deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4905
Published: 2023-02-13
Description: A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress. It has been declared as problematic. This vulnerability affects the function setup_wizard_interface of the file lib/classes/class-settings.php. The manipulation of the argument settings leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 is able to address this issue. The patch is identified as 6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a. It is recommended to upgrade the affected component. VDB-220750 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/udx/wp-stateless/commit/6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a; https://github.com/udx/wp-stateless/pull/630; https://github.com/udx/wp-stateless/releases/tag/3.2.0
CVE: CVE-2023-24084
Published: 2023-02-13
Description: ChiKoi v1.0 was discovered to contain a SQL injection vulnerability via the load_file function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/tanhongit/2023/ChiKoi; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/tanhongit/2023/ChiKoi
CVE: CVE-2023-24086
Published: 2023-02-13
Description: SLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /customs/loan_by_class.php?reportView.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.2; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.2
CVE: CVE-2023-24646
Published: 2023-02-13
Description: An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Food-Ordering-System-v2.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Food-Ordering-System-v2.0
CVE: CVE-2023-24647
Published: 2023-02-13
Description: Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Food-Ordering-System-v2.0/SQLi; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Food-Ordering-System-v2.0/SQLi
CVE: CVE-2023-24648
Published: 2023-02-13
Description: Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/zippy/zstore-6.6.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/zippy/zstore-6.6.0
CVE: CVE-2023-25160
Published: 2023-02-13
Description: Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nextcloud 22-24, Mail 1.12.9 for Nextcloud 21, or Mail 1.11.8 for Nextcloud 20 to receive a patch. No known workarounds are available.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/nextcloud/mail/pull/7740; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx; https://hackerone.com/reports/1784681
CVE: CVE-2023-25161
Published: 2023-02-13
Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.
CVSS Score: 3.7 (LOW)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-596q-xr2f; https://github.com/nextcloud/server/pull/34632; https://hackerone.com/reports/1691195
CVE: CVE-2023-25162
Published: 2023-02-13
Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request forgery (SSRF). Attackers can leverage enclosed alphanumeric payloads to bypass IP filters and gain SSRF, which would allow an attacker to read crucial metadata if the server is hosted on the AWS platform. Nextcloud Server 24.0.8 and 23.0.2 and Nextcloud Enterprise Server 24.0.8 and 23.0.12 contain a patch for this issue. No known workarounds are available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mqrx-grp7-244m; https://github.com/nextcloud/server/pull/34160; https://hackerone.com/reports/1702864
CVE: CVE-2023-25240
Published: 2023-02-13
Description: An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1265
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pimcore/pimCore-10.5.15; https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pimcore/pimCore-10.5.15
CVE: CVE-2023-25241
Published: 2023-02-13
Description: bgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/bgERP/2023/bgERP-v22.31-Cookie-Session-vulnerability%2BXSS-Reflected; https://portswigger.net/kb/issues/00500b01_cookie-manipulation-reflected-dom-based; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/bgERP/2023/bgERP-v22.31-Cookie-Session-vulnerability%2BXSS-Reflected
CVE: CVE-2023-25572
Published: 2023-02-13
Description: react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and using the `<RichTextField>` are affected. `<RichTextField>` outputs the field value using `dangerouslySetInnerHTML` without client-side sanitization. If the data isn't sanitized server-side, this opens a possible cross-site scripting (XSS) attack. Versions 3.19.12 and 4.7.6 now use `DOMPurify` to escape the HTML before outputting it with React and `dangerouslySetInnerHTML`. Users who already sanitize HTML data server-side do not need to upgrade. As a workaround, users may replace the `<RichTextField>` by a custom field doing sanitization by hand.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/marmelab/react-admin/pull/8644; https://github.com/marmelab/react-admin/pull/8645; https://github.com/marmelab/react-admin/releases/tag/v3.19.12
CVE: CVE-2015-10079
Published: 2023-02-13
Description: A vulnerability was found in juju2143 WalrusIRC 0.0.2. It has been rated as problematic. This issue affects the function parseLinks of the file public/parser.js. The manipulation of the argument text leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.0.3 is able to address this issue. The patch is named 45fd885895ae13e8d9b3a71e89d59768914f60af. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220751.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/juju2143/walrusirc/commit/45fd885895ae13e8d9b3a71e89d59768914f60af; https://github.com/juju2143/walrusirc/releases/tag/0.0.3; https://vuldb.com/?ctiid.220751
CVE: CVE-2022-47034
Published: 2023-02-13
Description: A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-697, CWE-697
References: https://gist.github.com/tonino-25/d2316094cc751cc7a8e2c1ae6dbecfe9; https://github.com/playsms/playsms/commit/dd23673a00c052e113c6d44eb629dc355d3c0605; https://gist.github.com/tonino-25/d2316094cc751cc7a8e2c1ae6dbecfe9
CVE: CVE-2023-0817
Published: 2023-02-13
Description: Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: https://github.com/gpac/gpac/commit/be9f8d395bbd196e3812e9cd80708f06bcc206f7; https://huntr.dev/bounties/cb730bc5-d79c-4de6-9e57-10e8c3ce2cf3; https://github.com/gpac/gpac/commit/be9f8d395bbd196e3812e9cd80708f06bcc206f7
CVE: CVE-2023-0818
Published: 2023-02-13
Description: Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-193, CWE-193
References: https://github.com/gpac/gpac/commit/377ab25f3e502db2934a9cf4b54739e1c89a02ff; https://huntr.dev/bounties/038e7472-f3e9-46c2-9aea-d6dafb62a18a; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2023-0819
Published: 2023-02-13
