deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-43799
Published: 2023-10-04
Description: Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer process. This affects versions of the software running on MacOS, Windows, and Linux. Version 5.2.5 fixes this issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://github.com/altair-graphql/altair/releases/tag/v5.2.5; https://github.com/altair-graphql/altair/security/advisories/GHSA-9m5v-vrf6-fmvm; https://github.com/altair-graphql/altair/releases/tag/v5.2.5
CVE: CVE-2023-43805
Published: 2023-10-04
Description: Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc; https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d; https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf
CVE: CVE-2023-43809
Published: 2023-10-04
Description: Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is active, through the `allow-keyless` setting, and the public key requires additional client-side verification for example using FIDO2 or GPG. This is due to insufficient validation procedures of the public key step during SSH request handshake, granting unauthorized access if the keyboard-interaction mode is utilized. An attacker could exploit this vulnerability by presenting manipulated SSH requests using keyboard-interactive authentication mode. This could potentially result in unauthorized access to the Soft Serve. Users should upgrade to the latest Soft Serve version `v0.6.2` to receive the patch for this issue. To workaround this vulnerability without upgrading, users can temporarily disable Keyboard-Interactive SSH Authentication using the `allow-keyless` setting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/charmbracelet/soft-serve/commit/407c4ec72d1006cee1ff8c1775e5bcc091c2bc89; https://github.com/charmbracelet/soft-serve/issues/389; https://github.com/charmbracelet/soft-serve/releases/tag/v0.6.2
CVE: CVE-2023-44389
Published: 2023-10-04
Description: Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
CVSS Score: 3.1 (LOW)
CWE: CWE-79
References: https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd[PII_REDACTED]ebbacae5141a; https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d; https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
CVE: CVE-2023-35803
Published: 2023-10-04
Description: IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2023-067-iq-engine-acsd-service-buffer-overflow-cve-2023/ba-p/96472; https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2023-067-iq-engine-acsd-service-buffer-overflow-cve-2023/ba-p/96472
CVE: CVE-2023-40299
Published: 2023-10-04
Description: Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using the DYLD_INSERT_LIBRARIES environment variable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-114
References: https://github.com/Kong/insomnia/pull/6217/commits; https://github.com/Kong/insomnia/releases; https://insomnia.rest/changelog
CVE: CVE-2023-43321
Published: 2023-10-04
Description: File Upload vulnerability in Digital China Networks DCFW-1800-SDC v.3.0 allows an authenticated attacker to execute arbitrary code via the wget function in the /sbin/cloudadmin.sh component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/Push3AX/vul/blob/main/DCN/DCFW_1800_SDC_CommandInjection.md; https://www.dcnetworks.com.cn/goods/61.html; https://github.com/Push3AX/vul/blob/main/DCN/DCFW_1800_SDC_CommandInjection.md
CVE: CVE-2023-43877
Published: 2023-10-04
Description: Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fields in the Administration menu.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CVE-2023-43878-RiteCMS-Stored-XSS---MainMenu/blob/main/README.md; https://github.com/sromanhu/RiteCMS-Stored-XSS---Home; https://github.com/sromanhu/CVE-2023-43878-RiteCMS-Stored-XSS---MainMenu/blob/main/README.md
CVE: CVE-2023-26236
Published: 2023-10-05
Description: An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchGuard EPDR processes, it is possible to perform a Local Privilege Escalation on Windows by sending a crafted message to a named pipe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00004; https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00004
CVE: CVE-2023-26237
Published: 2023-10-05
Description: An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a registry key as SYSTEM.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00005; https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00005
CVE: CVE-2023-26238
Published: 2023-10-05
Description: An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to enable or disable defensive capabilities by sending a crafted message to a named pipe.
CVSS Score: 5.5 (MEDIUM)
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00006; https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00006
CVE: CVE-2023-26239
Published: 2023-10-05
Description: An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentials to access the management console as a non-privileged user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-273
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00007; https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00007
CVE: CVE-2023-45198
Published: 2023-10-05
Description: ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable.
CVSS Score: 7.5 (HIGH)
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95; https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html; http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95
CVE: CVE-2023-45159
Published: 2023-10-05
Description: 1E Client installer can perform arbitrary file deletion on protected files.  

A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. 

A hotfix is available from the 1E support portal that forces the 1E Client to check for a symbolic link or junction and if it finds one refuses to use that path and instead creates a path involving a random GUID.

