deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39322
Published: 2023-09-08
Description: QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://go.dev/cl/523039; https://go.dev/issue/62266; https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
CVE: CVE-2023-4843
Published: 2023-09-08
Description: Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://support.pega.com/support-doc/pega-security-advisory-%E2%80%93-d23-vulnerability-remediation-note?; https://support.pega.com/support-doc/pega-security-advisory-%E2%80%93-d23-vulnerability-remediation-note?
CVE: CVE-2023-28010
Published: 2023-09-08
Description: In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.

CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107388; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107388
CVE: CVE-2023-39712
Published: 2023-09-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add New Put section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Arajawat007/836b586cfb8faeb4edbe57ff1c5dc457#file-cve-2023-39712; https://www.sourcecodester.com/; https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.html
CVE: CVE-2023-4782
Published: 2023-09-08
Description: Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://discuss.hashicorp.com/t/hcsec-2023-27-terraform-allows-arbitrary-file-write-during-init-operation/58082; https://discuss.hashicorp.com/t/hcsec-2023-27-terraform-allows-arbitrary-file-write-during-init-operation/58082
CVE: CVE-2023-38736
Published: 2023-09-08
Description: IBM QRadar WinCollect Agent 10.0 through 10.1.6, when installed to run as ADMIN or SYSTEM, is vulnerable to a local escalation of privilege attack that a normal user could utilize to gain SYSTEM permissions.  IBM X-Force ID:  262542.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/262542; https://www.ibm.com/support/pages/node/7030703; https://exchange.xforce.ibmcloud.com/vulnerabilities/262542
CVE: CVE-2023-41338
Published: 2023-09-08
Description: Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for `ctx.IsFromLocal`. Access is limited to the scope of the affected process. This issue has been patched in version `2.49.2` with commit `b8c9ede6`. Users are advised to upgrade. There are no known workarounds to remediate this vulnerability without upgrading to the patched version. 
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-670
References: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For; https://docs.gofiber.io/api/ctx#isfromlocal; https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc
CVE: CVE-2023-41575
Published: 2023-09-08
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in /bbdms/sign-up.php of Blood Bank & Donor Management v2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Full Name, Message, or Address parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/soundarkutty/Stored-xss/blob/main/poc; https://github.com/soundarkutty/Stored-xss/blob/main/poc
CVE: CVE-2023-41578
Published: 2023-09-08
Description: Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/Snakinya/Bugs/issues/1; https://github.com/Snakinya/Bugs/issues/1
CVE: CVE-2023-42268
Published: 2023-09-08
Description: Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jeecgboot/jeecg-boot/issues/5311; https://github.com/jeecgboot/jeecg-boot/issues/5311
CVE: CVE-2022-33164
Published: 2023-09-08
Description: IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view or write to arbitrary files on the system.  IBM X-Force ID:  228579.
CVSS Score: 8.7 (HIGH)
CWE: CWE-22, CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228579; https://www.ibm.com/support/pages/node/7031021; https://exchange.xforce.ibmcloud.com/vulnerabilities/228579
CVE: CVE-2023-32332
Published: 2023-09-08
Description: IBM Maximo Application Suite 8.9, 8.10 and IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.  IBM X-Force ID:  255072.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/255072; https://www.ibm.com/support/pages/node/7030367; https://www.ibm.com/support/pages/node/7030926
CVE: CVE-2023-41318
Published: 2023-09-08
Description: matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits `77ec235` and `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the `Content-Disposition` header returned by matrix-media-repo as a workaround.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script; https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137; https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59
CVE: CVE-2022-22405
Published: 2023-09-08
Description: IBM Aspera Faspex 5.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  IBM X-Force ID:  222576.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/222576; https://www.ibm.com/support/pages/node/7029681; https://exchange.xforce.ibmcloud.com/vulnerabilities/222576
CVE: CVE-2023-24965
Published: 2023-09-08
Description: IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.  IBM X-Force ID:  246713.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-668
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/246713; https://www.ibm.com/support/pages/node/7029681; https://exchange.xforce.ibmcloud.com/vulnerabilities/246713
CVE: CVE-2023-30995
Published: 2023-09-08
