deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-5695
Published: 2023-10-22
Description: A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file pages_reset_pwd.php. The manipulation of the argument email with the input testing%40example.com'%26%25<ScRiPt%20>alert(9860)</ScRiPt> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243133 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.243133; https://vuldb.com/?id.243133
CVE: CVE-2023-5696
Published: 2023-10-22
Description: A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file pages_transfer_money.php. The manipulation of the argument account_number with the input 357146928--><ScRiPt%20>alert(9206)</ScRiPt><!-- leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-243134 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.243134; https://vuldb.com/?id.243134
CVE: CVE-2023-46319
Published: 2023-10-23
Description: WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288
References: https://www.wallix.com/support/alerts/; https://www.wallix.com/support/alerts/
CVE: CVE-2023-46321
Published: 2023-10-23
Description: iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-117
References: https://gitlab.com/gnachman/iterm2/-/commit/de3d351e1bd3bc1c1a4f85fe976c592e497dd071; https://iterm2.com/downloads.html; https://gitlab.com/gnachman/iterm2/-/commit/de3d351e1bd3bc1c1a4f85fe976c592e497dd071
CVE: CVE-2023-46322
Published: 2023-10-23
Description: iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other characters may be outside the set of alphanumeric characters, dash, and period.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-117
References: https://gitlab.com/gnachman/iterm2/-/commit/ef7bb84520013b2524df9787d4aa9f2c96746c01; https://iterm2.com/downloads.html; https://gitlab.com/gnachman/iterm2/-/commit/ef7bb84520013b2524df9787d4aa9f2c96746c01
CVE: CVE-2023-5697
Published: 2023-10-23
Description: A vulnerability classified as problematic has been found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pages_withdraw_money.php. The manipulation of the argument account_number with the input 287359614--><ScRiPt%20>alert(1234)</ScRiPt><!-- leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243135.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.243135; https://vuldb.com/?id.243135
CVE: CVE-2023-5698
Published: 2023-10-23
Description: A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. This vulnerability affects unknown code of the file pages_deposit_money.php. The manipulation of the argument account_number with the input 421873905--><ScRiPt%20>alert(9523)</ScRiPt><!-- leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243136.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.243136; https://vuldb.com/?id.243136
CVE: CVE-2023-5699
Published: 2023-10-23
Description: A vulnerability, which was classified as problematic, has been found in CodeAstro Internet Banking System 1.0. This issue affects some unknown processing of the file pages_view_client.php. The manipulation of the argument acc_name with the input Johnnie Reyes'"()&%<zzz><ScRiPt >alert(5646)</ScRiPt> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243137 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%207.pdf; https://vuldb.com/?ctiid.243137; https://vuldb.com/?id.243137
CVE: CVE-2023-5700
Published: 2023-10-23
Description: A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/iscgwtunnel/uploadiscgwrouteconf.php. The manipulation of the argument GWLinkId leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-243138 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/istlnight/cve/blob/main/NS-ASG-sql-uploadiscgwrouteconf.md; https://vuldb.com/?ctiid.243138; https://vuldb.com/?id.243138
CVE: CVE-2023-46324
Published: 2023-10-23
Description: pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its private key and the attacker's public key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/free5gc/udm/compare/v1.1.1...v1.2.0; https://github.com/free5gc/udm/pull/20; https://www.gsma.com/security/wp-content/uploads/2023/10/0073-invalid_curve.pdf
CVE: CVE-2023-5701
Published: 2023-10-23
Description: A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Markdown File Handler. The manipulation with the input <xss onclick="alert(1)" style=display:block>Click here</xss> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243139. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/victorootnice/victorootnice.github.io/blob/main/2023/bbp-01.md; https://vuldb.com/?ctiid.243139; https://vuldb.com/?id.243139
CVE: CVE-2023-5702
Published: 2023-10-23
Description: A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/. The manipulation leads to direct request. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425, CWE-425
References: https://github.com/GTA12138/vul/blob/main/Viessmann/Vitogate300_Document_Unauthorized_Access.md; https://vuldb.com/?ctiid.243140; https://vuldb.com/?id.243140
CVE: CVE-2023-43624
Published: 2023-10-23
Description: CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4)  contains an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Designer is installed may be disclosed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://jvn.jp/en/vu/JVNVU98683567/; https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-011_en.pdf; https://jvn.jp/en/vu/JVNVU98683567/
CVE: CVE-2023-31122
Published: 2023-10-23
Description: Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TI3V2YCEUM65QDYPGGNUZ7UONIM5OEXC/
CVE: CVE-2023-43622
Published: 2023-10-23
Description: An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.
This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.