for v8.1 use hotfix Q23097
for v8.4 use hotfix Q23105
for v9.0 use hotfix Q23115

for SaaS customers, use 1EClient v23.7 plus hotfix Q23121
CVSS Score: 8.4 (HIGH)
CWE: CWE-59, CWE-59
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2001/; https://www.1e.com/trust-security-compliance/cve-info/
CVE: CVE-2022-4145
Published: 2023-10-05
Description: A content spoofing flaw was found in OpenShift's OAuth endpoint. This flaw allows a remote, unauthenticated attacker to inject text into a webpage, enabling the obfuscation of a phishing operation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://access.redhat.com/security/cve/CVE-2022-4145; https://bugzilla.redhat.com/show_bug.cgi?id=2148667; https://access.redhat.com/security/cve/CVE-2022-4145
CVE: CVE-2022-3248
Published: 2023-10-05
Description: A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://access.redhat.com/security/cve/CVE-2022-3248; https://bugzilla.redhat.com/show_bug.cgi?id=2072188; https://access.redhat.com/security/cve/CVE-2022-3248
CVE: CVE-2023-44390
Published: 2023-10-05
Description: HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either `svg` or `math` are in the list of allowed elements. In the case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. The vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mganss/HtmlSanitizer/commit/ab29319866c020f0cc11e6b92228cd8039196c6e; https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-43cp-6p3q-2pc4; https://github.com/mganss/HtmlSanitizer/commit/ab29319866c020f0cc11e6b92228cd8039196c6e
CVE: CVE-2023-44828
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the CurrentPassword parameter in the CheckPasswdSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/CheckPasswdSettings_CurrentPassword; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/CheckPasswdSettings_CurrentPassword
CVE: CVE-2023-44829
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the AdminPassword parameter in the SetDeviceSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetDeviceSettings_AdminPassword; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetDeviceSettings_AdminPassword
CVE: CVE-2023-44830
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the EndTime parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_EndTime; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_EndTime
CVE: CVE-2023-44831
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Type parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_Type; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_Type
CVE: CVE-2023-44832
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the MacAddress parameter in the SetWanSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWanSettings_MacAddress; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWanSettings_MacAddress
CVE: CVE-2023-44833
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the GuardInt parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_GuardInt; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_GuardInt
CVE: CVE-2023-44834
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the StartTime parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_%20StartTime; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_%20StartTime
CVE: CVE-2023-44835
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Mac parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_Mac; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_Mac
CVE: CVE-2023-44836
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_SSID; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_SSID
CVE: CVE-2023-44837
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Password parameter in the SetWanSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWanSettings_Password; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWanSettings_Password
CVE: CVE-2023-44838
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the TXPower parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_TXPower; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_TXPower
CVE: CVE-2023-44839
Published: 2023-10-05
Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Encryption parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSecurity_Encryption; https://www.dlink.com/en/security-bulletin/; https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSecurity_Encryption
CVE: CVE-2023-45160
Published: 2023-10-05
Description: In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replacing a resource script file created by an instruction at run time with a malicious script. The 1E Client's temporary directory is now locked down in the released patch.



Resolution: This has been fixed in patch Q23094 

This issue has also been fixed in the Mac Client in updated versions of Non-Windows release v8.1.2.62 - please re-download from the 1E Support site. 

Customers with Mac Client versions higher than v8.1 will need to upgrade to v23.11 to remediate this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-552, CWE-552
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2002/; https://1e.my.site.com/s/; https://www.1e.com/trust-security-compliance/cve-info/
CVE: CVE-2023-4570
Published: 2023-10-05
Description: An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost.  These services were previously thought to be unreachable outside of the node.  This affects measurement plug-ins written in Python using version 1.1.0 of the ni-measurementlink-service Python package and all previous versions.

CVSS Score: 8.8 (HIGH)
CWE: CWE-420
References: https://www.ni.com/en/support/documentation/supplemental/23/improper-restriction-in-ni-measurementlink-python-services.html; https://www.ni.com/en/support/documentation/supplemental/23/improper-restriction-in-ni-measurementlink-python-services.html
CVE: CVE-2023-2306
Published: 2023-10-05
Description: 




Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacker can retrieve information about the cameras, user information, and modify database records.





CVSS Score: 10.0 (CRITICAL)
CWE: CWE-798
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-02
CVE: CVE-2023-43068
Published: 2023-10-05
Description: 
Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the restricted shell in SSH. An authenticated remote attacker could potentially exploit this vulnerability, leading to execute arbitrary commands.


CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-43069
Published: 2023-10-05
Description: 
Dell SmartFabric Storage Software v1.4 (and earlier) contain(s) an OS Command Injection Vulnerability in the CLI. An authenticated local attacker could potentially exploit this vulnerability, leading to possible injection of parameters to curl or docker.


CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-43070
Published: 2023-10-05
Description: 
Dell SmartFabric Storage Software v1.4 (and earlier) contains a Path Traversal Vulnerability in the HTTP interface. A remote authenticated attacker could potentially exploit this vulnerability, leading to modify or write arbitrary files to arbitrary locations in the license container.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-43071
Published: 2023-10-05
Description: 
Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to various injection type attacks.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-1236
References: https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-43072
Published: 2023-10-05
Description: 
Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI. A local possibly unauthenticated attacker could potentially exploit this vulnerability, leading to ability to execute arbritrary shell commands.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-43073
Published: 2023-10-05
Description: 
Dell SmartFabric Storage Software v1.4 (and earlier) contains an Improper Input Validation vulnerability in RADIUS configuration. An authenticated remote attacker could potentially exploit this vulnerability, leading to gaining unauthorized access to data.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218107/dsa-2023-347-dell-smartfabric-storage-software-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-44386
Published: 2023-10-05
Description: Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-231, CWE-617, CWE-696
References: https://github.com/vapor/vapor/commit/090464a654b03148b139a81f8f5ac63b0856f6f3; https://github.com/vapor/vapor/releases/tag/4.84.2; https://github.com/vapor/vapor/security/advisories/GHSA-3mwq-h3g6-ffhm