deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-23620
Published: 2023-01-28
Description: Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse/commit/105fee978d73b0ec23ff814a09d1c0c9ace95164; https://github.com/discourse/discourse/pull/20004; https://github.com/discourse/discourse/security/advisories/GHSA-hvj9-g84x-5prx
CVE: CVE-2023-23621
Published: 2023-01-28
Description: Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS Score: 8.6 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://github.com/discourse/discourse/commit/6d92c3cbdac431db99a450f360a3048bb3aaf458; https://github.com/discourse/discourse/pull/20002; https://github.com/discourse/discourse/security/advisories/GHSA-mrfp-54hf-jrcv
CVE: CVE-2023-23624
Published: 2023-01-28
Description: Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, someone can use the `exclude_tag param` to filter out topics and deduce which ones were using a specific hidden tag. This affects any Discourse site using hidden tags in public categories. This issue is patched in version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches. As a workaround, secure any categories that are using hidden tags, change any existing hidden tags to not include private data, or remove any hidden tags currently in use.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse/commit/f55e0fe7910149c431861c18ce407d1be0d6091a; https://github.com/discourse/discourse/pull/20006; https://github.com/discourse/discourse/security/advisories/GHSA-qgj5-g5vf-fm7q
CVE: CVE-2023-23627
Published: 2023-01-28
Description: Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is configured with a custom allowlist that allows `noscript` elements, attackers are able to include arbitrary HTML, resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. The default configurations do not allow `noscript` elements and are not vulnerable. This issue only affects users who are using a custom config that adds `noscript` to the element allowlist. This issue has been patched in version 6.0.1. Users who are unable to upgrade can prevent this issue by using one of Sanitize's default configs or by ensuring that their custom config does not include `noscript` in the element allowlist.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rgrove/sanitize/security/advisories/GHSA-fw3g-2h3j-qmm7; https://github.com/rgrove/sanitize/security/advisories/GHSA-fw3g-2h3j-qmm7
CVE: CVE-2023-23628
Published: 2023-01-28
Description: Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.

CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv; https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv
CVE: CVE-2023-23629
Published: 2023-01-28
Description: Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard subscription, add people with fewer data privileges, and all recipients of that subscription receive the same data: the charts shown in the email would abide by the privileges of the user who created the subscription. The issue is users with fewer privileges who can view a dashboard are able to add themselves to a dashboard subscription created by someone with additional data privileges, and thus get access to more data via email. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. On Metabase instances running Enterprise Edition, admins can disable the "Subscriptions and Alerts" permission for groups that have restricted data permissions, as a workaround.

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-200, CWE-269
References: https://github.com/metabase/metabase/security/advisories/GHSA-ch8f-hhq9-7gv5; https://github.com/metabase/metabase/security/advisories/GHSA-ch8f-hhq9-7gv5
CVE: CVE-2023-0560
Published: 2023-01-28
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219701 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_practice_pdf_id.md; https://vuldb.com/?ctiid.219701; https://vuldb.com/?id.219701
CVE: CVE-2023-0561
Published: 2023-01-28
Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-219702 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/_user_s_id.md; https://vuldb.com/?ctiid.219702; https://vuldb.com/?id.219702
CVE: CVE-2021-4315
Published: 2023-01-28
Description: A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue. The name of the patch is 47787e15cecd66f2aa87687bf852ae0194a4335f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-219676.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1336, CWE-94
References: https://github.com/NYUCCL/psiTurk/commit/47787e15cecd66f2aa87687bf852ae0194a4335f; https://github.com/NYUCCL/psiTurk/pull/517; https://github.com/NYUCCL/psiTurk/releases/tag/v3.2.1
CVE: CVE-2023-0562
Published: 2023-01-28
Description: A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md; https://vuldb.com/?ctiid.219716; https://vuldb.com/?id.219716
CVE: CVE-2023-0563
Published: 2023-01-28
