deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1738
Published: 2023-03-30
Description: A vulnerability has been found in SourceCodester Young Entrepreneur E-Negosyo System 1.0 and classified as critical. This vulnerability affects unknown code of the file index.php?q=product. The manipulation of the argument search leads to sql injection. The attack can be initiated remotely. VDB-224626 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?ctiid.224626; https://vuldb.com/?id.224626; https://vuldb.com/?ctiid.224626
CVE: CVE-2023-1739
Published: 2023-03-30
Description: A vulnerability was found in SourceCodester Simple and Beautiful Shopping Cart System 1.0 and classified as critical. This issue affects some unknown processing of the file upload.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224627.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://gitee.com/misak7in/cve/blob/master/simple%20and%20beautiful%20shopping%20cart%20system/simple%20and%20beautiful%20shopping%20cart%20system%20upload.php%20has%20a%20file%20upload%20vulnerability.pdf; https://vuldb.com/?ctiid.224627; https://vuldb.com/?id.224627
CVE: CVE-2023-1740
Published: 2023-03-30
Description: A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been classified as critical. Affected is an unknown function of the file admin/user/manage_user.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224628.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/west9b/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.224628; https://vuldb.com/?id.224628
CVE: CVE-2023-1741
Published: 2023-03-30
Description: A vulnerability was found in jeecg-boot 3.5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file SysDictMapper.java of the component Sleep Command Handler. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224629 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/private-null/report/blob/main/README.md; https://vuldb.com/?ctiid.224629; https://vuldb.com/?id.224629
CVE: CVE-2023-1742
Published: 2023-03-30
Description: A vulnerability was found in IBOS 4.5.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /?r=report/api/getlist of the component Report Search. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-224630 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://gitee.com/wkstestete/cve/blob/master/sql/ibos%20sql%20injection3.md; https://vuldb.com/?ctiid.224630; https://vuldb.com/?id.224630
CVE: CVE-2023-1743
Published: 2023-03-30
Description: A vulnerability classified as problematic has been found in SourceCodester Grade Point Average GPA Calculator 1.0. This affects an unknown part of the file index.php. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224631.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Grade%20Point%20Average%20(GPA)%20Calculator%20in%20PHP%20and%20SQLite3/Grade%20Point%20Average%20(GPA)%20Calculator%20in%20PHP%20and%20SQLite3%20vlun%202.pdf; https://vuldb.com/?ctiid.224631; https://vuldb.com/?id.224631
CVE: CVE-2023-25587
Published: 2023-03-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-1670
Published: 2023-03-30
Description: A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html; https://lore.kernel.org/all/[PII_REDACTED][PII_REDACTED]-1-zyytlz.wz%40163.com/
CVE: CVE-2023-1744
Published: 2023-03-30
Description: A vulnerability classified as critical was found in IBOS 4.5.5. This vulnerability affects unknown code of the component htaccess Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224632.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://gitee.com/xieqiangweb/cve/blob/master/cve/IBOS%20oa%20v4.5.5%20upload.md; https://vuldb.com/?ctiid.224632; https://vuldb.com/?id.224632
CVE: CVE-2023-1745
Published: 2023-03-30
Description: A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73. This issue affects some unknown processing in the library SHFOLDER.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224633 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://drive.google.com/file/d/1bdYaDmtWhnjaHkzv3bZ4PUSMzDJ8JjSV/view; https://github.com/10cksYiqiyinHangzhouTechnology/KMPlayer_Poc; https://vuldb.com/?ctiid.224633
CVE: CVE-2023-1746
Published: 2023-03-30
Description: A vulnerability, which was classified as problematic, was found in Dreamer CMS up to 3.5.0. Affected is an unknown function of the component File Upload Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-224634 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/iteachyou-wjn/dreamer_cms/issues/11; https://vuldb.com/?ctiid.224634; https://vuldb.com/?id.224634
CVE: CVE-2023-1747
Published: 2023-03-31
Description: A vulnerability has been found in IBOS up to 4.5.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /?r=email/api/mark&op=delFromSend. The manipulation of the argument emailids leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.5 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-224635.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://gitee.com/wkstestete/cve/blob/master/sql/ibos%20sql%20injection.md; https://vuldb.com/?ctiid.224635; https://vuldb.com/?id.224635
