deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-33318
Published: 2023-12-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.40.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/woocommerce-follow-up-emails/wordpress-woocommerce-follow-up-emails-plugin-4-9-40-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-follow-up-emails/wordpress-woocommerce-follow-up-emails-plugin-4-9-40-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-34007
Published: 2023-12-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-8-3-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-8-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-34385
Published: 2023-12-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Akshay Menariya Export Import Menus.This issue affects Export Import Menus: from n/a through 1.8.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/export-import-menus/wordpress-export-import-menus-plugin-1-8-0-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/export-import-menus/wordpress-export-import-menus-plugin-1-8-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-40204
Published: 2023-12-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager.This issue affects Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: from n/a through 2.9.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/folders/wordpress-folders-plugin-2-9-2-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/folders/wordpress-folders-plugin-2-9-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-45603
Published: 2023-12-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue affects User Submitted Posts – Enable Users to Submit Posts from the Front End: from n/a through 20230902.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/user-submitted-posts/wordpress-user-submitted-posts-plugin-20230902-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/user-submitted-posts/wordpress-user-submitted-posts-plugin-20230902-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-46149
Published: 2023-12-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/themify-ultra/wordpress-themify-ultra-theme-7-3-3-authenticated-unrestricted-zip-extraction-lead-to-rce-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/themify-ultra/wordpress-themify-ultra-theme-7-3-3-authenticated-unrestricted-zip-extraction-lead-to-rce-vulnerability?_s_id=cve
CVE: CVE-2023-47784
Published: 2023-12-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a through 6.6.15.
CVSS Score: 8.4 (HIGH)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-6-15-author-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-6-15-author-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-47990
Published: 2023-12-20
Description: SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/d3do-23/cuppacve/blob/main/sql%20in%20edit_admin_table.php; https://github.com/d3do-23/cuppacve/blob/main/sql%20in%20edit_admin_table.php
CVE: CVE-2023-49814
Published: 2023-12-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Symbiostock symbiostock.This issue affects Symbiostock: from n/a through 6.0.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/symbiostock/wordpress-symbiostock-lite-plugin-6-0-0-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/symbiostock/wordpress-symbiostock-lite-plugin-6-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2022-44684
Published: 2023-12-20
Description: Windows Local Session Manager (LSM) Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44684; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44684
CVE: CVE-2023-23970
Published: 2023-12-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in WooRockets Corsa.This issue affects Corsa: from n/a through 1.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://patchstack.com/database/vulnerability/corsa/wordpress-corsa-theme-1-5-arbitrary-file-upload?_s_id=cve; https://patchstack.com/database/vulnerability/corsa/wordpress-corsa-theme-1-5-arbitrary-file-upload?_s_id=cve
CVE: CVE-2023-25970
Published: 2023-12-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Zendrop Zendrop – Global Dropshipping.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/zendrop-dropshipping-and-fulfillment/wordpress-zendrop-global-dropshipping-plugin-1-0-0-arbitrary-file-upload?_s_id=cve; https://patchstack.com/database/vulnerability/zendrop-dropshipping-and-fulfillment/wordpress-zendrop-global-dropshipping-plugin-1-0-0-arbitrary-file-upload?_s_id=cve
CVE: CVE-2023-49270
Published: 2023-12-20
Description: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_in_date' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fluidattacks.com/advisories/lang/; https://www.kashipara.com/; https://fluidattacks.com/advisories/lang/
CVE: CVE-2023-49271
Published: 2023-12-20
Description: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_out_date' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fluidattacks.com/advisories/lang/; https://www.kashipara.com/; https://fluidattacks.com/advisories/lang/
CVE: CVE-2023-49272
Published: 2023-12-20
Description: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'children' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fluidattacks.com/advisories/lang/; https://www.kashipara.com/; https://fluidattacks.com/advisories/lang/
CVE: CVE-2023-48433
Published: 2023-12-20
Description: Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the login_action.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/ma/; https://projectworlds.in/; https://fluidattacks.com/advisories/ma/
CVE: CVE-2023-48434
Published: 2023-12-20
Description: Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the reg_action.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/ma/; https://projectworlds.in/; https://fluidattacks.com/advisories/ma/
