deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-32076
Published: 2023-05-10
Description: in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-15, CWE-610
References: https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x; https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd; https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf
CVE: CVE-2022-36937
Published: 2023-05-10
Description: HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3.

Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: https://github.com/facebook/hhvm/commit/083f5ffdee661f61512909d16f9a5b98cff3cf0b; https://hhvm.com/blog/2023/01/20/security-update.html; https://github.com/facebook/hhvm/commit/083f5ffdee661f61512909d16f9a5b98cff3cf0b
CVE: CVE-2021-45345
Published: 2023-05-10
Description: Buffer Overflow vulnerability found in En3rgy WebcamServer v.0.5.2 allows a remote attacker to cause a denial of service via the WebcamServer.exe file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://gist.github.com/0xHop/0d065694d56ac3943d8e8c239d80c63f; https://gist.github.com/0xHop/337e65ec684b8866e86f4b25b8f1dbc7; https://sourceforge.net/projects/webcamserv/
CVE: CVE-2022-36329
Published: 2023-05-10
Description: An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-400
References: https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191; https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191
CVE: CVE-2023-2310
Published: 2023-05-10
Description: A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) could allow a remote attacker to perform a man-in-the-middle (MiTM) that could result in denial of service.

See the ACSELERATOR RTAC SEL-5033 Software instruction manual date code 20210915 for more details.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-300
References: https://selinc.com/support/security-notifications/external-reports/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-30194
Published: 2023-05-10
Description: Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://friends-of-presta.github.io/security-advisories/modules/2023/05/09/posstaticfooter.html; https://themeforest.net/user/posthemes/portfolio; https://friends-of-presta.github.io/security-advisories/modules/2023/05/09/posstaticfooter.html
CVE: CVE-2023-31148
Published: 2023-05-10
Description: An Improper Input Validation vulnerability 

in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to execute arbitrary code.
See SEL Service Bulletin dated 2022-11-15 for more details.



CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31149
Published: 2023-05-10
Description: 
An Improper Input Validation vulnerability 

in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to execute arbitrary code.
See SEL Service Bulletin dated 2022-11-15 for more details.





CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31150
Published: 2023-05-10
Description: 
A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database system could allow an authenticated attacker to retrieve passwords.
See SEL Service Bulletin dated 2022-11-15 for more details.



CVSS Score: 8.0 (HIGH)
CWE: CWE-257, CWE-922
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31151
Published: 2023-05-10
Description: An Improper Certificate Validation vulnerability 

in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface

could allow a remote unauthenticated attacker to conduct a man-in-the-middle (MitM) attack.
See SEL Service Bulletin dated 2022-11-15 for more details.





CVSS Score: 4.7 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31152
Published: 2023-05-10
Description: An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication Bypass. 
See SEL Service Bulletin dated 2022-11-15 for more details.




CVSS Score: 4.0 (MEDIUM)
CWE: CWE-288, CWE-287
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31153
Published: 2023-05-10
Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.See SEL Service Bulletin dated 2022-11-15 for more details.




CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31154
Published: 2023-05-10
Description: 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31155
Published: 2023-05-10
Description: 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31156
Published: 2023-05-10
Description: 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31157
Published: 2023-05-10
Description: 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31158
Published: 2023-05-10
Description: 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31159
Published: 2023-05-10
Description: 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31160
Published: 2023-05-10
Description: 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31161
Published: 2023-05-10
Description: An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow an authenticated remote attacker to use internal resources, allowing a variety of potential effects.

See SEL Service Bulletin dated 2022-11-15 for more details.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31162
Published: 2023-05-10
Description: An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to arbitrarily alter the content of a configuration file.

See SEL Service Bulletin dated 2022-11-15 for more details.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31163
Published: 2023-05-10
Description: 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.


See SEL Service Bulletin dated 2022-11-15 for more details.






CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31164
Published: 2023-05-10
Description: 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.


See SEL Service Bulletin dated 2022-11-15 for more details.






CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31165
Published: 2023-05-10
Description: 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.


See SEL Service Bulletin dated 2022-11-15 for more details.






CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2023-31166
Published: 2023-05-10
Description: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to create folders in arbitrary paths of the file system.

