deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-48347
Published: 2024-01-18
Description: In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48348
Published: 2024-01-18
Description: In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48349
Published: 2024-01-18
Description: In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48350
Published: 2024-01-18
Description: In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48351
Published: 2024-01-18
Description: In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48352
Published: 2024-01-18
Description: In phasecheckserver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48353
Published: 2024-01-18
Description: In vsp driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48354
Published: 2024-01-18
Description: In telephone service, there is a possible improper input validation. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48355
Published: 2024-01-18
Description: In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48356
Published: 2024-01-18
Description: In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48357
Published: 2024-01-18
Description: In vsp driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48358
Published: 2024-01-18
Description: In drm driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2023-48359
Published: 2024-01-18
Description: In autotest driver, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]42220545
CVE: CVE-2024-0655
Published: 2024-01-18
Description: A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /novel/bookSetting/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251383.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/red0-ZhaoSi/CVE/blob/main/novel-plus/sql/sql_1.md; https://vuldb.com/?ctiid.251383; https://vuldb.com/?id.251383
CVE: CVE-2023-6816
Published: 2024-01-18
Description: A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://access.redhat.com/errata/RHSA-2024:0320; https://access.redhat.com/errata/RHSA-2024:0557; https://access.redhat.com/errata/RHSA-2024:0558
CVE: CVE-2023-6958
Published: 2024-01-18
Description: The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/includes/public/shortcodes/general/class-wprm-sc-text.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/ec201702-8c8c-4049-b647-422d18001b7f?source=cve; https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/includes/public/shortcodes/general/class-wprm-sc-text.php
CVE: CVE-2023-6970
Published: 2024-01-18
Description: The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/templates/public/print.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/20842e95-4b91-4138-9e32-7c090724bf64?source=cve; https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/templates/public/print.php
CVE: CVE-2024-0381
Published: 2024-01-18
Description: The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/includes/public/shortcodes/recipe/class-wprm-sc-counter.php; https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/includes/public/shortcodes/recipe/class-wprm-sc-date.php; https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/includes/public/shortcodes/recipe/class-wprm-sc-name.php
CVE: CVE-2024-0580
Published: 2024-01-18
Description: Omission of user-controlled key authorization in the IDMSistemas platform, affecting the QSige product. This vulnerability allows an attacker to extract sensitive information from the API by making a request to the parameter '/qsige.locator/quotePrevious/centers/X', where X supports values 1,2,3, etc.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/omission-key-controlled-authorization-qsige; https://www.incibe.es/en/incibe-cert/notices/aviso/omission-key-controlled-authorization-qsige
CVE: CVE-2023-51463
Published: 2024-01-18
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-51464
Published: 2024-01-18
Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CVE: CVE-2023-5806
Published: 2024-01-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Injection.This issue affects Quality Management System: before v1.2.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-0040; https://www.usom.gov.tr/bildirim/tr-24-0040
CVE: CVE-2024-0669
Published: 2024-01-18
Description: A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1021
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-plone-cms; https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-plone-cms
CVE: CVE-2024-22317
Published: 2024-01-18
Description: IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to obtain sensitive information or cause a denial of service due to improper restriction of excessive authentication attempts.  IBM X-Force ID:  279143.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/279143; https://www.ibm.com/support/pages/node/7108661; https://exchange.xforce.ibmcloud.com/vulnerabilities/279143
CVE: CVE-2021-33630
Published: 2024-01-18
Description: NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is associated with program files net/sched/sch_cbs.C.

This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://www.openwall.com/lists/oss-security/2024/01/30/10; http://www.openwall.com/lists/oss-security/2024/01/30/3; http://www.openwall.com/lists/oss-security/2024/01/30/4
CVE: CVE-2021-33631
Published: 2024-01-18
Description: Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from 5.10.0-60.18.0 before 5.10.0-183.0.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: http://www.openwall.com/lists/oss-security/2024/01/30/10; http://www.openwall.com/lists/oss-security/2024/01/30/3; http://www.openwall.com/lists/oss-security/2024/01/30/4
CVE: CVE-2023-40051
Published: 2024-01-18
Description: This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE.  If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.




CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://community.progress.com/s/article/Important-Progress-OpenEdge-Critical-Alert-for-Progress-Application-Server-in-OpenEdge-PASOE-Arbitrary-File-Upload-Vulnerability-in-WEB-Transport; https://www.progress.com/openedge; https://community.progress.com/s/article/Important-Progress-OpenEdge-Critical-Alert-for-Progress-Application-Server-in-OpenEdge-PASOE-Arbitrary-File-Upload-Vulnerability-in-WEB-Transport
CVE: CVE-2023-40052
Published: 2024-01-18
Description: 


This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0

. 

An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activities of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compared to the server’s remaining ability to process valid requests.






CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://community.progress.com/s/article/Important-Progress-OpenEdge-Product-Alert-for-Progress-Application-Server-for-OpenEdge-PASOE-Denial-of-Service-Vulnerability-in-WEB-Transport; https://www.progress.com/openedge; https://community.progress.com/s/article/Important-Progress-OpenEdge-Product-Alert-for-Progress-Application-Server-for-OpenEdge-PASOE-Denial-of-Service-Vulnerability-in-WEB-Transport
CVE: CVE-2023-7153
Published: 2024-01-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Macroturk Software and Internet Technologies Macro-Bel allows Reflected XSS.This issue affects Macro-Bel: before V.1.0.1.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-0041; https://www.usom.gov.tr/bildirim/tr-24-0041
CVE: CVE-2024-22548
Published: 2024-01-18
Description: FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the system website settings website name section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/5List/cms/blob/main/1.md; https://github.com/5List/cms/blob/main/1.md
CVE: CVE-2024-22549
Published: 2024-01-18
Description: FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/cccbbbttt/cms/blob/main/1.md; https://github.com/cccbbbttt/cms/blob/main/1.md
CVE: CVE-2024-22568
Published: 2024-01-18
Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/del.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/kayo-zjq/myc/blob/main/1.md; https://github.com/kayo-zjq/myc/blob/main/1.md
CVE: CVE-2024-22591
Published: 2024-01-18
Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_save.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/ysuzhangbin/cms2/blob/main/1.md; https://github.com/ysuzhangbin/cms2/blob/main/1.md
CVE: CVE-2024-22592
Published: 2024-01-18
Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_update
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/ysuzhangbin/cms2/blob/main/2.md; https://github.com/ysuzhangbin/cms2/blob/main/2.md
CVE: CVE-2024-22593
Published: 2024-01-18
Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/add_group_save
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/ysuzhangbin/cms2/blob/main/3.md; https://github.com/ysuzhangbin/cms2/blob/main/3.md
CVE: CVE-2024-0408
Published: 2024-01-18
Description: A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-158
References: https://access.redhat.com/errata/RHSA-2024:0320; https://access.redhat.com/errata/RHSA-2024:2169; https://access.redhat.com/errata/RHSA-2024:2170
CVE: CVE-2024-0409
Published: 2024-01-18
Description: A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://access.redhat.com/errata/RHSA-2024:0320; https://access.redhat.com/errata/RHSA-2024:2169; https://access.redhat.com/errata/RHSA-2024:2170
CVE: CVE-2024-0607
Published: 2024-01-18
Description: A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-229
References: https://access.redhat.com/security/cve/CVE-2024-0607; https://bugzilla.redhat.com/show_bug.cgi?id=2258635; https://github.com/torvalds/linux/commit/c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63
CVE: CVE-2024-22699
Published: 2024-01-18
Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/biantaibao/cms/blob/main/1.md; https://github.com/biantaibao/cms/blob/main/1.md
CVE: CVE-2023-28900
Published: 2024-01-18
Description: The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://asrg.io/security-advisories/cve-2023-28900; https://asrg.io/security-advisories/cve-2023-28900
CVE: CVE-2023-28901
Published: 2024-01-18
Description: The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://asrg.io/security-advisories/cve-2023-28901/; https://asrg.io/security-advisories/cve-2023-28901/
CVE: CVE-2024-22601
Published: 2024-01-18
Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/scorerule_save
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/ljw11e/cms/blob/main/5.md; https://github.com/ljw11e/cms/blob/main/5.md
CVE: CVE-2024-22603
Published: 2024-01-18
Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add_link
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/ljw11e/cms/blob/main/4.md; https://github.com/ljw11e/cms/blob/main/4.md
CVE: CVE-2024-22817
Published: 2024-01-18
Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/mafangqian/cms/blob/main/1.md; https://github.com/mafangqian/cms/blob/main/1.md
CVE: CVE-2024-22818
Published: 2024-01-18
Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword_save
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/mafangqian/cms/blob/main/3.md; https://github.com/mafangqian/cms/blob/main/3.md
CVE: CVE-2024-22819
Published: 2024-01-18
Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/mafangqian/cms/blob/main/2.md; https://github.com/mafangqian/cms/blob/main/2.md
CVE: CVE-2023-31274
Published: 2024-01-18
Description: 
AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of a PI Server to consume available memory resulting in throttled processing of new PI Data Archive events and a partial denial-of-service condition.





CVSS Score: 5.3 (MEDIUM)
CWE: CWE-772, CWE-772
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01
CVE: CVE-2023-34348
Published: 2024-01-18
Description: 
AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to remotely crash the PI Message Subsystem of a PI Server, resulting in a denial-of-service condition.





CVSS Score: 7.5 (HIGH)
CWE: CWE-703, CWE-755, CWE-754
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01
CVE: CVE-2024-0694
Published: 2024-01-18
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-6620. Reason: This candidate is a reservation duplicate of CVE-2023-6620. Notes: All CVE users should reference CVE-2023-6620 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.