CVE: CVE-2023-50639
Published: 2023-12-20
Description: Cross Site Scripting (XSS) vulnerability in CuteHttpFileServer v.1.0 and v.2.0 allows attackers to obtain sensitive information via the file upload function in the home page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/940198871/Vulnerability-details/blob/main/CVE-2023-50639.md; https://github.com/940198871/Vulnerability-details/blob/main/CVE-2023-50639.md
CVE: CVE-2023-50983
Published: 2023-12-20
Description: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://tenda.com; https://github.com/ef4tless/vuln/blob/master/iot/i29/sysScheduleRebootSet-2.md; http://tenda.com
CVE: CVE-2023-50984
Published: 2023-12-20
Description: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the ip parameter in the spdtstConfigAndStart function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://tenda.com; https://github.com/ef4tless/vuln/blob/master/iot/i29/spdtstConfigAndStart.md; http://tenda.com
CVE: CVE-2023-50985
Published: 2023-12-20
Description: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the lanGw parameter in the lanCfgSet function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://tenda.com; https://github.com/ef4tless/vuln/blob/master/iot/i29/lanCfgSet.md; http://tenda.com
CVE: CVE-2023-50986
Published: 2023-12-20
Description: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120, CWE-787
References: http://tenda.com; https://github.com/ef4tless/vuln/blob/master/iot/i29/sysLogin.md; http://tenda.com
CVE: CVE-2023-50987
Published: 2023-12-20
Description: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysTimeInfoSet function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://tenda.com; https://github.com/ef4tless/vuln/blob/master/iot/i29/sysTimeInfoSet.md; http://tenda.com
CVE: CVE-2023-50988
Published: 2023-12-20
Description: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the bandwidth parameter in the wifiRadioSetIndoor function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://tenda.com; https://github.com/ef4tless/vuln/blob/master/iot/i29/wifiRadioSetIndoor.md; http://tenda.com
CVE: CVE-2023-50989
Published: 2023-12-20
Description: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://tenda.com; https://github.com/ef4tless/vuln/blob/master/iot/i29/pingSet-2.md; http://tenda.com
CVE: CVE-2023-50990
Published: 2023-12-20
Description: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the rebootTime parameter in the sysScheduleRebootSet function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://tenda.com; https://github.com/ef4tless/vuln/blob/master/iot/i29/sysScheduleRebootSet.md; http://tenda.com
CVE: CVE-2023-50992
Published: 2023-12-20
Description: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a stack overflow via the ip parameter in the setPing function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://tenda.com; https://github.com/ef4tless/vuln/blob/master/iot/i29/setPing.md; http://tenda.com
CVE: CVE-2023-50993
Published: 2023-12-20
Description: Ruijie WS6008 v1.x v2.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 and WS6108 v1.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 was discovered to contain a command injection vulnerability via the function downFiles.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/ef4tless/vuln/blob/master/iot/WS6008-WS6108/1.md; https://github.com/ef4tless/vuln/blob/master/iot/WS6008-WS6108/1.md
CVE: CVE-2023-41166
Published: 2023-12-21
Description: An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0 through 4.7.1. It's possible to know if a specific user account exists on the SNS firewall by using remote access commands.
CVSS Score: 5.3 (MEDIUM)
References: https://advisories.stormshield.eu/2023-027; https://advisories.stormshield.eu/2023-027
CVE: CVE-2023-45703
Published: 2023-12-21
Description: HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion.

CVSS Score: 5.3 (MEDIUM)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108649; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108649
CVE: CVE-2023-46131
Published: 2023-12-21
Description: Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/grails/grails-core/commit/74326bdd2cf7dcb594092165e9464520f8366c60; https://github.com/grails/grails-core/commit/c401faaa6c24c021c758b95f72304a0e855a8db3; https://github.com/grails/grails-core/issues/13302
CVE: CVE-2023-47093
Published: 2023-12-21
Description: An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. Sending a crafted ICMP packet may lead to a crash of the ASQ engine.
CVSS Score: 6.5 (MEDIUM)
References: https://advisories.stormshield.eu/2023-031/; https://advisories.stormshield.eu/2023-031/
CVE: CVE-2023-49032
Published: 2023-12-21
Description: An issue in LTB Self Service Password before v.1.5.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via hijack of the SMS verification code function to arbitrary phone.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/ltb-project/self-service-password/issues/816; https://github.com/piuppi/Proof-of-Concepts/blob/main/ltb-project/README.md; https://github.com/ltb-project/self-service-password/issues/816
CVE: CVE-2023-51390
Published: 2023-12-21
Description: journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-215, CWE-284, CWE-319
References: https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da; https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g; https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da
CVE: CVE-2023-28025
Published: 2023-12-21
Description: Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage. 

