deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28379
Published: 2023-11-14
Description: A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-119, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1738; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1738; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1738
CVE: CVE-2023-28391
Published: 2023-11-14
Description: A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-119, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1732; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1732; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1732
CVE: CVE-2023-31247
Published: 2023-11-14
Description: A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-119, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1746; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1746; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1746
CVE: CVE-2023-43503
Published: 2023-11-14
Description: A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and project information in cleartext via UDP.
CVSS Score: 3.5 (LOW)
CWE: CWE-319, CWE-319
References: https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf
CVE: CVE-2023-43504
Published: 2023-11-14
Description: A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affected application is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf
CVE: CVE-2023-43505
Published: 2023-11-14
Description: A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in SMB shares. This could allow an attacker to access files that the user should not have access to.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf
CVE: CVE-2023-44318
Published: 2023-11-14
Description: Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that obtains a configuration backup to extract configuration information from the exported file.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-321
References: https://cert-portal.siemens.com/productcert/html/ssa-180704.html; https://cert-portal.siemens.com/productcert/html/ssa-353002.html; https://cert-portal.siemens.com/productcert/html/ssa-690517.html
CVE: CVE-2023-44321
Published: 2023-11-14
Description: Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing an authenticated attacker to cause a denial of service condition. The device needs to be restarted for the web interface to become available again.
CVSS Score: 2.7 (LOW)
CWE: CWE-400
References: https://cert-portal.siemens.com/productcert/html/ssa-087301.html; https://cert-portal.siemens.com/productcert/html/ssa-180704.html; https://cert-portal.siemens.com/productcert/html/ssa-353002.html
CVE: CVE-2023-44373
Published: 2023-11-14
Description: Affected devices do not properly sanitize an input field.  This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-74
References: https://cert-portal.siemens.com/productcert/html/ssa-019200.html; https://cert-portal.siemens.com/productcert/html/ssa-180704.html; https://cert-portal.siemens.com/productcert/html/ssa-602936.html
CVE: CVE-2023-44374
Published: 2023-11-14
Description: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.0), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V8.0), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.0), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.0), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.0), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.0), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.0), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.0), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.0), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.0), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.0), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.0), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.0), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.0), SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V3.0.0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) (All versions < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V3.0.0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) (All versions < V3.0.0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) (All versions < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V3.0.0). Affected devices allow to change the password, but insufficiently check which password is to be changed. With this an authenticated attacker could, under certain conditions, be able to change the password of another, potential admin user, which could allow to escalate privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-567
References: https://cert-portal.siemens.com/productcert/html/ssa-180704.html; https://cert-portal.siemens.com/productcert/html/ssa-690517.html; https://cert-portal.siemens.com/productcert/html/ssa-699386.html
CVE: CVE-2023-45794
Published: 2023-11-14
Description: A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9 (All versions < V9.24.10). A capture-replay flaw in the platform could have an impact to apps built with the platform, if certain preconditions are met that depend on the app's model and access control design.

This could allow authenticated attackers to access or modify objects without proper authorization, or escalate privileges in the context of the vulnerable app.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-294
References: https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf
CVE: CVE-2023-46096
Published: 2023-11-14
Description: A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf
CVE: CVE-2023-46097
Published: 2023-11-14
Description: A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). The PUD Manager of affected products does not properly neutralize user provided inputs. This could allow an authenticated adjacent attacker to execute SQL statements in the underlying database.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf
CVE: CVE-2023-46098
Published: 2023-11-14
Description: A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.
CVSS Score: 8.0 (HIGH)
CWE: CWE-942
References: https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf
CVE: CVE-2023-46099
Published: 2023-11-14
Description: A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). There is a stored cross-site scripting vulnerability in the Administration Console of the affected product, that could allow an attacker with high privileges to inject Javascript code into the application that is later executed by another legitimate user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf
CVE: CVE-2023-46590
Published: 2023-11-14
Description: A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE) injection vulnerability. This vulnerability could allow an attacker to interfere with an application's processing of XML data and read arbitrary files in the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://cert-portal.siemens.com/productcert/pdf/ssa-197270.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-197270.pdf
CVE: CVE-2023-46601
Published: 2023-11-14
Description: A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf
CVE: CVE-2023-6111
Published: 2023-11-14
Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the argument sync is true, making it possible to free a catchall set element many times.

We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93995bf4af2c5a99e2a87f0cd5ce547d31eb7630; https://kernel.dance/93995bf4af2c5a99e2a87f0cd5ce547d31eb7630; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OXWBKK7RTQOGGDLQGCZFS753VLGS2GD/
CVE: CVE-2023-45684
Published: 2023-11-14
Description: Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://cfengine.com/blog/2023/cve-2023-45684/; https://cfengine.com/blog/2023/cve-2023-45684/
CVE: CVE-2023-48020
Published: 2023-11-14
Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/moonsabc123/dreamer_cms/blob/main/Enable%20CSRF%20for%20Task%20Management%20Office.md; https://github.com/moonsabc123/dreamer_cms/blob/main/Enable%20CSRF%20for%20Task%20Management%20Office.md
CVE: CVE-2023-48021
Published: 2023-11-14
Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20CSRF%20in%20the%20task%20management%20editing%20task%20area.md; https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20CSRF%20in%20the%20task%20management%20editing%20task%20area.md
CVE: CVE-2023-6124
Published: 2023-11-14
Description: Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9; https://huntr.com/bounties/aed4d8f3-ab9a-42fd-afea-b3ec288a148e; https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE: CVE-2023-47262
Published: 2023-11-14
Description: The startup process and device configurations of the Abbott ID NOW device, before v7.1, can be interrupted and/or modified via physical access to an internal serial port. Direct physical access is required to exploit.
