deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-25171
Published: 2023-02-15
Description: Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/kiwitcms/Kiwi/commit/761305d04f5910ba14cc04d1255a8f1afdbb87f3; https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7j9h-3jxf-3vrf; https://huntr.dev/bounties/3b712cb6-3fa3-4f71-8562-7a7016c6262e
CVE: CVE-2023-25191
Published: 2023-02-15
Description: AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-update-5.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023002.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023002.pdf
CVE: CVE-2023-25192
Published: 2023-02-15
Description: AMI MegaRAC SPX devices allow User Enumeration through Redfish. The fixed versions are SPx12-update-7.00 and SPx13-update-5.00.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023002.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023002.pdf
CVE: CVE-2023-25578
Published: 2023-02-15
Description: Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 1.5.2, the request body parsing in `starlite` allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and an unlimited number of field parts. This is a remote, potentially unauthenticated Denial of Service vulnerability. This vulnerability affects applications with a request handler that accepts a `Body(media_type=RequestEncodingType.MULTI_PART)`. The large amount of CPU time required for processing requests can block all available worker processes and significantly delay or slow down the processing of legitimate user requests. The large amount of RAM accumulated while processing requests can lead to Out-Of-Memory kills. Complete DoS is achievable by sending many concurrent multipart requests in a loop. Version 1.51.2 contains a patch for this issue.

CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83; https://github.com/starlite-api/starlite/releases/tag/v1.51.2; https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6q
CVE: CVE-2022-46892
Published: 2023-02-15
Description: In Ampere AltraMax and Ampere Altra before 2.10c, improper access controls allows the OS to reinitialize a disabled root complex.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://amperecomputing.com/products/security-bulletins/root-complex-OS-re-enable; https://amperecomputing.com/products/security-bulletins/root-complex-OS-re-enable
CVE: CVE-2022-45586
Published: 2023-02-15
Description: Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://forum.xpdfreader.com/viewtopic.php?t=42361; https://forum.xpdfreader.com/viewtopic.php?t=42361
CVE: CVE-2022-45587
Published: 2023-02-15
Description: Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://forum.xpdfreader.com/viewtopic.php?t=42361; https://forum.xpdfreader.com/viewtopic.php?t=42361
CVE: CVE-2023-0102
Published: 2023-02-15
Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE: CVE-2023-0103
Published: 2023-02-15
Description: If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communication buffer, the device stops operating. This could allow an attacker to cause a denial-of-service condition.


CVSS Score: 7.5 (HIGH)
CWE: CWE-788
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE: CVE-2023-0361
Published: 2023-02-15
Description: A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.
CVSS Score: 7.4 (HIGH)
CWE: CWE-203, CWE-203
References: https://access.redhat.com/security/cve/CVE-2023-0361; https://github.com/tlsfuzzer/tlsfuzzer/pull/679; https://gitlab.com/gnutls/gnutls/-/issues/1050
CVE: CVE-2023-22803
Published: 2023-02-15
Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily.


CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE: CVE-2023-22804
Published: 2023-02-15
Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE: CVE-2023-22805
Published: 2023-02-15
Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to remotely set the feature to lock users out of reading data from the device.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE: CVE-2023-22806
Published: 2023-02-15
Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 transmits sensitive information in cleartext when communicating over its XGT protocol. This could allow an attacker to gain sensitive information such as user credentials.


CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE: CVE-2023-22807
Published: 2023-02-15
Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol.  An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE: CVE-2022-38111
Published: 2023-02-15
Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38111; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm
CVE: CVE-2022-47503
Published: 2023-02-15
Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.


CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-47503; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm
CVE: CVE-2022-47504
Published: 2023-02-15
Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.


CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-47504; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm
CVE: CVE-2022-47506
Published: 2023-02-15
Description: SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated account access to edit the default configuration, enabling the execution of arbitrary commands.


CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-47506; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm
CVE: CVE-2022-47507
Published: 2023-02-15
Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.


CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-47507; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm
CVE: CVE-2022-47508
Published: 2023-02-15
Description: Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP address this prevented us from utilizing Kerberos.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://documentation.solarwinds.com/en/success_center/sam/content/release_notes/sam_2023-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-47508; https://documentation.solarwinds.com/en/success_center/sam/content/release_notes/sam_2023-1_release_notes.htm
CVE: CVE-2023-23458
Published: 2023-02-15
Description: Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23459
Published: 2023-02-15
Description: Priority Windows may allow Command Execution via SQL Injection using an unspecified method.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89, CWE-89
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23460
Published: 2023-02-15
Description: Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23461
Published: 2023-02-15
Description: Libpeconv – access violation, before commit b076013 (30/11/2022).
CVSS Score: 9.8 (CRITICAL)
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23462
Published: 2023-02-15
Description: Libpeconv – integer overflow, before commit 75b1565 (30/11/2022).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190, CWE-190
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23463
Published: 2023-02-15
Description: Sunell DVR, latest version, Insufficiently Protected Credentials (CWE-522) may be exposed through an unspecified request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23464
Published: 2023-02-15
Description: Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure.
CVSS Score: 8.1 (HIGH)
CWE: CWE-942
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23465
Published: 2023-02-15
Description: Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-352, CWE-352
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23466
Published: 2023-02-15
Description: Media CP Media Control Panel latest version. Insufficiently protected credential change.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23467
Published: 2023-02-15
Description: Media CP Media Control Panel latest version. Reflected XSS possible through unspecified endpoint.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-23836
Published: 2023-02-15
Description: SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to the SolarWinds Web Console to execute arbitrary commands.


CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23836; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm
CVE: CVE-2023-23847
Published: 2023-02-15
Description: A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 3.5 (LOW)
CWE: CWE-352, CWE-352, CWE-352
References: https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkins-Plugin; https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2793%20%282%29; https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkins-Plugin
CVE: CVE-2023-23848
Published: 2023-02-15
Description: Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-276, CWE-276
References: https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkins-Plugin; https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2793%20%282%29; https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkins-Plugin
CVE: CVE-2023-23850
Published: 2023-02-15
Description: A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-276, CWE-276
References: https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkins-Plugin; https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2793%20%281%29; https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkins-Plugin
CVE: CVE-2023-24498
Published: 2023-02-15
Description: An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the password to the switch in clear text.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-24499
Published: 2023-02-15
Description: Butterfly Button plugin may leave traces of its use on user's device. Since it is used for reporting domestic problems, this may lead to spouse knowing about its use.
CVSS Score: 4.3 (MEDIUM)
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-42455
Published: 2023-02-15
Description: ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiple ASUS software products, contains multiple IOCTL handlers that provide raw read and write access to port I/O and MSRs via unprivileged IOCTL calls. Local users can gain privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0003.md; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0003.md
CVE: CVE-2022-45543
Published: 2023-02-15
Description: Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or username parameters via the audit search.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://srpopty.github.io/2023/02/15/Vulnerability-Discuz-X3.4-Reflected-XSS-%28CVE-2022-45543%29/; https://srpopty.github.io/2023/02/15/Vulnerability-Discuz-X3.4-Reflected-XSS-%28CVE-2022-45543%29/; https://srpopty.github.io/2023/02/15/Vulnerability-Discuz-X3.4-Reflected-XSS-%28CVE-2022-45543%29/
CVE: CVE-2022-45546
Published: 2023-02-15
Description: Information Disclosure in Authentication Component of ScreenCheck BadgeMaker 2.6.2.0 application allows internal attacker to obtain credentials for authentication via network sniffing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://lgnas.gitbook.io/cve-2022-45546/; https://lgnas.gitbook.io/cve-2022-45546/
CVE: CVE-2023-22855
Published: 2023-02-15
Description: Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is handed to a path-concatenation method (Path.Combine from .NET) without proper sanitisation. This yields the possibility of including local files, as well as remote files on SMB shares. If one provides a file with the extension .t4, it is rendered with the .NET templating engine mono/t4, which can execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/171046/Kardex-Mlog-MCC-5.7.12-0-a203c2a213-master-File-Inclusion-Remote-Code-Execution.html; http://packetstormsecurity.com/files/171689/Kardex-Mlog-MCC-5.7.12-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2023/Feb/10
CVE: CVE-2020-19825
Published: 2023-02-15
Description: Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/kevinpapst/kimai2; https://github.com/kevinpapst/kimai2/pull/962/files; https://github.com/kevinpapst/kimai2
CVE: CVE-2020-21119
Published: 2023-02-15
Description: SQL Injection vulnerability in Kliqqi-CMS 2.0.2 in admin/admin_update_module_widgets.php in recordIDValue parameter, allows attackers to gain escalated privileges and execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Kliqqi-CMS/Kliqqi-CMS/issues/259; https://github.com/Kliqqi-CMS/Kliqqi-CMS/issues/259
CVE: CVE-2020-21120
Published: 2023-02-15
Description: SQL Injection vulnerability in file home\controls\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookie_cart parameter to /index.php/cart/num.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html; https://github.com/alixiaowei/cve_test/issues/3; https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
CVE: CVE-2021-33304
Published: 2023-02-15
Description: Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in function pico_fragments_reassemble, allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-415
References: https://github.com/virtualsquare/picotcp/issues/6; https://github.com/virtualsquare/picotcp/issues/6
CVE: CVE-2021-33396
Published: 2023-02-15
Description: Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/baijiacms/baijiacmsV4/issues/7; https://github.com/baijiacms/baijiacmsV4/issues/7
CVE: CVE-2021-33925
Published: 2023-02-15
Description: SQL Injection vulnerability in nitinparashar30 cms-corephp through commit bdabe52ef282846823bda102728a35506d0ec8f9 (May 19, 2021) allows unauthenticated attackers to gain escilated privledges via a crafted login.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/nitinp1232/cms-corephp/issues/1; https://github.com/nitinp1232/cms-corephp/issues/1
CVE: CVE-2021-34117
Published: 2023-02-15
Description: SQL Injection vulnerability in SEO Panel 4.9.0 in api/user.api.php in function getUserName in the username parameter, allows attackers to gain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://gist.github.com/victomteng1997/a0d47d6982a7b382f632ec7e8c3307f1; https://github.com/seopanel/Seo-Panel/issues/219; https://www.seopanel.org/