Description: IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request.  IBM X-Force ID:  254268.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254268; https://www.ibm.com/support/pages/node/7029681; https://www.ibm.com/support/pages/node/7048851
CVE: CVE-2022-22401
Published: 2023-09-08
Description: IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information.  IBM X-Force ID:  222567.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/222567; https://www.ibm.com/support/pages/node/7029681; https://exchange.xforce.ibmcloud.com/vulnerabilities/222567
CVE: CVE-2022-22402
Published: 2023-09-08
Description: IBM Aspera Faspex 5.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  222571.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/222571; https://www.ibm.com/support/pages/node/7029681; https://exchange.xforce.ibmcloud.com/vulnerabilities/222571
CVE: CVE-2022-22409
Published: 2023-09-08
Description: IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration.  IBM X-Force ID:  222592.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/222592; https://www.ibm.com/support/pages/node/7029681; https://exchange.xforce.ibmcloud.com/vulnerabilities/222592
CVE: CVE-2023-40306
Published: 2023-09-08
Description: SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3156972; https://https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE: CVE-2023-42276
Published: 2023-09-08
Description: hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/dromara/hutool/issues/3286; https://github.com/dromara/hutool/issues/3286
CVE: CVE-2023-42277
Published: 2023-09-08
Description: hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/dromara/hutool/issues/3285; https://github.com/dromara/hutool/issues/3285
CVE: CVE-2023-42278
Published: 2023-09-08
Description: hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/dromara/hutool/issues/3289; https://github.com/dromara/hutool/issues/3289
CVE: CVE-2023-4844
Published: 2023-09-08
Description: A vulnerability was found in SourceCodester Simple Membership System 1.0. It has been classified as critical. This affects an unknown part of the file club_edit_query.php. The manipulation of the argument club_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239253 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Meizhi-hua/cve/blob/main/Simple-Membership-System%20club_edit_query.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.239253; https://vuldb.com/?id.239253
CVE: CVE-2023-41564
Published: 2023-09-08
Description: An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-434
References: https://github.com/LongHair00/Mitre_opensource_report/blob/main/CockpitCMS-StoredXSS.md; https://github.com/LongHair00/Mitre_opensource_report/blob/main/CockpitCMS-StoredXSS.md
CVE: CVE-2023-4838
Published: 2023-09-09
Description: The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'before' and 'after'. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
References: https://plugins.trac.wordpress.org/changeset/2963794; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5f7f2a-c7b7-4339-a608-51fd684c18bf?source=cve; https://plugins.trac.wordpress.org/changeset/2963794
CVE: CVE-2023-4845
Published: 2023-09-09
Description: A vulnerability was found in SourceCodester Simple Membership System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file account_edit_query.php. The manipulation of the argument admin_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239254 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/BigBaos/MemShipVul/blob/main/Simple-Membership-System%20account_edit_query.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.239254; https://vuldb.com/?id.239254
CVE: CVE-2023-4846
Published: 2023-09-09
Description: A vulnerability was found in SourceCodester Simple Membership System 1.0. It has been rated as critical. This issue affects some unknown processing of the file delete_member.php. The manipulation of the argument mem_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239255.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Swpan2018/Vulhub/blob/main/Simple-Membership-System%20delete_member.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.239255; https://vuldb.com/?id.239255
CVE: CVE-2023-4847
Published: 2023-09-09
Description: A vulnerability classified as problematic has been found in SourceCodester Simple Book Catalog App 1.0. Affected is an unknown function of the component Update Book Form. The manipulation of the argument book_title/book_author leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239256.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://skypoc.wordpress.com/2023/09/04/sourcecodester-simple-book-catalog-app-v1-0-has-multiple-vulnerabilities/; https://vuldb.com/?ctiid.239256; https://vuldb.com/?id.239256
CVE: CVE-2023-4848
Published: 2023-09-09
Description: A vulnerability classified as critical was found in SourceCodester Simple Book Catalog App 1.0. Affected by this vulnerability is an unknown functionality of the file delete_book.php. The manipulation of the argument delete leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239257 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://skypoc.wordpress.com/2023/09/04/sourcecodester-simple-book-catalog-app-v1-0-has-multiple-vulnerabilities/; https://vuldb.com/?ctiid.239257; https://vuldb.com/?id.239257
CVE: CVE-2023-4849
Published: 2023-09-09
