deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38423
Published: 2023-08-02
Description: 
A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://my.f5.com/manage/s/article/K000134535; https://my.f5.com/manage/s/article/K000134535
CVE: CVE-2023-3470
Published: 2023-08-02
Description: 
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account.  The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password.  On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Guest to access keys of a different Guest.

The following BIG-IP hardware platforms are affected: 10350v-F, i5820-DF, i7820-DF, i15820-DF, 5250v-F, 7200v-F, 10200v-F, 6900-F, 8900-F, 11000-F, and 11050-F.

The BIG-IP rSeries r5920-DF and r10920-DF are not affected, nor does the issue affect software FIPS implementations or network HSM configurations.



Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.



CVSS Score: 6.0 (MEDIUM)
CWE: CWE-1391, CWE-287
References: https://my.f5.com/manage/s/article/K000135449; https://my.f5.com/manage/s/article/K000135449
CVE: CVE-2023-29407
Published: 2023-08-02
Description: A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: https://go.dev/cl/514897; https://go.dev/issue/61581; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/
CVE: CVE-2023-29408
Published: 2023-08-02
Description: The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://go.dev/cl/514897; https://go.dev/issue/61582; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/
CVE: CVE-2023-29409
Published: 2023-08-02
Description: Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://go.dev/cl/515257; https://go.dev/issue/61460; https://groups.google.com/g/golang-announce/c/X0b6CsSAaYI/m/Efv5DbZ9AwAJ
CVE: CVE-2023-36081
Published: 2023-08-02
Description: Cross Site Scripting vulnerability in GatesAIr Flexiva FM Transmitter/Exciter v.FAX 150W allows a remote attacker to execute arbitrary code via a crafted script to the web application dashboard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://flexiva.com; http://gatesair.com; https://strik3r.gitbook.io/strik3r-blog/security-research/cves-pocs/cve-2023-36081
CVE: CVE-2023-3978
Published: 2023-08-02
Description: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://go.dev/cl/514896; https://go.dev/issue/61615; https://pkg.go.dev/vuln/GO-2023-1988
CVE: CVE-2023-1437
Published: 2023-08-02
Description: All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-822, CWE-119
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-02
CVE: CVE-2023-1935
Published: 2023-08-02
Description: ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-206-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-206-03
CVE: CVE-2023-39113
Published: 2023-08-02
Description: ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c. This vulnerability is triggered when running the program gif2tga.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/miniupnp/ngiflib/issues/27; https://github.com/miniupnp/ngiflib/issues/27
CVE: CVE-2023-39114
Published: 2023-08-02
Description: ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerability is triggered when running the program SDLaffgif.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/miniupnp/ngiflib/issues/29; https://github.com/miniupnp/ngiflib/issues/29
CVE: CVE-2023-3329
Published: 2023-08-02
Description: SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-03
CVE: CVE-2023-33368
Published: 2023-08-03
Description: Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33368; https://www.controlid.com.br/en/access-control/idsecure/; https://claroty.com/team82/disclosure-dashboard/cve-2023-33368
CVE: CVE-2023-33369
Published: 2023-08-03
Description: A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33369; https://www.controlid.com.br/en/access-control/idsecure/; https://claroty.com/team82/disclosure-dashboard/cve-2023-33369
CVE: CVE-2023-33370
Published: 2023-08-03
Description: An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33370; https://www.controlid.com.br/en/access-control/idsecure/; https://claroty.com/team82/disclosure-dashboard/cve-2023-33370
CVE: CVE-2023-33371
Published: 2023-08-03
Description: Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-33371; https://www.controlid.com.br/en/access-control/idsecure/; https://claroty.com/team82/disclosure-dashboard/cve-2023-33371
CVE: CVE-2023-36082
Published: 2023-08-03
Description: An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://flexiva.com; http://gatesair.com; https://strik3r.gitbook.io/strik3r-blog/security-research/cves-pocs/cve-2023-36082
CVE: CVE-2023-4068
Published: 2023-08-03
Description: Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.1 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1466183; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-4069
Published: 2023-08-03
Description: Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1465326; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-4070
Published: 2023-08-03
Description: Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.1 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1462951; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-4071
Published: 2023-08-03
Description: Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1458819; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-4072
Published: 2023-08-03
Description: Out of bounds read and write in WebGL in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1464038; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-4073
Published: 2023-08-03
Description: Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1456243; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-4074
Published: 2023-08-03
Description: Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1464113; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-4075
Published: 2023-08-03
Description: Use after free in Cast in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1457757; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-4076
Published: 2023-08-03
Description: Use after free in WebRTC in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC session. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1459124; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-4077