Description: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/gpac/gpac/commit/d067ab3ccdeaa340e8c045a0fd5bcfc22b809e8f; https://huntr.dev/bounties/35793610-dccc-46c8-9f55-6a24c621e4ef; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2022-3411
Published: 2023-02-13
Description: A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1284, CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3411.json; https://gitlab.com/gitlab-org/gitlab/-/issues/376247; https://hackerone.com/reports/1685995
CVE: CVE-2022-3759
Published: 2023-02-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3759.json; https://gitlab.com/gitlab-org/gitlab/-/issues/379633; https://hackerone.com/reports/1736230
CVE: CVE-2022-4138
Published: 2023-02-13
Description: A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4138.json; https://gitlab.com/gitlab-org/gitlab/-/issues/383709; https://hackerone.com/reports/1778009
CVE: CVE-2023-0518
Published: 2023-02-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0518.json; https://gitlab.com/gitlab-org/gitlab/-/issues/383082; https://hackerone.com/reports/1766973
CVE: CVE-2023-0795
Published: 2023-02-13
Description: LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0795.json; https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68; https://gitlab.com/libtiff/libtiff/-/issues/493
CVE: CVE-2023-0796
Published: 2023-02-13
Description: LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0796.json; https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68; https://gitlab.com/libtiff/libtiff/-/issues/499
CVE: CVE-2023-0797
Published: 2023-02-13
Description: LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0797.json; https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68; https://gitlab.com/libtiff/libtiff/-/issues/495
CVE: CVE-2023-0798
Published: 2023-02-13
Description: LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0798.json; https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68; https://gitlab.com/libtiff/libtiff/-/issues/492
CVE: CVE-2023-0799
Published: 2023-02-13
Description: LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0799.json; https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68; https://gitlab.com/libtiff/libtiff/-/issues/494
CVE: CVE-2023-0800
Published: 2023-02-13
Description: LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0800.json; https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00; https://gitlab.com/libtiff/libtiff/-/issues/496
CVE: CVE-2023-0801
Published: 2023-02-13
Description: LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0801.json; https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00; https://gitlab.com/libtiff/libtiff/-/issues/498
CVE: CVE-2023-0802
Published: 2023-02-13
Description: LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0802.json; https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00; https://gitlab.com/libtiff/libtiff/-/issues/500
CVE: CVE-2023-0803
Published: 2023-02-13
Description: LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0803.json; https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00; https://gitlab.com/libtiff/libtiff/-/issues/501
CVE: CVE-2023-0804
Published: 2023-02-13
Description: LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0804.json; https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00; https://gitlab.com/libtiff/libtiff/-/issues/497
CVE: CVE-2023-0814
Published: 2023-02-14
Description: The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://lana.codes/lanavdb/512e7307-04a5-4d8b-8f79-f75f37784a9f/; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2864329%40profile-builder&new=2864329%40profile-builder&sfp_email=&sfph_mail=; https://www.wordfence.com/blog/2023/03/vulnerability-patched-in-cozmolabs-profile-builder-plugin-information-disclosure-leads-to-account-takeover/
CVE: CVE-2023-24187
Published: 2023-02-14
Description: An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.
CVSS Score: 7.8 (HIGH)
CWE: CWE-611, CWE-611
References: http://ureport.com; https://github.com/Venus-WQLab/bug_report/blob/main/ureport/ureport-cve-2023-24187.md; https://github.com/cgddgc/vulns/blob/main/ureport2-vuln-des.md
CVE: CVE-2023-0655
Published: 2023-02-14
Description: SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0002; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0002
CVE: CVE-2023-22370
Published: 2023-02-14
Description: Stored cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a network-adjacent authenticated attacker to inject an arbitrary script. NOTE: This vulnerability only affects products that are no longer supported by the developer.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN98612206/; https://www.planex.co.jp/support/support_end_list.shtml; https://jvn.jp/en/jp/JVN98612206/
CVE: CVE-2023-22375
Published: 2023-02-14
Description: Cross-site request forgery (CSRF) vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to hijack the authentication and conduct arbitrary operations by having a logged-in user to view a malicious page. NOTE: This vulnerability only affects products that are no longer supported by the developer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://jvn.jp/en/jp/JVN98612206/; https://www.planex.co.jp/support/support_end_list.shtml; https://jvn.jp/en/jp/JVN98612206/
CVE: CVE-2023-22376
Published: 2023-02-14
Description: Reflected cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to inject arbitrary script to inject an arbitrary script. NOTE: This vulnerability only affects products that are no longer supported by the developer.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN98612206/; https://www.planex.co.jp/support/support_end_list.shtml; https://jvn.jp/en/jp/JVN98612206/
CVE: CVE-2023-0019
Published: 2023-02-14
Description: In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/3281724; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3281724
CVE: CVE-2023-0020
Published: 2023-02-14
Description: SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality and limited impact on integrity of the application.


CVSS Score: 8.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://launchpad.support.sap.com/#/notes/3263135; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3263135
CVE: CVE-2023-0024
Published: 2023-02-14
Description: SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources, resulting in Cross-Site Scripting vulnerability.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3265846; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3265846
CVE: CVE-2023-0025
Published: 2023-02-14
Description: SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3267442; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3267442