Description: A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219717 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/BLMS_XSS_IN_ADMIN_BROWSER.md; https://vuldb.com/?ctiid.219717; https://vuldb.com/?id.219717
CVE: CVE-2023-0564
Published: 2023-01-29
Description: Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-521
References: https://github.com/froxlor/froxlor/commit/2a84e9c1207fd3d792b7fb198fd0c66fe1a66a7a; https://huntr.dev/bounties/a4f86d6f-0d5d-428d-a4b3-551b20a21ce6; https://github.com/froxlor/froxlor/commit/2a84e9c1207fd3d792b7fb198fd0c66fe1a66a7a
CVE: CVE-2022-48285
Published: 2023-01-29
Description: loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22, CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244499; https://github.com/Stuk/jszip/commit/2edab366119c9ee948357c02f1206c28566cdf15; https://github.com/Stuk/jszip/compare/v3.7.1...v3.8.0
CVE: CVE-2023-0569
Published: 2023-01-29
Description: Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-521
References: https://github.com/publify/publify/commit/8905e4e639cf03b758da558568a86c9816253b2d; https://huntr.dev/bounties/81b1e1da-10dd-435e-94ae-4bdd41df6df9; https://github.com/publify/publify/commit/8905e4e639cf03b758da558568a86c9816253b2d
CVE: CVE-2023-0570
Published: 2023-01-29
Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file user\operations\payment_operation.php. The manipulation of the argument booking_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219729 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/user_operations_payment_operation_booking_id.md; https://vuldb.com/?ctiid.219729; https://vuldb.com/?id.219729
CVE: CVE-2023-0571
Published: 2023-01-29
Description: A vulnerability has been found in SourceCodester Canteen Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file createcustomer.php of the component Add Customer. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219730 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/ctflearner/Vulnerability/blob/main/Canteen%20Management%20System/Canteen_Management_System_XSS_IN_Add_Customer.md; https://vuldb.com/?ctiid.219730; https://vuldb.com/?id.219730
CVE: CVE-2009-10003
Published: 2023-01-29
Description: A vulnerability was found in capnsquarepants wordcraft up to 0.6. It has been classified as problematic. Affected is an unknown function of the file tag.php. The manipulation of the argument tag leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 0.7 is able to address this issue. The patch is identified as be23028633e8105de92f387036871c03f34d3124. It is recommended to upgrade the affected component. VDB-219714 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/capnsquarepants/wordcraft/commit/be23028633e8105de92f387036871c03f34d3124; https://github.com/capnsquarepants/wordcraft/releases/tag/wordcraft-0.7; https://vuldb.com/?ctiid.219714
CVE: CVE-2016-15022
Published: 2023-01-29
Description: A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.7.19 is able to address this issue. The patch is named 401478c[PII_REDACTED]beeddfeac5ce44570af162b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-219715.
CVSS Score: 2.0 (LOW)
CWE: CWE-79
References: https://github.com/mosbth/cimage/commit/401478c[PII_REDACTED]beeddfeac5ce44570af162b; https://github.com/mosbth/cimage/releases/tag/v0.7.19; https://vuldb.com/?ctiid.219715
CVE: CVE-2023-0565
Published: 2023-01-29
Description: Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-840
References: https://github.com/froxlor/froxlor/commit/2feb8020941a82bfb4ac68890f6ced0e5b3c4a15; https://huntr.dev/bounties/12d78294-1723-4450-a[PII_REDACTED]66102; https://github.com/froxlor/froxlor/commit/2feb8020941a82bfb4ac68890f6ced0e5b3c4a15
CVE: CVE-2023-0566
Published: 2023-01-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/froxlor/froxlor/commit/bd5b99dc1c06f594b9563d459a50bf3b32504876; https://huntr.dev/bounties/8339e4f1-d430-4845-81b5-36dd9fcdac49; https://github.com/froxlor/froxlor/commit/bd5b99dc1c06f594b9563d459a50bf3b32504876
CVE: CVE-2023-24065
Published: 2023-01-29
Description: NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for health charting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/abbisQQ/e0967d5b8355087c8e224bdd1ace3bf3; https://github.com/shihjay2/docker-nosh; https://github.com/shihjay2/nosh2/issues/202
CVE: CVE-2021-46873
Published: 2023-01-29
Description: WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://lists.zx2c4.com/pipermail/wireguard/2021-August/006916.html; https://lists.zx2c4.com/pipermail/wireguard/2021-August/006916.html
CVE: CVE-2023-0572
Published: 2023-01-29
Description: Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-391, CWE-754
References: https://github.com/froxlor/froxlor/commit/7b08a71c59430d06c1efb012a6c6448262aacdb1; https://huntr.dev/bounties/4ab24ee2-3ff6-4248-9555-0af3e5f754ec; https://github.com/froxlor/froxlor/commit/7b08a71c59430d06c1efb012a6c6448262aacdb1
CVE: CVE-2022-27596
Published: 2023-01-30
Description: A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code.
