deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-32468
Published: 2023-07-26
Description: 
Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability. A remote malicious high-privileged user could potentially exploit this vulnerability leading to exposure of this sensitive data.


CVSS Score: 5.8 (MEDIUM)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000215903/dsa-2023-254-security-update-for-dell-ecs-streamer-sensitive-data-exposure-vulnerability; https://www.dell.com/support/kbdoc/en-us/000215903/dsa-2023-254-security-update-for-dell-ecs-streamer-sensitive-data-exposure-vulnerability
CVE: CVE-2023-38433
Published: 2023-07-26
Description: Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as follows: IP-HE950E firmware versions V01L001 to V01L053, IP-HE950D firmware versions V01L001 to V01L053, IP-HE900E firmware versions V01L001 to V01L010, IP-HE900D firmware versions V01L001 to V01L004, IP-900E / IP-920E firmware versions V01L001 to V02L061, IP-900D / IP-900ⅡD / IP-920D firmware versions V01L001 to V02L061, IP-90 firmware versions V01L001 to V01L013, and IP-9610 firmware versions V01L001 to V02L007.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://jvn.jp/en/jp/JVN95727578/; https://www.fujitsu.com/global/products/computing/peripheral/video/download/; https://jvn.jp/en/jp/JVN95727578/
CVE: CVE-2023-38555
Published: 2023-07-26
Description: Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products. Affected products and versions are as follows: Si-R 30B all versions, Si-R 130B all versions, Si-R 90brin all versions, Si-R570B all versions, Si-R370B all versions, Si-R220D all versions, Si-R G100 V02.54 and earlier, Si-R G200 V02.54 and earlier, Si-R G100B V04.12 and earlier, Si-R G110B V04.12 and earlier, Si-R G200B V04.12 and earlier, Si-R G210 V20.52 and earlier, Si-R G211 V20.52 and earlier, Si-R G120 V20.52 and earlier, Si-R G121 V20.52 and earlier, and SR-M 50AP1 all versions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://jvn.jp/en/vu/JVNVU96643580/; https://www.fujitsu.com/jp/products/network/support/2023/fjlan-01/; https://jvn.jp/en/vu/JVNVU96643580/
CVE: CVE-2023-38647
Published: 2023-07-26
Description: An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation.

Affect all the versions lower and include 1.2.0.

Affected products: helix-core, helix-rest

Mitigation: Short term, stop using any YAML based configuration and workflow creation.
                  Long term, all Helix version bumping up to 1.3.0 


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/zyqxhv0lc2z9w3tgr8ttrdy2zfh5jvc4; https://lists.apache.org/thread/zyqxhv0lc2z9w3tgr8ttrdy2zfh5jvc4
CVE: CVE-2023-38669
Published: 2023-07-26
Description: Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. This resulted in a potentially exploitable condition.

CVSS Score: 8.3 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-001.md; https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-001.md
CVE: CVE-2023-28130
Published: 2023-07-26
Description: Local user may lead to privilege escalation using Gaia Portal hostnames page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-77
References: http://packetstormsecurity.com/files/173918/Checkpoint-Gaia-Portal-R81.10-Remote-Command-Execution.html; http://seclists.org/fulldisclosure/2023/Aug/4; http://seclists.org/fulldisclosure/2023/Jul/43
CVE: CVE-2023-38670
Published: 2023-07-26
Description: Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0. This resulted in a runtime crash and denial of service.

CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-002.md; https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-002.md
CVE: CVE-2023-38671
Published: 2023-07-26
Description: Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.

CVSS Score: 8.3 (HIGH)
CWE: CWE-120, CWE-787
References: https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-003.md; https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-003.md
CVE: CVE-2023-38672
Published: 2023-07-26
Description: FPE in paddle.trace in PaddlePaddle before 2.5.0. This flaw can cause a runtime crash and a denial of service.

