deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-20050
Published: 2023-02-23
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the currently logged-in user.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cli-cmdinject-euQVK9u; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cli-cmdinject-euQVK9u
CVE: CVE-2023-20089
Published: 2023-02-23
Description: A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, adjacent attacker to cause a memory leak, which could result in an unexpected reload of the device. This vulnerability is due to incorrect error checking when parsing ingress LLDP packets. An attacker could exploit this vulnerability by sending a steady stream of crafted LLDP packets to an affected device. A successful exploit could allow the attacker to cause a memory leak, which could result in a denial of service (DoS) condition when the device unexpectedly reloads. Note: This vulnerability cannot be exploited by transit traffic through the device. The crafted LLDP packet must be targeted to a directly connected interface, and the attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). In addition, the attack surface for this vulnerability can be reduced by disabling LLDP on interfaces where it is not required.
CVSS Score: 7.4 (HIGH)
CWE: CWE-789, CWE-401
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-lldp-dos-ySCNZOpX; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-lldp-dos-ySCNZOpX
CVE: CVE-2023-23914
Published: 2023-02-23
Description: A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319, CWE-319, CWE-319
References: https://hackerone.com/reports/1813864; https://security.gentoo.org/glsa/202310-12; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-23915
Published: 2023-02-23
Description: A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://hackerone.com/reports/1826048; https://security.gentoo.org/glsa/202310-12; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-23916
Published: 2023-02-23
Description: An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770, CWE-770
References: https://hackerone.com/reports/1826048; https://lists.debian.org/debian-lts-announce/2023/02/msg00035.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/
CVE: CVE-2023-23917
Published: 2023-02-23
Description: A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-1321, CWE-1321
References: https://hackerone.com/reports/1631258; https://hackerone.com/reports/1631258
CVE: CVE-2023-23918
Published: 2023-02-23
Description: A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
CVE: CVE-2023-23919
Published: 2023-02-23
Description: A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: https://hackerone.com/reports/1808596; https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-23920
Published: 2023-02-23
Description: An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-426, CWE-426, CWE-426
References: https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html; https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-24317
Published: 2023-02-23
Description: Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the component edit_organizer.php.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: http://judging.com; http://sourcecodester.com; https://packetstormsecurity.com/files/170205/Judging-Management-System-1.0-Shell-Upload.html
CVE: CVE-2023-26325
Published: 2023-02-23
Description: The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterValue' and 'selectedColumns' parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.tenable.com/security/research/tra-2023-2; https://www.tenable.com/security/research/tra-2023-2
CVE: CVE-2023-26326
Published: 2023-02-23
Description: The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.tenable.com/security/research/tra-2023-7; https://www.tenable.com/security/research/tra-2023-7
CVE: CVE-2022-36231
Published: 2023-02-23
Description: pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/affix/CVE-2022-36231; https://github.com/newspaperclub/pdf_info/issues/16; https://github.com/newspaperclub/pdf_info/pull/15
CVE: CVE-2022-46784
Published: 2023-02-23
Description: SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was originally found in 5.5.1 GA.)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://scomsupport.squaredup.com/hc/en-us/articles/[PII_REDACTED]677-CVE-2022-46784-Client-side-open-redirection; https://scomsupport.squaredup.com/hc/en-us/articles/[PII_REDACTED]677-CVE-2022-46784-Client-side-open-redirection
CVE: CVE-2022-46785
Published: 2023-02-23
Description: SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 1 of 2).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://scomsupport.squaredup.com/hc/en-us/articles/[PII_REDACTED]197-CVE-2022-46785-Prototype-pollution-leading-to-XSS; https://scomsupport.squaredup.com/hc/en-us/articles/[PII_REDACTED]197-CVE-2022-46785-Prototype-pollution-leading-to-XSS
CVE: CVE-2023-0754
Published: 2023-02-23
Description: 
The affected products are vulnerable to an integer
overflow or wraparound, which could  allow an attacker to crash the server and remotely
execute arbitrary code.
















CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01
CVE: CVE-2023-0755
Published: 2023-02-23
Description: 
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01
CVE: CVE-2023-24205
Published: 2023-02-23
Description: Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw-setting.yaml).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732, CWE-732
References: https://github.com/Fndroid/clash_for_windows_pkg; https://github.com/Fndroid/clash_for_windows_pkg/issues/3891; https://github.com/Fndroid/clash_for_windows_pkg
CVE: CVE-2023-25823
Published: 2023-02-23
Description: Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=True`), a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides. This issue is patched in version 3.13.1, however, users  are recommended to update to 3.19.1 or later where the FRP solution has been properly tested. 
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://github.com/gradio-app/gradio/security/advisories/GHSA-3x5j-9vwr-8rr5; https://github.com/gradio-app/gradio/security/advisories/GHSA-3x5j-9vwr-8rr5
CVE: CVE-2023-25824
Published: 2023-02-23
Description: Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read operations on TLS connections when the transport hit timeouts. Instead it entered an endless loop retrying the read operation, consuming CPU resources. This could be exploited for denial of service attacks. If trace level logging was enabled, it would also produce an excessive amount of log output during the loop, consuming disk space. The problem has been fixed in commit d7eec4e598158ab6a98bf505354e84352f9715ec, please update to version 0.12.1. There are no workarounds, users who cannot update should apply the errno fix detailed in the security advisory. 

CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942737#25; https://github.com/airtower-luna/mod_gnutls/commit/d7eec4e598158ab6a98bf505354e84352f9715ec; https://github.com/airtower-luna/mod_gnutls/security/advisories/GHSA-6cfv-fvgm-7pc8
CVE: CVE-2023-23294
Published: 2023-02-23
Description: Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute commands as root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/; https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/
CVE: CVE-2023-23295
Published: 2023-02-23
Description: Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/; https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/
CVE: CVE-2023-23296
Published: 2023-02-23
Description: Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/; https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/
CVE: CVE-2023-24212
Published: 2023-02-23
Description: Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the timeType function at /goform/SetSysTimeCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Venus-WQLab/bug_report/blob/main/Tenda/CVE-2023-24212.md; https://github.com/w0x68y/cve-lists/blob/main/Tenda/vuln/readme.md; https://github.com/Venus-WQLab/bug_report/blob/main/Tenda/CVE-2023-24212.md
CVE: CVE-2023-26468
Published: 2023-02-24
Description: Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/cerebrate-project/cerebrate/commit/7ccf9252470a23acc38ad6ed13eecf523e368b48; https://github.com/cerebrate-project/cerebrate/commit/7ccf9252470a23acc38ad6ed13eecf523e368b48
CVE: CVE-2022-46440
Published: 2023-02-24
Description: ttftool v0.9.2 was discovered to contain a segmentation violation via the readU16 function at ttf.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/keepinggg/poc; https://github.com/matthiaskramm/swftools/issues/194; https://github.com/keepinggg/poc
CVE: CVE-2023-0994
Published: 2023-02-24
Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://github.com/francoisjacquet/rosariosis/commit/630d3e3d78270db8dbcbfe87db265bc3e70c5a76; https://huntr.dev/bounties/a281c586-9b97-4d17-88ff-ca91bb4c45ad; https://github.com/francoisjacquet/rosariosis/commit/630d3e3d78270db8dbcbfe87db265bc3e70c5a76
CVE: CVE-2023-0995
Published: 2023-02-24
Description: Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to v2.0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/unilogies/bumsys/commit/927214bd7c475b31062c56294ff7b23d523a7219; https://huntr.dev/bounties/2847b92b-22c2-4dbc-a9d9-56a7cd12fe5f; https://github.com/unilogies/bumsys/commit/927214bd7c475b31062c56294ff7b23d523a7219
CVE: CVE-2023-0996
Published: 2023-02-24
Description: 
There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call.





CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/strukturag/libheif/pull/759; https://govtech-csg.github.io/security-advisories/2023/02/24/CVE-2023-0996.html; https://github.com/strukturag/libheif/pull/759
CVE: CVE-2022-1607
Published: 2023-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2023-26102
Published: 2023-02-24
Description: All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321, CWE-1321, CWE-1321
References: https://github.com/timdown/rangy/issues/478; https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702; https://github.com/timdown/rangy/issues/478
CVE: CVE-2022-48345
Published: 2023-02-24
Description: sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c; https://github.com/braintree/sanitize-url/compare/v6.0.1...v6.0.2; https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c
CVE: CVE-2023-22425
Published: 2023-02-24
Description: Stored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote authenticated attacker to inject an arbitrary script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/shirasagi/shirasagi; https://jvn.jp/en/jp/JVN18765463/; https://www.ss-proj.org/
CVE: CVE-2023-22427
Published: 2023-02-24
Description: Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker with an administrative privilege to inject an arbitrary script.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/shirasagi/shirasagi; https://jvn.jp/en/jp/JVN18765463/; https://www.ss-proj.org/
CVE: CVE-2023-0997
Published: 2023-02-24
Description: A vulnerability was found in SourceCodester Moosikay E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Moosikay/order.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221732.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/jidle123/bug_report/blob/main/vendors/razormist/Moosikay%20-%20E-Commerce%20System/SQLi-1.md; https://vuldb.com/?ctiid.221732; https://vuldb.com/?id.221732
CVE: CVE-2023-0998
Published: 2023-02-24
Description: A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alphaware/summary.php of the component Payment Handler. The manipulation of the argument amount leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221733 was assigned to this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/1MurasaKi/PaymentVul_report/blob/main/razormist/Alphaware%20-%20Simple%20E-Commerce%20System/payment_vulnerability.md; https://vuldb.com/?ctiid.221733; https://vuldb.com/?id.221733
CVE: CVE-2023-0999
Published: 2023-02-24
Description: A vulnerability classified as problematic was found in SourceCodester Sales Tracker Management System 1.0. This vulnerability affects unknown code of the file admin/?page=user/list. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221734 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/1MurasaKi/STMS_CSRF/blob/main/README.md; https://vuldb.com/?ctiid.221734; https://vuldb.com/?id.221734
CVE: CVE-2023-1002
Published: 2023-02-24
Description: A vulnerability, which was classified as problematic, has been found in MuYuCMS 2.2. This issue affects some unknown processing of the file index.php. The manipulation of the argument file_path leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221735.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/MuYuCMS/MuYuCMS/issues/3; https://vuldb.com/?ctiid.221735; https://vuldb.com/?id.221735
CVE: CVE-2023-1004
Published: 2023-02-24
Description: A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-221737 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://github.com/marktext/marktext/issues/3575; https://vuldb.com/?ctiid.221737; https://vuldb.com/?id.221737
CVE: CVE-2023-1005
Published: 2023-02-24
Description: A vulnerability was found in JP1016 Markdown-Electron and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to code injection. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-221738 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-94
References: https://github.com/JP1016/Markdown-Electron/issues/3; https://vuldb.com/?ctiid.221738; https://vuldb.com/?id.221738
CVE: CVE-2023-1006
Published: 2023-02-24
Description: A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been classified as problematic. This affects an unknown part of the component New Record Handler. The manipulation of the argument Firstname/Middlename/Lastname/Suffix/Nationality/Doctor Fullname/Doctor Suffix with the input "><script>prompt(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-221739.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.221739; https://vuldb.com/?id.221739; https://vuldb.com/?ctiid.221739