deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-34761
Published: 2023-06-28
Description: An unauthenticated attacker within BLE proximity can remotely connect to a 7-Eleven LED Message Cup, Hello Cup 1.3.1 for Android, and bypass the application's client-side chat censor filter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://github.com/actuator/7-Eleven-Bluetooth-Smart-Cup-Jailbreak; https://github.com/actuator/cve/blob/main/CVE-2023-34761; https://github.com/actuator/7-Eleven-Bluetooth-Smart-Cup-Jailbreak
CVE: CVE-2023-3090
Published: 2023-06-28
Description: A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb  initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.


We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html; http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=90cbed5247439a966b645b34eb0a2e037836ea8e
CVE: CVE-2023-3389
Published: 2023-06-28
Description: A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.

Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer.

We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable).
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=4716c73b188566865bdd79c3a6709696a224ac04; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.15.y&id=0e388fce7aec40992eadee654193cad345d62663
CVE: CVE-2022-4143
Published: 2023-06-28
Description: An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, unapproved MRs to be introduced and merged without authorization
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-367
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4143.json; https://gitlab.com/gitlab-org/gitlab/-/issues/383776; https://hackerone.com/reports/1767639
CVE: CVE-2023-21512
Published: 2023-06-28
Description: Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access permission.
CVSS Score: 2.4 (LOW)
CWE: CWE-269, CWE-276
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=06; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=06
CVE: CVE-2023-21513
Published: 2023-06-28
Description: Improper privilege management vulnerability in CC Mode prior to SMR Jun-2023 Release 1 allows physical attackers to manipulate device to operate in way that results in unexpected behavior in CC Mode under specific condition.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-269, CWE-276
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=06; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=06
CVE: CVE-2023-21517
Published: 2023-06-28
Description: Heap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=06; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=06
CVE: CVE-2023-21518
Published: 2023-06-28
Description: Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted applications to start arbitrary activity.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=06; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=06
CVE: CVE-2023-2232
Published: 2023-06-28
Description: An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulnerability in the Jira prefix
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2232.json; https://gitlab.com/gitlab-org/gitlab/-/issues/408352; https://hackerone.com/reports/1934802
CVE: CVE-2023-32222
Published: 2023-06-28
Description: D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-32223
Published: 2023-06-28
Description: D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-32224
Published: 2023-06-28
Description: D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-34650
Published: 2023-06-28
Description: PHPgurukl Small CRM v.1.0 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ckalnarayan/Common-Vulnerabilities-and-Exposures/blob/main/CVE-2023-34650; https://phpgurukul.com/small-crm-php/; https://github.com/ckalnarayan/Common-Vulnerabilities-and-Exposures/blob/main/CVE-2023-34650
CVE: CVE-2023-34651
Published: 2023-06-28
Description: PHPgurukl Hospital Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ckalnarayan/Common-Vulnerabilities-and-Exposures/blob/main/CVE-2023-34651; https://phpgurukul.com/hospital-management-system-in-php/; https://github.com/ckalnarayan/Common-Vulnerabilities-and-Exposures/blob/main/CVE-2023-34651
CVE: CVE-2023-34652
Published: 2023-06-28
Description: PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS) via Add New Course.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ckalnarayan/Common-Vulnerabilities-and-Exposures/blob/main/CVE-2023-34652; https://phpgurukul.com/hostel-management-system/; https://github.com/ckalnarayan/Common-Vulnerabilities-and-Exposures/blob/main/CVE-2023-34652
CVE: CVE-2023-3138
Published: 2023-06-28
Description: A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://access.redhat.com/security/cve/CVE-2023-3138; https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c; https://lists.x.org/archives/xorg-announce/2023-June/003406.html
CVE: CVE-2023-3243
Published: 2023-06-28
Description: 
** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash
and utilize it to create new sessions. The hash is also a poorly salted MD5
hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix:  Upgrade to a supported product such
as Alerton
ACM.] Out of an abundance of caution, this CVE ID is being assigned to 
better serve our customers and ensure all who are still running this product understand 
that the product is end of life and should be removed or upgraded. 