See SEL Service Bulletin dated 2022-11-15 for more details.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://selinc.com/support/security-notifications/external-reports/; https://www.nozominetworks.com/blog/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2022-29842
Published: 2023-05-10
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis issue affects My Cloud OS 5: before 5.26.119.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119; https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119
CVE: CVE-2023-32080
Published: 2023-05-10
Description: Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11.6 impacts anyone running the affected versions of Wings.  This vulnerability can be used to gain access to the host system running Wings if a user is able to modify an server's install script or the install script executes code supplied by the user (either through environment variables, or commands that execute commands based off of user data). This vulnerability has been resolved in version `v1.11.6` of Wings, and has been back-ported to the 1.7 release series in `v1.7.5`. Anyone running `v1.11.x` should upgrade to `v1.11.6` and anyone running `v1.7.x` should upgrade to `v1.7.5`.

There are no workarounds aside from upgrading. Running Wings with a rootless container runtime may mitigate the severity of any attacks, however the majority of users are using container runtimes that run as root as per the Wings documentation. SELinux may prevent attackers from performing certain operations against the host system, however privileged containers have a lot of freedom even on systems with SELinux enabled.

It should be noted that this was a known attack vector, for attackers to easily exploit this attack it would require compromising an administrator account on a Panel.  However, certain eggs (the data structure that holds the install scripts that get passed to Wings) have an issue where they are unknowingly executing shell commands with escalated privileges provided by untrusted user data.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-250
References: https://github.com/pterodactyl/wings/releases/tag/v1.11.6; https://github.com/pterodactyl/wings/releases/tag/v1.17.5; https://github.com/pterodactyl/wings/security/advisories/GHSA-p744-4q6p-hvc2
CVE: CVE-2022-29841
Published: 2023-05-10
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a privileged location and created a system command without sanitizing the read data. This command could be triggered by an attacker remotely to cause code execution and gain a reverse shell in Western Digital My Cloud OS 5 devices.This issue affects My Cloud OS 5: before 5.26.119.


CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119; https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119
CVE: CVE-2022-29840
Published: 2023-05-10
Description: Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vulnerabilities on the local server.This issue affects My Cloud OS 5 devices before 5.26.202.



CVSS Score: 5.1 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202; https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202
CVE: CVE-2023-29986
Published: 2023-05-11
Description: spring-boot-actuator-logview 0.2.13 allows Directory Traversal to sibling directories via LogViewEndpoint.view.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/lukashinsch/spring-boot-actuator-logview/issues/33; https://github.com/lukashinsch/spring-boot-actuator-logview/issues/33
CVE: CVE-2023-30172
Published: 2023-05-11
Description: A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/mlflow/mlflow/issues/7166; https://github.com/mlflow/mlflow/issues/7166#issuecomment[PII_REDACTED]; https://github.com/mlflow/mlflow/issues/7166
CVE: CVE-2023-31442
Published: 2023-05-11
Description: In Lightbend Akka before 2.8.1, the async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not validate (e.g., via TLS) the authenticity of the discovered service, this may result in exfiltration of application data (e.g., persistence events may be published to an unintended Kafka broker). If such validation is performed, then the poisoning constitutes a denial of access to the intended service. This affects Akka 2.5.14 through 2.8.0, and Akka Discovery through 2.8.0.
CVSS Score: 7.5 (HIGH)
References: https://akka.io/security/akka-async-dns-2023-31442.html; https://lightbend.com; https://akka.io/security/akka-async-dns-2023-31442.html
CVE: CVE-2023-31477
Published: 2023-05-11
Description: A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/gl-inet/CVE-issues/blob/main/3.215/Path_Traversal.md; https://www.gl-inet.com; https://github.com/gl-inet/CVE-issues/blob/main/3.215/Path_Traversal.md
CVE: CVE-2023-2641
Published: 2023-05-11
Description: A vulnerability was found in SourceCodester Online Internship Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin/login.php of the component POST Parameter Handler. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228770 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/csbsong/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.228770; https://vuldb.com/?id.228770
CVE: CVE-2023-2642
Published: 2023-05-11
Description: A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. This affects an unknown part of the file adminpanel/admin/facebox_modal/updateCourse.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228771.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/sushanburanxisha/cve/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.228771; https://vuldb.com/?id.228771
CVE: CVE-2023-32668
Published: 2023-05-11
Description: LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
CVSS Score: 5.5 (MEDIUM)
References: https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3; https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0; https://tug.org/pipermail/tex-live/2023-May/049188.html