CVSS Score: 4.7 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-004.md; https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-004.md
CVE: CVE-2023-38673
Published: 2023-07-26
Description: PaddlePaddle before 2.5.0 has a command injection in fs.py. This resulted in the ability to execute arbitrary commands on the operating system.

CVSS Score: 9.6 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-005.md; https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-005.md
CVE: CVE-2023-37049
Published: 2023-07-26
Description: emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/Num-Nine/CVE/issues/1; https://github.com/Num-Nine/CVE/issues/1
CVE: CVE-2023-39261
Published: 2023-07-26
Description: In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-250
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-43710
Published: 2023-07-26
Description: Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery (CSRF) because the unique token could be deduced using the names of all input fields.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://service.gxsoftware.com; https://service.gxsoftware.com/hc/nl/articles/[PII_REDACTED]461; https://service.gxsoftware.com
CVE: CVE-2022-43711
Published: 2023-07-26
Description: Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks (XSS) because the CSP header uses eval() in the script-src.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://service.gxsoftware.com; https://service.gxsoftware.com/hc/nl/articles/[PII_REDACTED]461; https://service.gxsoftware.com
CVE: CVE-2022-43712
Published: 2023-07-26
Description: POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://service.gxsoftware.com/hc/en-us/articles/[PII_REDACTED]381-Vulnerability-in-Spring-core-Spring4Shell-; https://service.gxsoftware.com/hc/nl/articles/[PII_REDACTED]461; https://service.gxsoftware.com/hc/en-us/articles/[PII_REDACTED]381-Vulnerability-in-Spring-core-Spring4Shell-
CVE: CVE-2022-43713
Published: 2023-07-26
Description: Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypassed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-116
References: https://service.gxsoftware.com; https://service.gxsoftware.com/hc/nl/articles/[PII_REDACTED]461; https://service.gxsoftware.com
CVE: CVE-2023-23843
Published: 2023-07-26
Description: The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-697, CWE-697
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2023-23843; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE: CVE-2023-23844
Published: 2023-07-26
Description: The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-184, CWE-697
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23844; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE: CVE-2023-26859
Published: 2023-07-26
Description: SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderTracking.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/en/newsletter-sms/8300-sendinblue-all-in-one-marketing-tool.html; https://security.friendsofpresta.org/modules/2023/07/25/sendinblue.html; https://addons.prestashop.com/en/newsletter-sms/8300-sendinblue-all-in-one-marketing-tool.html
CVE: CVE-2023-26911
Published: 2023-07-26
Description: ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: http://asus.com; http://setupasusservices.com; https://irradiate.com.au/blog/CVE-2023-26911
CVE: CVE-2023-33224
Published: 2023-07-26
Description: The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-696
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2023-33224; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE: CVE-2023-33225
Published: 2023-07-26
Description: The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-697, CWE-697
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2023-33225; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE: CVE-2023-39151
Published: 2023-07-26
Description: Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2023/07/26/2; https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3188; http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE: CVE-2023-39152
Published: 2023-07-26
Description: Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-670
References: http://www.openwall.com/lists/oss-security/2023/07/26/2; https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3208; http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE: CVE-2023-39153
Published: 2023-07-26
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2023/07/26/2; https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-2696; http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE: CVE-2023-39154
Published: 2023-07-26
Description: Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2023/07/26/2; https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3012; http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE: CVE-2023-39155
Published: 2023-07-26
Description: Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: http://www.openwall.com/lists/oss-security/2023/07/26/2; https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3192; http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE: CVE-2023-39156
Published: 2023-07-26
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2023/07/26/2; https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3095; http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE: CVE-2023-23842
Published: 2023-07-26
Description: The SolarWinds Network Configuration Manager was susceptible to the Directory Traversal Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-3_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23842; https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-3_release_notes.htm
CVE: CVE-2023-33229
Published: 2023-07-26
Description: The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML. 
CVSS Score: 3.5 (LOW)
CWE: CWE-94, CWE-94
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2023-33229; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE: CVE-2023-33308
Published: 2023-07-26
Description: A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://fortiguard.com/psirt/FG-IR-23-183; https://fortiguard.com/psirt/FG-IR-23-183
CVE: CVE-2023-3622
Published: 2023-07-26
Description: 
 Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource 
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-3622; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE: CVE-2023-30577
Published: 2023-07-26
Description: AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than CVE-2022-37705.
CVSS Score: 7.8 (HIGH)
CWE: CWE-88, CWE-88
References: https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.4; https://github.com/zmanda/amanda/security/advisories/GHSA-crrw-v393-h5q3; https://lists.debian.org/debian-lts-announce/2023/12/msg00003.html
CVE: CVE-2023-30949
Published: 2023-07-26
Description: A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1173, CWE-346
References: https://palantir.safebase.us/?tcuUid=bbc1772c-e10a-45cc-b89f-48cc1a8b2cfc; https://palantir.safebase.us/?tcuUid=bbc1772c-e10a-45cc-b89f-48cc1a8b2cfc
CVE: CVE-2023-3242
Published: 2023-07-26
Description: Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions.
CVSS Score: 8.6 (HIGH)
CWE: CWE-665, CWE-770
References: https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]46-en-original-1.0.pdf; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]46-en-original-1.0.pdf
CVE: CVE-2023-3414
Published: 2023-07-26
Description: A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server.  No changes are required on your instances of the Now Platform. 