Published: 2023-08-03
Description: Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1451146; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2023-4078
Published: 2023-08-03
Description: Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html; https://crbug.com/1461895; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2020-20808
Published: 2023-08-03
Description: Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd and starttijd parameters of do/search.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/alorfm/vuln/blob/master/qibosoft_cross_Site_Scripting.md; https://github.com/alorfm/vuln/blob/master/qibosoft_cross_Site_Scripting.md
CVE: CVE-2023-26979
Published: 2023-08-03
Description: Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to decrease or increase the intensity of the stimulator by hijacking the BLE communication.
CVSS Score: 3.1 (LOW)
CWE: CWE-924
References: http://bluetens.com; https://www.secura.com/blog/serious-safety-impact-found-in-bluetooth-low-energy-based-medical-devices; http://bluetens.com
CVE: CVE-2023-36212
Published: 2023-08-03
Description: File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/capture0x/Total-CMS-EXPLOIT/; https://packetstormsecurity.com/files/172687/Total-CMS-1.7.4-Shell-Upload.html; https://www.exploit-db.com/exploits/51500
CVE: CVE-2023-36255
Published: 2023-08-03
Description: An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://eramba.com; https://trovent.github.io/security-advisories/TRSA-2303-01/TRSA-2303-01.txt; https://trovent.io/security-advisory-2303-01/
CVE: CVE-2023-38954
Published: 2023-08-03
Description: ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://zkteco.com; https://claroty.com/team82/disclosure-dashboard/cve-2023-38954; http://zkteco.com
CVE: CVE-2023-38955
Published: 2023-08-03
Description: ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: http://zkteco.com; https://claroty.com/team82/disclosure-dashboard/cve-2023-38955; http://zkteco.com
CVE: CVE-2023-38956
Published: 2023-08-03
Description: A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://zkteco.com; https://claroty.com/team82/disclosure-dashboard/cve-2023-38956; http://zkteco.com
CVE: CVE-2023-38958
Published: 2023-08-03
Description: An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotely via sending a crafted web request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: http://zkteco.com; https://claroty.com/team82/disclosure-dashboard/cve-2023-38958; http://zkteco.com
CVE: CVE-2023-34196
Published: 2023-08-03
Description: In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates (attributes and public keys) to unauthenticated or less privileged users may occur.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287
References: https://keyfactor.com; https://support.keyfactor.com/hc/en-us/articles/[PII_REDACTED]827-EJBCA-Security-Advisory-Partial-denial-of-service-attack-on-certificate-distribution-servlet-ejbca-ra-cert; https://keyfactor.com
CVE: CVE-2023-37364
Published: 2023-08-03
Description: In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service, a similar issue to CVE-2013-4152.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://ws-inc.com; https://ws-inc.com/security.html; https://ws-inc.com
CVE: CVE-2023-37679
Published: 2023-08-03
Description: A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://mirth.com; http://nextgen.com; http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html
CVE: CVE-2023-39144
Published: 2023-08-03
Description: Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://getknowmore.com/; https://github.com/cduram/CVE-2023-39144; https://getknowmore.com/
CVE: CVE-2023-4110
Published: 2023-08-03
Description: A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument session_id leads to cross site scripting. The attack can be launched remotely. The identifier VDB-235957 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173926/PHPJabbers-Availability-Booking-Calendar-5.0-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235957; https://vuldb.com/?id.235957
CVE: CVE-2023-4111
Published: 2023-08-03
Description: A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index/pickup_id leads to cross site scripting. The attack may be launched remotely. VDB-235958 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/173927/PHPJabbers-Bus-Reservation-System-1.1-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235958; https://vuldb.com/?id.235958
CVE: CVE-2023-4124
Published: 2023-08-03
Description: Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/answerdev/answer/commit/964195fd859ee5d7171fac847374dfa31893e793; https://huntr.dev/bounties/2c684f99-d181-4106-8ee2-64a76ae6a348; https://github.com/answerdev/answer/commit/964195fd859ee5d7171fac847374dfa31893e793
CVE: CVE-2023-4125
Published: 2023-08-03
Description: Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-521, CWE-521
References: https://github.com/answerdev/answer/commit/7d23b17cdbbefcd2e7b5c3150f0b5ec908dc835f; https://huntr.dev/bounties/85bfd18f-8d3b-4154-8b7b-1f8fcf704e28; https://github.com/answerdev/answer/commit/7d23b17cdbbefcd2e7b5c3150f0b5ec908dc835f
CVE: CVE-2023-4126
Published: 2023-08-03
Description: Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://github.com/answerdev/answer/commit/4f468b58d0dea51290bfbdd3e96332b0014c8730; https://huntr.dev/bounties/7f50bf1c-bcb9-46ca-8cec-211493d280c5; https://github.com/answerdev/answer/commit/4f468b58d0dea51290bfbdd3e96332b0014c8730
CVE: CVE-2023-4127
Published: 2023-08-03
Description: Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-366
References: https://github.com/answerdev/answer/commit/47661dc8a356ce6aa7793f1bd[PII_REDACTED]80182; https://huntr.dev/bounties/cf7d19e3-1318-4c77-8366-d8d04a0b41ba; https://github.com/answerdev/answer/commit/47661dc8a356ce6aa7793f1bd[PII_REDACTED]80182
CVE: CVE-2023-38744
Published: 2023-08-03
Description: Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://jvn.jp/en/vu/JVNVU92193064/; https://www.ia.omron.com/product/vulnerability/OMSR-2023-006_en.pdf; https://jvn.jp/en/vu/JVNVU92193064/