Description: A vulnerability, which was classified as critical, has been found in IBOS OA 4.5.5. Affected by this issue is some unknown functionality of the file ?r=file/dashboard/trash&op=del. The manipulation of the argument fids leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-239258 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/TinkAnet/cve/blob/main/sql.md; https://vuldb.com/?ctiid.239258; https://vuldb.com/?id.239258
CVE: CVE-2023-4850
Published: 2023-09-09
Description: A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=dashboard/position/del. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239259.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/RCEraser/cve/blob/main/sql_inject_2.md; https://vuldb.com/?ctiid.239259; https://vuldb.com/?id.239259
CVE: CVE-2023-4851
Published: 2023-09-09
Description: A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects unknown code of the file ?r=dashboard/position/edit&op=member. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239260.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/liuqiba12345678/cve/blob/main/sql.md; https://vuldb.com/?ctiid.239260; https://vuldb.com/?id.239260
CVE: CVE-2023-4852
Published: 2023-09-09
Description: A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/database/optimize. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239261 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/r1pte/cve/blob/main/sql.md; https://vuldb.com/?ctiid.239261; https://vuldb.com/?id.239261
CVE: CVE-2023-4874
Published: 2023-09-09
Description: Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-475, CWE-476
References: https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b[PII_REDACTED].patch; https://gitlab.com/muttmua/mutt/-/commit/a4752eb0ae0a521eec02e59e51ae5daedf74fda0.patch; http://www.openwall.com/lists/oss-security/2023/09/26/6
CVE: CVE-2023-4875
Published: 2023-09-09
Description: Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
CVSS Score: 2.2 (LOW)
CWE: CWE-475, CWE-476
References: https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b[PII_REDACTED].patch; https://gitlab.com/muttmua/mutt/-/commit/4cc3128abdf52c[PII_REDACTED]94a03271fddeefc6.patch; http://www.openwall.com/lists/oss-security/2023/09/26/6
CVE: CVE-2023-4864
Published: 2023-09-09
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Take-Note App 1.0. This affects an unknown part of the file index.php. The manipulation of the argument noteContent with the input <script>alert('xss')</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239349 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://skypoc.wordpress.com/2023/09/05/sourcecodester-take-note-app-v1-0-has-multiple-vulnerabilities/; https://vuldb.com/?ctiid.239349; https://vuldb.com/?id.239349
CVE: CVE-2023-41915
Published: 2023-09-09
Description: OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2024/07/10/3; http://www.openwall.com/lists/oss-security/2024/07/10/4; http://www.openwall.com/lists/oss-security/2024/07/10/6
CVE: CVE-2023-4865
Published: 2023-09-09
Description: A vulnerability has been found in SourceCodester Take-Note App 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239350 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://skypoc.wordpress.com/2023/09/05/sourcecodester-take-note-app-v1-0-has-multiple-vulnerabilities/; https://vuldb.com/?ctiid.239350; https://vuldb.com/?id.239350
CVE: CVE-2023-4866
Published: 2023-09-10
Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the function exec of the file booking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239351.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://blog.csdn.net/weixin_43864034/article/details/132697070; https://vuldb.com/?ctiid.239351; https://vuldb.com/?id.239351
CVE: CVE-2023-4867
Published: 2023-09-10
Description: A vulnerability was found in Xintian Smart Table Integrated Management System 5.6.9. It has been classified as critical. Affected is an unknown function of the file /SysManage/AddUpdateSites.aspx of the component Added Site Page. The manipulation of the argument TbxSiteName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239352.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/fortunate888/cve/blob/main/sql_inject_1.md; https://vuldb.com/?ctiid.239352; https://vuldb.com/?id.239352
CVE: CVE-2023-4868
Published: 2023-09-10
Description: A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file add.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239353 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://skypoc.wordpress.com/2023/09/05/vuln1/; https://vuldb.com/?ctiid.239353; https://vuldb.com/?id.239353
CVE: CVE-2023-4869
Published: 2023-09-10
Description: A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file update.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-239354 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://skypoc.wordpress.com/2023/09/05/vuln1/; https://vuldb.com/?ctiid.239354; https://vuldb.com/?id.239354
CVE: CVE-2023-4876
Published: 2023-09-10
Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://github.com/hamza417/inure/commit/7db[PII_REDACTED]c3cf477475f1f3b62a6e6ede4a8; https://huntr.dev/bounties/f729d2c8-a62e-4f30-ac24-e187b0a7892a; https://github.com/hamza417/inure/commit/7db[PII_REDACTED]c3cf477475f1f3b62a6e6ede4a8