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1434118; https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1434118
CVE: CVE-2023-3442
Published: 2023-07-26
Description: A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server.  No changes are required on your instances of the Now Platform. 

CVSS Score: 7.7 (HIGH)
CWE: CWE-862, CWE-862
References: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1434119; https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1434119
CVE: CVE-2022-31456
Published: 2023-07-26
Description: A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the team name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40rohitgautam26/cve-2022-31456-c8bbefba6cc1; https://www.acunetix.com/vulnerabilities/web/cross-site-scripting/; https://medium.com/%40rohitgautam26/cve-2022-31456-c8bbefba6cc1
CVE: CVE-2023-31465
Published: 2023-07-26
Description: An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.
CVSS Score: 9.8 (CRITICAL)
References: https://fsmlabs.com/fsmlabs-cybersecurity/; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-31465.md; https://fsmlabs.com/fsmlabs-cybersecurity/
CVE: CVE-2023-31466
Published: 2023-07-26
Description: An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the "Configuration -> Compliance -> Add a new compliance report" and "Configuration -> Timekeeper Configuration -> Add a new source there" screens, there are entry points to inject JavaScript code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fsmlabs.com/fsmlabs-cybersecurity/; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-31466.md; https://fsmlabs.com/fsmlabs-cybersecurity/
CVE: CVE-2023-33802
Published: 2023-07-26
Description: A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/CDACesec/CVE-2023-33802; https://github.com/CDACesec/CVE-2023-33802
CVE: CVE-2023-37623
Published: 2023-07-26
Description: Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/benjaminpsinclair/Netdisco-2023-Advisory; https://github.com/benjaminpsinclair/Netdisco-CVE; https://github.com/netdisco/netdisco/commit/39562e0633a2472d50f7f33e69c36da4ad1fbfa3
CVE: CVE-2023-37624
Published: 2023-07-26
Description: Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/benjaminpsinclair/Netdisco-2023-Advisory; https://github.com/benjaminpsinclair/Netdisco-CVE; https://github.com/netdisco/netdisco/commit/a2da6a7a046c1c0fd41072dd6991eec7614293f8
CVE: CVE-2022-31455
Published: 2023-07-26
Description: * A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a user chat box.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40rohitgautam26/cve-2022-31455-bc929f477446; https://www.acunetix.com/vulnerabilities/web/cross-site-scripting/; https://medium.com/%40rohitgautam26/cve-2022-31455-bc929f477446