CVE: CVE-2023-1753
Published: 2023-03-31
Description: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-521
References: https://github.com/thorsten/phpmyfaq/commit/f612a72494080e04947da7028340fee4493fe8a5; https://huntr.dev/bounties/01d6ae23-3a8f-42a8-99f4-10246187d71b; https://github.com/thorsten/phpmyfaq/commit/f612a72494080e04947da7028340fee4493fe8a5
CVE: CVE-2023-1754
Published: 2023-03-31
Description: Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/d773df925cb74e874527458beed1f66f966ec491; https://huntr.dev/bounties/529f2361-eb2e-476f-b7ef-4e561a712e28; https://github.com/thorsten/phpmyfaq/commit/d773df925cb74e874527458beed1f66f966ec491
CVE: CVE-2023-1755
Published: 2023-03-31
Description: Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/[PII_REDACTED]fd3abf4c65270def77aed20ffc8994; https://huntr.dev/bounties/882ffa07-5397-4dbb-886f-4626859d711a; https://github.com/thorsten/phpmyfaq/commit/[PII_REDACTED]fd3abf4c65270def77aed20ffc8994
CVE: CVE-2023-1759
Published: 2023-03-31
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/ecbd8107fe954b6be95dab315862d1caa0b94efa; https://huntr.dev/bounties/e8109aed-d364-4c0c-9545-4de0347b10e1; https://github.com/thorsten/phpmyfaq/commit/ecbd8107fe954b6be95dab315862d1caa0b94efa
CVE: CVE-2023-1760
Published: 2023-03-31
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/56295b54062a284020fccce12a5044f9fa7d2770; https://huntr.dev/bounties/2d0ac48a-490d-4548-8d98-7447042dd1b5; https://github.com/thorsten/phpmyfaq/commit/56295b54062a284020fccce12a5044f9fa7d2770
CVE: CVE-2023-1761
Published: 2023-03-31
Description: Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/128ef85f8e3ab7869d3107aa4d0b6867b53391d7; https://huntr.dev/bounties/24c0a65f-0751-4ff8-af63-4b325ac8879f; https://github.com/thorsten/phpmyfaq/commit/128ef85f8e3ab7869d3107aa4d0b6867b53391d7
CVE: CVE-2023-1762
Published: 2023-03-31
Description: Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/thorsten/phpmyfaq/commit/ae6c1d8c3eab05d6e2227c7a9998707f4f891514; https://huntr.dev/bounties/3c2374cc-7082-44b7-a6a6-ccff7a650a3a; https://github.com/thorsten/phpmyfaq/commit/ae6c1d8c3eab05d6e2227c7a9998707f4f891514
CVE: CVE-2023-28755
Published: 2023-03-31
Description: A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/ruby/uri/releases/; https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
CVE: CVE-2023-28756
Published: 2023-03-31
Description: A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/ruby/time/releases/; https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
CVE: CVE-2023-28726
Published: 2023-03-31
Description: Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: https://www2.panasonic.biz/jp/densetsu/aiseg/firmup_info.html; https://www2.panasonic.biz/jp/densetsu/aiseg/firmup_info.html
CVE: CVE-2023-28727
Published: 2023-03-31
Description: Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287, CWE-305
References: https://www2.panasonic.biz/jp/densetsu/aiseg/firmup_info.html; https://www2.panasonic.biz/jp/densetsu/aiseg/firmup_info.html
CVE: CVE-2023-1258
Published: 2023-03-31
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footprinting.This issue affects Flow-X: before 4.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://packetstormsecurity.com/files/173610/ABB-FlowX-4.00-Information-Disclosure.html; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A9754&LanguageCode=en&DocumentPartId=&Action=Launch; http://packetstormsecurity.com/files/173610/ABB-FlowX-4.00-Information-Disclosure.html
CVE: CVE-2023-1060
Published: 2023-03-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YKM YKM CRM allows Reflected XSS.This issue affects YKM CRM: before 23.03.30.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0189; https://www.usom.gov.tr/bildirim/tr-23-0189
CVE: CVE-2023-1769
Published: 2023-03-31
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Grade Point Average GPA Calculator 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page with the input php://filter/read=convert.base64-encode/resource=grade_table leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-224670 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/Pe4cefulSnow/CVE-Advisory/blob/main/README.md; https://vuldb.com/?ctiid.224670; https://vuldb.com/?id.224670
CVE: CVE-2023-1770
Published: 2023-03-31
Description: A vulnerability has been found in SourceCodester Grade Point Average GPA Calculator 1.0 and classified as critical. Affected by this vulnerability is the function get_scale of the file Master.php. The manipulation of the argument perc leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224671.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Pe4cefulSnow/SQL-Injection/blob/main/README.md; https://vuldb.com/?ctiid.224671; https://vuldb.com/?id.224671
