deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-46858
Published: 2023-05-09
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Amin A.Rezapour Product Specifications for Woocommerce plugin <= 0.6.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/product-specifications/wordpress-product-specifications-for-woocommerce-plugin-0-6-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/product-specifications/wordpress-product-specifications-for-woocommerce-plugin-0-6-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-46864
Published: 2023-05-09
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Umair Saleem Woocommerce Custom Checkout Fields Editor With Drag & Drop plugin <= 0.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-custom-checkout-fields/wordpress-woocommerce-custom-checkout-fields-editor-with-drag-drop-plugin-0-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/woo-custom-checkout-fields/wordpress-woocommerce-custom-checkout-fields-editor-with-drag-drop-plugin-0-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23647
Published: 2023-05-09
Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Team Member – Team with Slider plugin <= 4.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/team-showcase-supreme/wordpress-team-member-team-with-slider-plugin-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/team-showcase-supreme/wordpress-team-member-team-with-slider-plugin-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27407
Published: 2023-05-09
Description: A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user input, making it susceptible to command injection. This could allow an authenticated remote attacker to access the underlying operating system as the root user.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf
CVE: CVE-2023-27408
Published: 2023-05-09
Description: A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The `i2c` mutex file is created with the permissions bits of `-rw-rw-rw-`. This file is used as a mutex for multiple applications interacting with i2c. This could allow an authenticated attacker with access to the SSH interface on the affected device to interfere with the integrity of the mutex and the data it protects.
CVSS Score: 3.3 (LOW)
CWE: CWE-378
References: https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf
CVE: CVE-2023-27409
Published: 2023-05-09
Description: A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). A path traversal vulnerability was found in the `deviceinfo` binary via the `mac` parameter. This could allow an authenticated attacker with access to the SSH interface on the affected device to read the contents of any file named `address`.
CVSS Score: 2.5 (LOW)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf
CVE: CVE-2023-27410
Published: 2023-05-09
Description: A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). A heap-based buffer overflow vulnerability was found in the `edgebox_web_app` binary. The binary will crash if supplied with a backup password longer than 255 characters. This could allow an authenticated privileged attacker to cause a denial of service.
CVSS Score: 2.7 (LOW)
CWE: CWE-122
References: https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf
CVE: CVE-2023-28832
Published: 2023-05-09
Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE: CVE-2023-29103
Published: 2023-05-09
Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions < V2.1). The affected device uses a hard-coded password to protect the diagnostic files. This could allow an authenticated attacker to access protected data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-259
References: https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE: CVE-2023-29104
Published: 2023-05-09
Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to overwrite any file the Linux user `ccuser` has write access to, or to download any file the Linux user `ccuser` has read-only access to.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE: CVE-2023-29105
Published: 2023-05-09
Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions < V2.1). The affected device is vulnerable to a denial of service while parsing a random (non-JSON) MQTT payload. This could allow an attacker who can manipulate the communication between the MQTT broker and the affected device to cause a denial of service (DoS).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-544
References: https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE: CVE-2023-29106
Published: 2023-05-09
Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download the files available via the endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE: CVE-2023-29107
Published: 2023-05-09
Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE: CVE-2023-29128
Published: 2023-05-09
Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to write any file with the extension `.db`.
CVSS Score: 3.8 (LOW)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE: CVE-2023-2594
Published: 2023-05-09
Description: A vulnerability, which was classified as critical, was found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the component Registration. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-228396.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?ctiid.228396; https://vuldb.com/?id.228396; https://vuldb.com/?ctiid.228396
CVE: CVE-2023-2595
Published: 2023-05-09
Description: A vulnerability has been found in SourceCodester Billing Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file ajax_service.php of the component POST Parameter Handler. The manipulation of the argument drop_services leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228397 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yastar/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.228397; https://vuldb.com/?id.228397
CVE: CVE-2023-2596
Published: 2023-05-09
Description: A vulnerability was found in SourceCodester Online Reviewer System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /reviewer/system/system/admins/manage/users/user-update.php of the component GET Parameter Handler. The manipulation of the argument user_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228398 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/rick13795/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.228398; https://vuldb.com/?id.228398
CVE: CVE-2023-30898
Published: 2023-05-09
Description: A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Event Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-502
References: https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf
CVE: CVE-2023-30899
Published: 2023-05-09
Description: A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-502
References: https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf
CVE: CVE-2023-30985
Published: 2023-05-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 3), Solid Edge SE2023 (All versions < V223.0 Update 2). Affected applications contain an out of bounds read past the end of an allocated buffer while parsing a specially crafted OBJ file. This vulnerability could allow an attacker to disclose sensitive information. (ZDI-CAN-19426)
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-932528.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-932528.pdf
CVE: CVE-2023-30986
Published: 2023-05-09
Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 3), Solid Edge SE2023 (All versions < V223.0 Update 2). Affected applications contain a memory corruption vulnerability while parsing specially crafted STP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19561)
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-932528.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-932528.pdf
CVE: CVE-2023-31126
Published: 2023-05-09
Description: `org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect restricted cleaning in HTMLCleaner as there attributes are cleaned and thus characters like `/` and `>` are removed in all attribute names. This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by making sure that data attributes only contain allowed characters. There are no known workarounds apart from upgrading to a version including the fix.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-86, CWE-79
References: https://github.com/xwiki/xwiki-commons/commit/0b8e9c45b7e[PII_REDACTED]f35265b2aa5adc76a68; https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-pv7v-ph6g-3gxv; https://jira.xwiki.org/browse/XCOMMONS-2606
CVE: CVE-2023-31972
Published: 2023-05-09
Description: yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://github.com/yasm/yasm/issues/209; https://github.com/yasm/yasm/issues/209
CVE: CVE-2023-31974
Published: 2023-05-09
Description: yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://github.com/yasm/yasm/issues/208; https://github.com/yasm/yasm/issues/208
CVE: CVE-2023-31975
Published: 2023-05-09
Description: yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.
CVSS Score: 3.3 (LOW)
CWE: CWE-401, CWE-401
References: http://www.openwall.com/lists/oss-security/2023/06/20/6; http://www.openwall.com/lists/oss-security/2023/06/21/10; http://www.openwall.com/lists/oss-security/2023/06/21/13
CVE: CVE-2023-29460
Published: 2023-05-09
Description: An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow potentially resulting in a complete loss of confidentiality, integrity, and availability.

CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139391; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139391
CVE: CVE-2023-29461
Published: 2023-05-09
Description: An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the heap. 

 potentially resulting in a complete loss of confidentiality, integrity, and availability.

CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139391; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139391
CVE: CVE-2023-29462
Published: 2023-05-09
Description: An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the heap. 

 potentially resulting in a complete loss of confidentiality, integrity, and availability.

CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139391; https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-10; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139391
CVE: CVE-2023-31134
Published: 2023-05-09
Description: Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit
arbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-601
References: https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9; https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4; https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5
CVE: CVE-2023-31136
Published: 2023-05-09
Description: PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.
CVSS Score: 3.7 (LOW)
CWE: CWE-522
References: https://github.com/advisories/GHSA-467w-rrqc-395f; https://github.com/advisories/GHSA-735f-7qx4-jqq5; https://github.com/apple/swift-nio/pull/2419
CVE: CVE-2023-31137
Published: 2023-05-09
Description: MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.

The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.

One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://github.com/samboy/MaraDNS/blob/08b21ea20d80cedcb74aa8f14979ec7c61846663/dns/Decompress.c#L886; https://github.com/samboy/MaraDNS/commit/bab062bde40b2ae8a91eecd522e84d8b993bab58; https://github.com/samboy/MaraDNS/security/advisories/GHSA-58m7-826v-9c3c
CVE: CVE-2023-31973
Published: 2023-05-09
Description: yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401, CWE-590
References: https://github.com/yasm/yasm/issues/207; https://github.com/yasm/yasm/issues/207
CVE: CVE-2023-31976
Published: 2023-05-09
Description: libming v0.4.8 was discovered to contain a stack buffer overflow via the function makeswf_preprocess at /util/makeswf_utils.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/libming/libming/issues/265; https://github.com/libming/libming/issues/265
CVE: CVE-2023-31979
Published: 2023-05-09
Description: Catdoc v0.95 was discovered to contain a global buffer overflow via the function process_file at /src/reader.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/petewarden/catdoc/issues/9; https://github.com/petewarden/catdoc/issues/9
CVE: CVE-2023-31981
Published: 2023-05-09
Description: Sngrep v1.6.0 was discovered to contain a stack buffer overflow via the function packet_set_payload at /src/packet.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/irontec/sngrep/issues/430; https://github.com/irontec/sngrep/issues/430
CVE: CVE-2023-31982
Published: 2023-05-09
Description: Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_packet_reasm_ip at /src/capture.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/irontec/sngrep/issues/431; https://github.com/irontec/sngrep/issues/431
CVE: CVE-2023-31138
Published: 2023-05-09
Description: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an object may be able to modify related objects that they should not have access to. DHIS2 implementers should upgrade to a supported version of DHIS2 to receive a patch: 2.37.9.1, 2.38.3.1, or 2.39.1.2. It is possible to work around this issue by blocking all PATCH requests on a reverse proxy, but this may cause some issues with the functionality of built-in applications using legacy PATCH requests.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284, CWE-863
References: https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwvw-4m67-f4g2; https://github.com/dhis2/dhis2-releases/blob/master/releases/2.37/ReleaseNote-2.37.9.1.md; https://github.com/dhis2/dhis2-releases/blob/master/releases/2.38/ReleaseNote-2.38.3.1.md