Arm%20Security%20Center; https://github.com/ARM-software/android-nn-driver/releases/tag/v23.02; https://developer.arm.com/Arm%20Security%20Center
CVE: CVE-2023-34658
Published: 2023-06-29
Description: Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1021
References: https://crsrg.sh/crsrg-2308101/; https://exchange.xforce.ibmcloud.com/vulnerabilities/259547; https://crsrg.sh/crsrg-2308101/
CVE: CVE-2023-36487
Published: 2023-06-29
Description: The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141694&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI; https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141703&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI; https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141694&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI
CVE: CVE-2023-36488
Published: 2023-06-29
Description: ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141704&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI; https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141710&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI; https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141704&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI
CVE: CVE-2023-30946
Published: 2023-06-29
Description: A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UUID of the author, and the user-defined title of the issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-288, CWE-420
References: https://palantir.safebase.us/?tcuUid=4cf0b6e6-564a-467b-83ae-36fec3a491c3; https://palantir.safebase.us/?tcuUid=4cf0b6e6-564a-467b-83ae-36fec3a491c3
CVE: CVE-2023-30955
Published: 2023-06-29
Description: A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users with insufficient privilege the ability to view and interact with Developer Mode settings in a limited capacity. A fix was deployed with workspace-server 7.7.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-602, CWE-863
References: https://palantir.safebase.us/?tcuUid=0c3f6c33-4eb0-48b5-ab87-fe48c46a4170; https://palantir.safebase.us/?tcuUid=0c3f6c33-4eb0-48b5-ab87-fe48c46a4170
CVE: CVE-2023-33190
Published: 2023-06-29
Description: Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. This issue has been addressed in version 4.2.1-rc4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-287, CWE-863
References: https://github.com/labring/sealos/commit/4cdf52e55666864e5f90ed502e9fc13e18985b7b; https://github.com/labring/sealos/security/advisories/GHSA-74j8-w7f9-pp62; https://github.com/labring/sealos/commit/4cdf52e55666864e5f90ed502e9fc13e18985b7b
CVE: CVE-2023-36484
Published: 2023-06-29
Description: ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141710&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI; https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141711&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI; https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141710&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI
CVE: CVE-2022-44719
Published: 2023-06-29
Description: An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://www.synacktiv.com/sites/default/files/2023-06/synacktiv-ucopia-multiple-vulnerabilities-2022.pdf; https://www.ucopia.com/en/; https://www.synacktiv.com/sites/default/files/2023-06/synacktiv-ucopia-multiple-vulnerabilities-2022.pdf
CVE: CVE-2022-44720
Published: 2023-06-29
Description: An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.synacktiv.com/sites/default/files/2023-06/synacktiv-ucopia-multiple-vulnerabilities-2022.pdf; https://www.ucopia.com/en/; https://www.synacktiv.com/sites/default/files/2023-06/synacktiv-ucopia-multiple-vulnerabilities-2022.pdf
CVE: CVE-2023-25433
Published: 2023-06-29
Description: libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://gitlab.com/libtiff/libtiff/-/issues/520; https://gitlab.com/libtiff/libtiff/-/merge_requests/467; https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html
CVE: CVE-2023-26966
Published: 2023-06-29
Description: libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://gitlab.com/libtiff/libtiff/-/issues/530; https://gitlab.com/libtiff/libtiff/-/merge_requests/473; https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html
CVE: CVE-2023-35938
Published: 2023-06-29
Description:  Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows restricted users to `Private without restricted`, restricted users that are project administrators keep this access right. Restricted users that were project administrators before the visibility switch keep the possibility to access the project and do some administration actions. This issue has been resolved in Tuleap version 14.9.99.63. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-281
References: https://github.com/Enalean/tuleap/commit/a108186e7538676c4bf6e615f793f3b787a09b91; https://github.com/Enalean/tuleap/security/advisories/GHSA-rq42-cv6q-3m9q; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a108186e7538676c4bf6e615f793f3b787a09b91
CVE: CVE-2023-36471
Published: 2023-06-29
Description: Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden" name="content" value="{{groovy}}println(&quot;Hello from Groovy!&quot;)" />{{/html}}` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document. This has been patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed tags. Users are advised to upgrade. As a workaround an admin can manually disallow the tags by adding `form, input, select, textarea, button` to the configuration option `xml.htmlElementSanitizer.forbidTags` in the `xwiki.properties` configuration file.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-74, CWE-79
References: https://github.com/xwiki/xwiki-commons/commit/99484d48e899a68a1b6e33d457825b776c6fe8c3; https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-6pqf-c99p-758v; https://jira.xwiki.org/browse/XCOMMONS-2634
CVE: CVE-2020-26708
Published: 2023-06-29
Description: requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/erinxocon/requests-xml/issues/7; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/erinxocon/requests-xml/issues/7
CVE: CVE-2020-26709
Published: 2023-06-29
Description: py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/PinaeOS/py-xml/issues/2; https://github.com/PinaeOS/py-xml/issues/2
CVE: CVE-2020-26710
Published: 2023-06-29
Description: easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/uncmath25/easy-parse/issues/3; https://github.com/uncmath25/easy-parse/issues/3