CVSS Score: 6.6 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109318; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109318
CVE: CVE-2023-29485
Published: 2023-12-21
Description: An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to bypass network filtering, execute arbitrary code, and obtain sensitive information via DarkLayer Guard threat prevention module. NOTE: Heimdal disputes the validity of this issue arguing that their DNS Security for Endpoint filters DNS traffic on the endpoint by intercepting system-generated DNS requests. The product was not designed to intercept DNS requests from third-party solutions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://medium.com/%40drabek.a/weaknesses-in-heimdal-thors-line-of-products-9d0e5095fb93; https://medium.com/%40drabek.a/weaknesses-in-heimdal-thors-line-of-products-9d0e5095fb93
CVE: CVE-2023-29486
Published: 2023-12-21
Description: An issue was discovered in Heimdal Thor agent versions 3.4.2 and before 3.7.0 on Windows, allows attackers to bypass USB access restrictions, execute arbitrary code, and obtain sensitive information via Next-Gen Antivirus component. NOTE: Heimdal argues that the limitation described here is a Microsoft Windows issue, not a Heimdal specific vulnerability. The USB control solution by Heimdal is meant to manage Microsoft Windows native USB restrictions. They maintain that their solution functions as a management layer over Windows settings and is not to blame for limitations in Windows' detection capabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1333, CWE-1333
References: https://medium.com/%40drabek.a/weaknesses-in-heimdal-thors-line-of-products-9d0e5095fb93; https://medium.com/%40drabek.a/weaknesses-in-heimdal-thors-line-of-products-9d0e5095fb93
CVE: CVE-2023-29487
Published: 2023-12-21
Description: An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to cause a denial of service (DoS) via the Threat To Process Correlation threat prevention module. NOTE: Heimdal asserts this is not a valid vulnerability. Their DNS Security for Endpoint solution includes an optional feature to provide extra information on the originating process that made a DNS request. The lack of process identification in DNS logs is therefore falsely categorized as a DoS issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1333
References: https://medium.com/%40drabek.a/weaknesses-in-heimdal-thors-line-of-products-9d0e5095fb93; https://medium.com/%40drabek.a/weaknesses-in-heimdal-thors-line-of-products-9d0e5095fb93
CVE: CVE-2023-45700
Published: 2023-12-21
Description: HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108644; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108644
CVE: CVE-2023-7020
Published: 2023-12-21
Description: A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. This issue affects some unknown processing of the file general/wiki/cp/ct/view.php. The manipulation of the argument TEMP_ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248567. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/zte12321/cve/blob/main/sql.md; https://vuldb.com/?ctiid.248567; https://vuldb.com/?id.248567
CVE: CVE-2023-7021
Published: 2023-12-21
Description: A vulnerability was found in Tongda OA 2017 up to 11.9. It has been classified as critical. Affected is an unknown function of the file general/vehicle/checkup/delete_search.php. The manipulation of the argument VU_ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248568. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/qq956801985/cve/blob/main/sql.md; https://vuldb.com/?ctiid.248568; https://vuldb.com/?id.248568
CVE: CVE-2023-7022
Published: 2023-12-21
Description: A vulnerability was found in Tongda OA 2017 up to 11.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file general/work_plan/manage/delete_all.php. The manipulation of the argument DELETE_STR leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248569 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/willchen0011/cve/blob/main/sql3.md; https://vuldb.com/?ctiid.248569; https://vuldb.com/?id.248569
CVE: CVE-2023-7023
Published: 2023-12-21
Description: A vulnerability was found in Tongda OA 2017 up to 11.9. It has been rated as critical. Affected by this issue is some unknown functionality of the file general/vehicle/query/delete.php. The manipulation of the argument VU_ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-248570 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/xiatiandeyu123/cve/blob/main/sql.md; https://vuldb.com/?ctiid.248570; https://vuldb.com/?id.248570
CVE: CVE-2023-7025
Published: 2023-12-21
Description: A vulnerability was found in KylinSoft hedron-domain-hook up to 3.8.0.12-0k0.5. It has been declared as critical. This vulnerability affects the function init_kcm of the component DBus Handler. The manipulation leads to improper access controls. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-248578 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://note.zhaoj.in/share/B05NqMPvEqoU; https://vuldb.com/?ctiid.248578; https://vuldb.com/?id.248578
CVE: CVE-2023-7026
Published: 2023-12-21
Description: A vulnerability was found in Lightxun IPTV Gateway up to 20231208. It has been rated as problematic. This issue affects some unknown processing of the file /ZHGXTV/index.php/admin/index/web_upload_template.html. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248579.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/willchen0011/cve/blob/main/upload2.md; https://vuldb.com/?ctiid.248579; https://vuldb.com/?id.248579