CVSS Score: 8.3 (HIGH)
CWE: CWE-290, CWE-326
References: https://www.honeywell.com/us/en/product-security; https://www.honeywell.com/us/en/product-security
CVE: CVE-2023-3355
Published: 2023-06-28
Description: A NULL pointer dereference flaw was found in the Linux kernel's drivers/gpu/drm/msm/msm_gem_submit.c code in the submit_lookup_cmds function, which fails because it lacks a check of the return value of kmalloc(). This issue allows a local user to crash the system.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/security/cve/CVE-2023-3355; https://bugzilla.redhat.com/show_bug.cgi?id=2217820; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d839f0811a31322c087a859c2b181e2383daa7be
CVE: CVE-2023-3390
Published: 2023-06-28
Description: A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.

Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.

We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1240eb93f0616b21c675416516ff3d74798fdc97; https://kernel.dance/1240eb93f0616b21c675416516ff3d74798fdc97
CVE: CVE-2023-3439
Published: 2023-06-28
Description: A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: http://www.openwall.com/lists/oss-security/2023/07/02/1; https://bugzilla.redhat.com/show_bug.cgi?id=2217915; https://github.com/torvalds/linux/commit/b561275d633bcd8e0e8055ab86f1a13df75a0269
CVE: CVE-2023-34647
Published: 2023-06-28
Description: PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ckalnarayan/Common-Vulnerabilities-and-Exposures/blob/main/CVE-2023-34647; https://github.com/ckalnarayan/Common-Vulnerabilities-and-Exposures/blob/main/CVE-2023-34647
CVE: CVE-2023-34736
Published: 2023-06-28
Description: Guantang Equipment Management System version 4.12 is vulnerable to Arbitrary File Upload.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/prismbreak/vulnerabilities/issues/5; https://github.com/prismbreak/vulnerabilities/issues/5
CVE: CVE-2023-36474
Published: 2023-06-28
Description: Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/projectdiscovery/interactsh/issues/136; https://github.com/projectdiscovery/interactsh/pull/155; https://github.com/projectdiscovery/interactsh/security/advisories/GHSA-m36x-mgfh-8g78
CVE: CVE-2023-3357
Published: 2023-06-28
Description: A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=53ffa6a9f83b2170c60591da1ead8791d5a42e81; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=53ffa6a9f83b2170c60591da1ead8791d5a42e81
CVE: CVE-2023-3358
Published: 2023-06-28
Description: A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8
CVE: CVE-2023-3359
Published: 2023-06-28
Description: An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0576ade3aaf24b376ea1a4406ae138e2a22b0c0; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0576ade3aaf24b376ea1a4406ae138e2a22b0c0
CVE: CVE-2023-36475
Published: 2023-06-28
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b[PII_REDACTED]6d90c7aa90; https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f; https://github.com/parse-community/parse-server/issues/8674
CVE: CVE-2023-33661
Published: 2023-06-29
Description: Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ChurchCRM/CRM/issues/6474; https://github.com/ChurchCRM/CRM/issues/6474
CVE: CVE-2023-34738
Published: 2023-06-29
Description: Chemex through 3.7.1 is vulnerable to arbitrary file upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/celaraze/chemex/issues/64; https://github.com/celaraze/chemex/issues/64
CVE: CVE-2023-34843
Published: 2023-06-29
Description: Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/rootd4ddy/CVE-2023-34843; https://github.com/rootd4ddy/CVE-2023-34843
CVE: CVE-2022-29144
Published: 2023-06-29
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29144; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29144
CVE: CVE-2022-29146
Published: 2023-06-29
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29146; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29146
CVE: CVE-2022-29147
Published: 2023-06-29
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 3.1 (LOW)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29147; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29147
CVE: CVE-2023-32610
Published: 2023-06-29
Description: Mailform Pro CGI 4.3.1.2 and earlier allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://jvn.jp/en/jp/JVN70502982/index.html; https://www.synck.com/blogs/news/newsroom/detail_[PII_REDACTED].html; https://www.synck.com/downloads/cgi-perl/mailformpro/feature_[PII_REDACTED].html
CVE: CVE-2023-36476
Published: 2023-06-29
