deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-25576
Published: 2023-02-14
Description: @fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an unlimited number of file parts, the multipart body parser accepting an unlimited number of field parts, and the multipart body parser accepting an unlimited number of empty parts as field parts. This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fb5a17173c1297; https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1; https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1
CVE: CVE-2023-0830
Published: 2023-02-14
Description: A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/xbz0n/CVE-2023-0830; https://vuldb.com/?ctiid.220950; https://vuldb.com/?id.220950
CVE: CVE-2022-41564
Published: 2023-02-14
Description: The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.1.0 through 6.2.1 and TIBCO Operational Intelligence Hawk RedTail: versions 7.0.0 through 7.2.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-522
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2023-22931
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-276
References: https://advisory.splunk.com/advisories/SVD-2023-0201; https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/; https://advisory.splunk.com/advisories/SVD-2023-0201
CVE: CVE-2023-22932
Published: 2023-02-14
Description: In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://advisory.splunk.com/advisories/SVD-2023-0202; https://research.splunk.com/application/ce6e1268-e01c-4df2-a617-0f034ed49a43/; https://advisory.splunk.com/advisories/SVD-2023-0202
CVE: CVE-2023-22933
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extensible mark-up language (XML) View through the ‘layoutPanel’ attribute in the ‘module’ tag’.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://advisory.splunk.com/advisories/SVD-2023-0203; https://research.splunk.com/application/9ac2bfea-a234-4a18-9d37-6d747e85c2e4; https://advisory.splunk.com/advisories/SVD-2023-0203
CVE: CVE-2023-22934
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a saved search job. The vulnerability requires an authenticated user to craft the saved job and a higher privileged user to initiate a request within their browser.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-20
References: https://advisory.splunk.com/advisories/SVD-2023-0204; https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd; https://advisory.splunk.com/advisories/SVD-2023-0204
CVE: CVE-2023-22935
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-77
References: https://advisory.splunk.com/advisories/SVD-2023-0205; https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd; https://advisory.splunk.com/advisories/SVD-2023-0205
CVE: CVE-2023-22936
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within the environment.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://advisory.splunk.com/advisories/SVD-2023-0206; https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd; https://advisory.splunk.com/advisories/SVD-2023-0206
CVE: CVE-2023-22937
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now be one of the following only: .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gzl.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-434
References: https://advisory.splunk.com/advisories/SVD-2023-0207; https://research.splunk.com/application/b7d1293f-e78f-415e-b5f6-443df3480082/; https://advisory.splunk.com/advisories/SVD-2023-0207
CVE: CVE-2023-22938
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://advisory.splunk.com/advisories/SVD-2023-0208; https://advisory.splunk.com/advisories/SVD-2023-0208
CVE: CVE-2023-22939
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://advisory.splunk.com/advisories/SVD-2023-0209; https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd; https://advisory.splunk.com/advisories/SVD-2023-0209
CVE: CVE-2023-22940
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://advisory.splunk.com/advisories/SVD-2023-0210; https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/; https://advisory.splunk.com/advisories/SVD-2023-0210
CVE: CVE-2023-22941
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248
References: https://advisory.splunk.com/advisories/SVD-2023-0211; https://research.splunk.com/application/08978eca-caff-44c1-84dc-53f17def4e14/; https://advisory.splunk.com/advisories/SVD-2023-0211
CVE: CVE-2023-22942
Published: 2023-02-14
Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://advisory.splunk.com/advisories/SVD-2023-0212; https://research.splunk.com/application/4742d5f7-ce00-45ce-9c79-5e98b43b4410/; https://advisory.splunk.com/advisories/SVD-2023-0212
CVE: CVE-2023-22943
Published: 2023-02-14
Description: In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-636, CWE-295
References: https://advisory.splunk.com/advisories/SVD-2023-0213; https://advisory.splunk.com/advisories/SVD-2023-0213
CVE: CVE-2023-25563
Published: 2023-02-14
Description: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/gssapi/gss-ntlmssp/commit/97c62c[PII_REDACTED]d80765080e74d91dfc99efbd; https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0; https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-jjjx-5qf7-9mgf
CVE: CVE-2023-25564
Published: 2023-02-14
Description: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was not initialized and could cause writing a zero to an arbitrary place in memory if `ntlm_str_convert()` were to fail, which would leave `outlen` uninitialized. This can lead to a denial of service if the write hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This issue is fixed in version 1.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/gssapi/gss-ntlmssp/commit/c753000eb31835c0664e528fbc99378ae0cbe950; https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0; https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-r85x-q5px-9xfq
CVE: CVE-2023-25565
Published: 2023-02-14
Description: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-590, CWE-763
References: https://github.com/gssapi/gss-ntlmssp/commit/c16100f60907a2de92bcb676f303b81facee0f64; https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0; https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfg
CVE: CVE-2023-25566
Published: 2023-02-14
Description: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-service. The domain portion of a username may be overridden causing an allocated memory area the size of the domain name to be leaked. An attacker can leak memory via the main `gss_accept_sec_context` entry point, potentially causing a denial-of-service. This issue is fixed in version 1.2.0.


CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://github.com/gssapi/gss-ntlmssp/commit/8660fb16474054e692a596e9c79670cd4d3954f4; https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0; https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-mfm4-6g58-jw74
CVE: CVE-2023-25567
Published: 2023-02-14
Description: GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/gssapi/gss-ntlmssp/commit/025fbb756d44ffee8f847db4222ed6aa4bd1fbe4; https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0; https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-24pf-6prf-24ch
CVE: CVE-2023-25571
Published: 2023-02-14
Description: Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components` prior to 0.12.4, and `@backstage/plugin-catalog-backend` prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack.

This vulnerability has been patched in both the frontend and backend implementations. The default `Link` component from `@backstage/core-components` version 1.2.0 and greater will now reject `javascript:` URLs, and there is a global override of `window.open` to do the same. In addition, the catalog model v0.12.4 and greater as well as the catalog backend v1.7.2 and greater now has additional validation built in that prevents `javascript:` URLs in known annotations. As a workaround, the general practice of limiting access to modifying catalog content and requiring code reviews greatly help mitigate this vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-84, CWE-79
References: https://github.com/backstage/backstage/commit/3d[PII_REDACTED]f7fa8bd0e2d357e00eada2c3e8a8; https://github.com/backstage/backstage/security/advisories/GHSA-7hv8-3fr9-j2hv; https://github.com/backstage/backstage/commit/3d[PII_REDACTED]f7fa8bd0e2d357e00eada2c3e8a8
CVE: CVE-2023-25725
Published: 2023-02-14
Description: HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-444
References: https://git.haproxy.org/?p=haproxy-2.7.git%3Ba=commit%3Bh=a0e561ad7f29ed50c473f5a9da664267b60d1112; https://lists.debian.org/debian-lts-announce/2023/02/msg00012.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPTJQHKUEU2PQ7RWFUYAFLAD4STEIKHU/
CVE: CVE-2023-21528
Published: 2023-02-14
Description: Microsoft SQL Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21528; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21528
CVE: CVE-2023-21529
Published: 2023-02-14
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21529
CVE: CVE-2023-21564
Published: 2023-02-14
Description: Azure DevOps Server Cross-Site Scripting Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21564; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21564
CVE: CVE-2023-21568
Published: 2023-02-14
Description: Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21568; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21568
CVE: CVE-2023-21570
Published: 2023-02-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21570; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21570
CVE: CVE-2023-21571
Published: 2023-02-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21571; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21571
CVE: CVE-2023-21572
Published: 2023-02-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21572; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21572
CVE: CVE-2023-21573
Published: 2023-02-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21573; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21573
CVE: CVE-2023-21684
Published: 2023-02-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21684; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21684
CVE: CVE-2023-21685
Published: 2023-02-14
Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21685; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21685
CVE: CVE-2023-21686
Published: 2023-02-14
Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21686; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21686
CVE: CVE-2023-21687
Published: 2023-02-14
Description: HTTP.sys Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-668
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21687; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21687
CVE: CVE-2023-21688
Published: 2023-02-14
Description: NT OS Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21688; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21688
CVE: CVE-2023-21689
Published: 2023-02-14
Description: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21689; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21689
CVE: CVE-2023-21690
Published: 2023-02-14
Description: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21690; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21690
CVE: CVE-2023-21691
Published: 2023-02-14
Description: Microsoft Protected Extensible Authentication Protocol (PEAP) Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21691; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21691
CVE: CVE-2023-21692
Published: 2023-02-14
Description: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21692; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21692
CVE: CVE-2023-21693
Published: 2023-02-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21693; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21693
CVE: CVE-2023-21694
Published: 2023-02-14
Description: Windows Fax Service Remote Code Execution Vulnerability
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21694; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21694
CVE: CVE-2023-21695
Published: 2023-02-14
Description: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21695; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21695
CVE: CVE-2023-21697
Published: 2023-02-14
Description: Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21697; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21697
CVE: CVE-2023-21699
Published: 2023-02-14
Description: Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21699; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21699
CVE: CVE-2023-21700
Published: 2023-02-14
Description: Windows iSCSI Discovery Service Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21700; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21700