Users are recommended to upgrade to version 2.4.58, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://httpd.apache.org/security/vulnerabilities_24.html
CVE: CVE-2023-45802
Published: 2023-10-23
Description: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.

This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.

Users are recommended to upgrade to version 2.4.58, which fixes the issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html
CVE: CVE-2023-5246
Published: 2023-10-23
Description: Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated remote attacker to potentially impact the availability, integrity and confidentiality of the gateways via an authentication bypass by capture-replay.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.pdf; https://sick.com/psirt
CVE: CVE-2021-26734
Published: 2023-10-23
Description: Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context.






CVSS Score: 4.4 (MEDIUM)
CWE: CWE-269
References: https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021; https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021
CVE: CVE-2021-26735
Published: 2023-10-23
Description: The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.






CVSS Score: 6.7 (MEDIUM)
CWE: CWE-346, CWE-428
References: https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021; https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021
CVE: CVE-2021-26736
Published: 2023-10-23
Description: Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges.



CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-22
References: https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021; https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021
CVE: CVE-2021-26737
Published: 2023-10-23
Description: The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition.



CVSS Score: 5.5 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.6&deployment_date=2022-01-07&id=1388686; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.6&deployment_date=2022-01-07&id=1388686
CVE: CVE-2021-26738
Published: 2023-10-23
Description: Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges.



CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.7&deployment_date=2022-08-19&id=1414851; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.7&deployment_date=2022-08-19&id=1414851
CVE: CVE-2023-28793
Published: 2023-10-23
Description: Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-787
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19
CVE: CVE-2023-28795
Published: 2023-10-23
Description: Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.




CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19
CVE: CVE-2023-28796
Published: 2023-10-23
Description: Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94, CWE-347
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19
CVE: CVE-2023-28797
Published: 2023-10-23
Description: Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user.




CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022
CVE: CVE-2023-28803
Published: 2023-10-23
Description: An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023
CVE: CVE-2023-28804
Published: 2023-10-23
Description: An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105
CVSS Score: 8.2 (HIGH)
CWE: CWE-347, CWE-347
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023
CVE: CVE-2023-28805
Published: 2023-10-23
Description: An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0.105
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023
CVE: CVE-2023-42295
Published: 2023-10-23
Description: An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_rle_image function of file bifs/unquantize.c
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://github.com/OpenImageIO/oiio/issues/3947; https://github.com/OpenImageIO/oiio/issues/3947
CVE: CVE-2023-43065
Published: 2023-10-23
Description: 
Dell Unity prior to 5.3 contains a Cross-site scripting vulnerability. A low-privileged authenticated attacker can exploit these issues to obtain escalated privileges.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-43074
Published: 2023-10-23
Description: 
Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by crafting arbitrary files through a request to the server.


CVSS Score: 5.2 (MEDIUM)
CWE: CWE-73
References: https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-46127
Published: 2023-10-23
Description: Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/frappe/frappe/commit/3dc5d2fcc7561dde181ba953009fe6e39d64e900; https://github.com/frappe/frappe/pull/22339; https://github.com/frappe/frappe/security/advisories/GHSA-j2w9-8xrr-7g98
CVE: CVE-2023-5718
Published: 2023-10-23
Description: The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web page with an iFrame targeting a sensitive resource (i.e. a locally accessible file or sensitive website), and registering a listener on the web page, the extension sent messages back to the listener, containing the base64 encoded screenshot data of the sensitive resource.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-346
References: https://gist.github.com/CalumHutton/bdb97077a66021ed455f87823cd7c7cb; https://gist.github.com/CalumHutton/bdb97077a66021ed455f87823cd7c7cb
CVE: CVE-2023-43066
Published: 2023-10-23
Description: 
Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by authenticating to the device CLI and issuing certain commands.


CVSS Score: 5.1 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-43067
Published: 2023-10-23
Description: 
Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerability disclosing local files in the file system.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-46122
Published: 2023-10-23
Description: sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.
CVSS Score: 3.9 (LOW)
CWE: CWE-22, CWE-22
References: https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a; https://github.com/sbt/io/issues/358; https://github.com/sbt/io/pull/360
CVE: CVE-2023-46332
Published: 2023-10-23
Description: WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/WebAssembly/wabt/issues/2311; https://github.com/WebAssembly/wabt/issues/2311
CVE: CVE-2023-37532
Published: 2023-10-23
Description: HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.

CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108094; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108094
CVE: CVE-2023-46331
Published: 2023-10-23
Description: WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/WebAssembly/wabt/issues/2310; https://github.com/WebAssembly/wabt/issues/2310