CVSS Score: 5.2 (MEDIUM)
References: https://www.cybersecurity.abbott/home/product-advisories.html; https://www.cybersecurity.abbott/home/product-advisories/id-now.html; https://www.cybersecurity.abbott/home/product-advisories.html
CVE: CVE-2023-6125
Published: 2023-11-14
Description:  Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9; https://huntr.com/bounties/a9462f1e-9746-4380-8228-533ff2f64691; https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE: CVE-2023-6126
Published: 2023-11-14
Description:  Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9; https://huntr.com/bounties/e22a9be3-3273-42cb-bfcc-c67a1025684e; https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE: CVE-2023-6127
Published: 2023-11-14
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9; https://huntr.com/bounties/bf10c72b-5d2e-4c9a-9bd6-d77bdf31027d; https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE: CVE-2023-6128
Published: 2023-11-14
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9; https://huntr.com/bounties/5[PII_REDACTED]-45f2-a416-7f14fd775d2d; https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE: CVE-2023-47659
Published: 2023-11-14
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/lava-directory-manager/wordpress-lava-directory-manager-plugin-1-1-34-contributor-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/lava-directory-manager/wordpress-lava-directory-manager-plugin-1-1-34-contributor-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47660
Published: 2023-11-14
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Wham Product Visibility by Country for WooCommerce plugin <= 1.4.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/product-visibility-by-country-for-woocommerce/wordpress-product-visibility-by-country-for-woocommerce-plugin-1-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/product-visibility-by-country-for-woocommerce/wordpress-product-visibility-by-country-for-woocommerce-plugin-1-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48094
Published: 2023-11-14
Description: A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to /container_files/public_html/doc/index.html. NOTE: the vendor’s position is that Apps/Sandcastle/standalone.html is part of the CesiumGS/cesium GitHub repository, but is demo code that is not part of the CesiumJS JavaScript library product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/cd80/33ab71cc49c42feb55de3e574753320f; https://gist.github.com/cd80/33ab71cc49c42feb55de3e574753320f
CVE: CVE-2023-6130
Published: 2023-11-14
Description: Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-29
References: https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9; https://huntr.com/bounties/22a27be9-f016-4daf-9887-c77eb3e1dc74; https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE: CVE-2023-6131
Published: 2023-11-14
Description:  Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9; https://huntr.com/bounties/5fa50b25-f6b1-408c-99df-4442c86c563f; https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE: CVE-2023-26205
Published: 2023-11-14
Description: An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://fortiguard.com/psirt/FG-IR-22-292; https://fortiguard.com/psirt/FG-IR-22-292
CVE: CVE-2023-28002
Published: 2023-11-14
Description: An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesystem integrity check in place.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-354
References: https://fortiguard.com/psirt/FG-IR-22-396; https://fortiguard.com/psirt/FG-IR-22-396
CVE: CVE-2023-33304
Published: 2023-11-14
Description: A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections via the use of static credentials.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-798
References: https://fortiguard.com/psirt/FG-IR-23-108; https://fortiguard.com/psirt/FG-IR-23-108
CVE: CVE-2023-34991
Published: 2023-11-14
Description: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.0 through 8.4.2 and 8.3.0 through 8.3.2 and 8.2.2 allows attacker to execute unauthorized code or commands via a crafted http request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fortiguard.com/psirt/FG-IR-23-142; https://fortiguard.com/psirt/FG-IR-23-142
CVE: CVE-2023-36016
Published: 2023-11-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36016; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36016
CVE: CVE-2023-36017
Published: 2023-11-14
Description: Windows Scripting Engine Memory Corruption Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36017; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36017
CVE: CVE-2023-36018
Published: 2023-11-14
Description: Visual Studio Code Jupyter Extension Spoofing Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-359
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36018; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36018
CVE: CVE-2023-36021
Published: 2023-11-14
Description: Microsoft On-Prem Data Gateway Security Feature Bypass Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36021; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36021
CVE: CVE-2023-36025
Published: 2023-11-14
Description: Windows SmartScreen Security Feature Bypass Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36025
CVE: CVE-2023-36028
Published: 2023-11-14
Description: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36028; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36028
CVE: CVE-2023-36030
Published: 2023-11-14
Description: Microsoft Dynamics 365 Sales Spoofing Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36030; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36030
CVE: CVE-2023-36031
Published: 2023-11-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36031; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36031