CVE: CVE-2023-1771
Published: 2023-03-31
Description: A vulnerability was found in SourceCodester Grade Point Average GPA Calculator 1.0 and classified as problematic. Affected by this issue is the function get_scale of the file Master.php. The manipulation of the argument perc leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224672.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Grade%20Point%20Average%20(GPA)%20Calculator%20in%20PHP%20and%20SQLite3/Grade%20Point%20Average%20(GPA)%20Calculator%20in%20PHP%20and%20SQLite3%20vlun%201.pdf; https://vuldb.com/?ctiid.224672; https://vuldb.com/?id.224672
CVE: CVE-2023-1772
Published: 2023-03-31
Description: A vulnerability was found in DataGear up to 4.5.1. It has been classified as problematic. This affects an unknown part of the component Diagram Type Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224673 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/yangyanglo/ForCVE/blob/main/2023-0x02.md; https://vuldb.com/?ctiid.224673; https://vuldb.com/?id.224673
CVE: CVE-2023-1773
Published: 2023-03-31
Description: A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-224674 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://gitee.com/galaxies2580/cve/blob/master/xinhuv2.3.2.md; https://vuldb.com/?ctiid.224674; https://vuldb.com/?id.224674
CVE: CVE-2023-1774
Published: 2023-03-31
Description: When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.



CVSS Score: 4.2 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-1775
Published: 2023-03-31
Description: When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-1776
Published: 2023-03-31
Description: Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.



CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-1777
Published: 2023-03-31
Description: Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-0343
Published: 2023-03-31
Description: Akuvox E11 contains a function that encrypts messages which are then forwarded. The IV vector and the key are static, and this may allow an attacker to decrypt messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0344
Published: 2023-03-31
Description: Akuvox E11 appears to be using a custom version of dropbear SSH server. This server allows an insecure option that by default is not in the official dropbear SSH server.
CVSS Score: 9.1 (CRITICAL)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0432
Published: 2023-03-31
Description: 
The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system (OS) from the device in the context of the user "root." If the attacker has credentials for the web service, then the device could be fully compromised.




CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-033-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-033-05
CVE: CVE-2023-26829
Published: 2023-03-31
Description: An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user account, without needing the previous known password, resulting in a full authentication bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://www.whiteoaksecurity.com/blog/centrestack-disclosure/; https://www.whiteoaksecurity.com/blog/centrestack-disclosure/
CVE: CVE-2023-26830
Published: 2023-03-31
Description: An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by uploading malicious files to the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.whiteoaksecurity.com/blog/centrestack-disclosure/; https://www.whiteoaksecurity.com/blog/centrestack-disclosure/
CVE: CVE-2023-28464
Published: 2023-03-31
Description: hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://lore.kernel.org/lkml/[PII_REDACTED]4645.74309-1-wzhmmmmm%40gmail.com/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.openwall.com/lists/oss-security/2023/03/28/2
CVE: CVE-2022-3192
Published: 2023-03-31
Description: Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://search.abb.com/library/Download.aspx?DocumentID=3ADR011162&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=3ADR011162&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2023-28862
Published: 2023-03-31
Description: An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2896; https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.16.1; https://lists.debian.org/debian-lts-announce/2023/07/msg00018.html
CVE: CVE-2023-28877
Published: 2023-03-31
Description: The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration data. (apps-graphql@3.x is unaffected by this issue.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://developers.vtex.com/updates/release-notes/deprecation-of-apps-graphql%402.x; https://developers.vtex.com/updates/release-notes/deprecation-of-apps-graphql%402.x
CVE: CVE-2023-28879
Published: 2023-03-31
Description: In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: http://www.openwall.com/lists/oss-security/2023/04/12/4; https://bugs.ghostscript.com/show_bug.cgi?id=706494; https://ghostscript.readthedocs.io/en/latest/News.html