Description: calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 and prior who installed NixOS through the graphical calamares installer, with an unencrypted `/boot`, on either non-UEFI systems or with a LUKS partition different from `/` have their LUKS key file in `/boot` as a plaintext CPIO archive attached to their NixOS initrd. A patch is available and anticipated to be part of version 0.3.13 to backport to NixOS 22.11, 23.05, and unstable channels. Expert users who have a copy of their data may, as a workaround, re-encrypt the LUKS partition(s) themselves.
CVSS Score: 7.9 (HIGH)
CWE: CWE-200, CWE-522
References: https://github.com/NixOS/calamares-nixos-extensions/security/advisories/GHSA-3rvf-24q2-24ww; https://github.com/osresearch/heads/issues/1348; https://github.com/vlinkz/calamares-nixos-extensions/commit/837ca4da5521a74d3b5ca6f7b88890a6713faa22
CVE: CVE-2022-26899
Published: 2023-06-29
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 6.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26899; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26899
CVE: CVE-2022-46407
Published: 2023-06-29
Description: Ericsson Network Manager (ENM), versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP Header Injection can lead to redirection of the submitted request to domain out of control of ENM deployment. The attacker would need admin/elevated access to exploit the vulnerability
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-601
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2023-1602
Published: 2023-06-29
Description: The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 4.4 (MEDIUM)
References: https://plugins.trac.wordpress.org/changeset/2931815/shorten-url/trunk/shorten-url.php; https://wordpress.org/plugins/shorten-url/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f29f35-da79-4389-a0a5-a1be0b0b8996?source=cve
CVE: CVE-2023-2982
Published: 2023-06-29
Description: The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://lana.codes/lanavdb/2326f41f-a39f-4fde-8627-9d29fff91443/; https://plugins.trac.wordpress.org/browser/miniorange-login-openid/trunk/mo-openid-social-login-functions.php#L107; https://plugins.trac.wordpress.org/changeset/2924863/miniorange-login-openid
CVE: CVE-2023-37237
Published: 2023-06-29
Description: In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://www.veritas.com/content/support/en_US/security/VTS23-004; https://www.veritas.com/content/support/en_US/security/VTS23-004
CVE: CVE-2022-46408
Published: 2023-06-29
Description: Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper Neutralization of Formula Elements in a CSV File can lead to remote code execution or data leakage via maliciously injected hyperlinks. The attacker would need admin/elevated access to exploit the vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1236
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2023-34648
Published: 2023-06-29
Description: A Cross Site Scripting vulnerability in PHPgurukl User Registration Login and User Management System with admin panel v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the signup.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ckalnarayan/Common-Vulnerabilities-and-Exposures/blob/main/CVE-2023-34648; https://github.com/ckalnarayan/Common-Vulnerabilities-and-Exposures/blob/main/CVE-2023-34648
CVE: CVE-2023-34734
Published: 2023-06-29
Description: Annet AC Centralized Management Platform 1.02.040 is vulnerable to Stored Cross-Site Scripting (XSS) .
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/prismbreak/vulnerabilities/issues/3; https://github.com/prismbreak/vulnerabilities/issues/3
CVE: CVE-2023-34831
Published: 2023-06-29
Description: The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form ("id" and "title" HTTP POST parameters) where the students submit their reports for similarity/plagiarism checks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831.txt; https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_Submission_Web_Form/; https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831.txt
CVE: CVE-2023-34834
Published: 2023-06-29
Description: A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about the configured databases via the "/file" endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: http://www.mclv4.mcl-collection.com/index.php; https://www.exploit-db.com/exploits/51542; http://www.mclv4.mcl-collection.com/index.php
CVE: CVE-2022-23264
Published: 2023-06-29
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.7 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23264; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23264