We have already fixed this vulnerability in the following versions of QuTS hero, QTS:
QuTS hero h5.0.1.2248 build 20221215 and later
QTS 5.0.1.2234 build 20221201 and later

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-23-01; https://www.qnap.com/en/security-advisory/qsa-23-01
CVE: CVE-2023-24612
Published: 2023-01-30
Description: The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://gitlab.com/organicdesign/PdfBook/-/merge_requests/6; https://gitlab.com/organicdesign/PdfBook/-/merge_requests/6
CVE: CVE-2022-48303
Published: 2023-01-30
Description: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/; https://savannah.gnu.org/bugs/?62387
CVE: CVE-2022-25936
Published: 2023-01-30
Description: Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22, CWE-22
References: https://gist.github.com/lirantal/691d02d607753d54856f9335f9a1692f; https://github.com/andrepolischuk/servst/commit/f7cae5d2d7c64c86bc512e1e[PII_REDACTED]6ef114; https://security.snyk.io/vuln/SNYK-JS-SERVST-3244896
CVE: CVE-2022-25967
Published: 2023-01-30
Description: Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API.**Note:** This is exploitable only for users who are rendering templates with user-defined data.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/compile-string.ts%23L21; https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/file-handlers.ts%23L182; https://github.com/eta-dev/eta/commit/[PII_REDACTED]ee0ff19d77c8481081a99e5b9138dd
CVE: CVE-2023-24622
Published: 2023-01-30
Description: isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/IncludeSecurity/safeurl-python/security/advisories/GHSA-jgh8-vchw-q3g7; https://github.com/IncludeSecurity/safeurl-python/security/advisories/GHSA-jgh8-vchw-q3g7
CVE: CVE-2023-24623
Published: 2023-01-30
Description: Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/hakobe/paranoidhttp/blob/master/CHANGELOG.md#v030-2023-01-19; https://github.com/hakobe/paranoidhttp/commit/07f671da14ce63a80f4e52432b32e8d178d75fd3; https://github.com/hakobe/paranoidhttp/compare/v0.2.0...v0.3.0
CVE: CVE-2023-22322
Published: 2023-01-30
Description: Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Motion Pro is installed may be disclosed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://jvn.jp/en/vu/JVNVU94200979/; https://jvn.jp/en/vu/JVNVU94200979/
CVE: CVE-2023-22324
Published: 2023-01-30
Description: SQL injection vulnerability in the CONPROSYS HMI System (CHS) Ver.3.5.0 and earlier allows a remote authenticated attacker to execute an arbitrary SQL command. As a result, information stored in the database may be obtained.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://jvn.jp/en/vu/JVNVU97195023/; https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230124_en.pdf; https://www.contec.com/download/contract/contract4/?itemid=ea8039aa-3434-4999-9ab6-897aa690210c&downloaditemid=866d7d3c-aae9-438d-87f3-17aa040df90b
CVE: CVE-2023-22332
Published: 2023-01-30
Description: Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series. A specific database user's authentication information may be obtained by another database user. As a result, the information stored in the database may be altered and/or database may be suspended by a remote attacker who successfully logged in the product with the obtained credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://jvn.jp/en/jp/JVN72418815/; https://www.pgpool.net/mediawiki/index.php/Main_Page#News; https://jvn.jp/en/jp/JVN72418815/
CVE: CVE-2023-22333
Published: 2023-01-30
Description: Cross-site scripting vulnerability in EasyMail 2.00.130 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN05288621/; https://www.mubag.com/download/; https://jvn.jp/en/jp/JVN05288621/
CVE: CVE-2022-46356
Published: 2023-01-30
Description: Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]378-16; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]378-16
CVE: CVE-2022-46357
Published: 2023-01-30
Description: Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]378-16; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]378-16
CVE: CVE-2022-46358
Published: 2023-01-30
Description: Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]378-16; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]378-16
CVE: CVE-2022-46359
Published: 2023-01-30
Description: Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]378-16; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]378-16
CVE: CVE-2023-0471
Published: 2023-01-30
Description: Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html; https://crbug.com/1376354; https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html