deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-0595
Published: 2023-02-24
Description: A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server's database web port (default 443). Affected products: EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2021(All Versions prior to October 2022), ClearSCADA (All Versions)


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-117, CWE-116
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-01.pdf
CVE: CVE-2023-1007
Published: 2023-02-24
Description: A vulnerability was found in Twister Antivirus 8.17. It has been declared as critical. This vulnerability affects the function 0x801120E4 in the library filmfd.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221740.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://drive.google.com/file/d/1wh20g2Ze4gwCtripe7QeHNXd3bS4aZNG/view?usp=sharing; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1007; https://vuldb.com/?ctiid.221740
CVE: CVE-2023-1008
Published: 2023-02-24
Description: A vulnerability was found in Twister Antivirus 8.17. It has been rated as problematic. This issue affects the function 0x801120E4 in the library filmfd.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-221741 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://drive.google.com/file/d/1fdQWJ1uvXELnXnDm2Jk81bA0fwwqQCpY/view?usp=sharing; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1008; https://vuldb.com/?ctiid.221741
CVE: CVE-2023-1009
Published: 2023-02-24
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub_1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input /../etc/passwd- leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221742 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/xxy1126/Vuln/blob/main/Draytek/1.md; https://vuldb.com/?ctiid.221742; https://vuldb.com/?id.221742
CVE: CVE-2023-1010
Published: 2023-02-24
Description: A vulnerability classified as critical was found in vox2png 1.0. Affected by this vulnerability is an unknown functionality of the file vox2png.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221743.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-122
References: https://github.com/10cksYiqiyinHangzhouTechnology/vox2png/blob/main/README.md; https://vuldb.com/?ctiid.221743; https://vuldb.com/?id.221743
CVE: CVE-2021-4105
Published: 2023-02-24
Description: Improper Handling of Parameters vulnerability in BG-TEK COSLAT Firewall allows Remote Code Inclusion.This issue affects COSLAT Firewall: from 5.24.0.R.20180630 before 5.24.0.R.20210727.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755
References: http://blog.coslat.com/2021/07/onemli-kritik-guncelleme-2021-07-27.html; https://www.usom.gov.tr/bildirim/tr-23-0108; http://blog.coslat.com/2021/07/onemli-kritik-guncelleme-2021-07-27.html
CVE: CVE-2023-25691
Published: 2023-02-24
Description: Improper Input Validation vulnerability in the Apache Airflow Google Provider.

This issue affects Apache Airflow Google Provider versions before 8.10.0.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://github.com/apache/airflow/pull/29497; https://lists.apache.org/thread/zdr8ovfttbh7kj0lydgcw88tbt2nmkcy; https://github.com/apache/airflow/pull/29497
CVE: CVE-2023-25692
Published: 2023-02-24
Description: Improper Input Validation vulnerability in the Apache Airflow Google Provider.

This issue affects Apache Airflow Google Provider versions before 8.10.0.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/apache/airflow/pull/29499; https://lists.apache.org/thread/ks4l78l5rwdpmvfn7y7yhs179nyxtlsh; https://github.com/apache/airflow/pull/29499
CVE: CVE-2023-25693
Published: 2023-02-24
Description: Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.

This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/apache/airflow/pull/29500; https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4; https://github.com/apache/airflow/pull/29500
CVE: CVE-2023-25696
Published: 2023-02-24
Description: Improper Input Validation vulnerability in the Apache Airflow Hive Provider.

This issue affects Apache Airflow Hive Provider versions before 5.1.3.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://github.com/apache/airflow/pull/29502; https://lists.apache.org/thread/99g0qm56wmgdxmbtdsvhj4rdnxhpzpml; https://github.com/apache/airflow/pull/29502
CVE: CVE-2023-25956
Published: 2023-02-24
Description: Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.

This issue affects Apache Airflow AWS Provider versions before 7.2.1.


CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://github.com/apache/airflow/pull/29587; https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv; https://github.com/apache/airflow/pull/29587
CVE: CVE-2022-43923
Published: 2023-02-24
Description: IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local user.  IBM X-Force ID:  241584.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/241584; https://www.ibm.com/support/pages/node/6957654; https://exchange.xforce.ibmcloud.com/vulnerabilities/241584
CVE: CVE-2022-4203
Published: 2023-02-24
Description: A read buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer.

The read buffer overrun might result in a crash which could lead to
a denial of service attack. In theory it could also result in the disclosure
of private memory contents (such as private keys, or sensitive plaintext)
although we are not aware of any working exploit leading to memory
contents disclosure as of the time of release of this advisory.

In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client authentication and a malicious client connects.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c927a3492698c254637da836762f9b1f86cffabc; https://security.gentoo.org/glsa/202402-08; https://www.openssl.org/news/secadv/20230207.txt
CVE: CVE-2023-0585
Published: 2023-02-24
Description: The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L624; https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L625; https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L665
CVE: CVE-2023-0586
Published: 2023-02-24
Description: The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Admin/PostSettings.php?v=2829340#L202; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2859011%40all-in-one-seo-pack%2Ftrunk&old=2847431%40all-in-one-seo-pack%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/blog/2023/02/all-in-one-seo-pack-vulnerabilities-impacting-3-million-sites-patched/
CVE: CVE-2021-33224
Published: 2023-02-24
Description: File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://umbraco.com; https://our.umbraco.com/packages/developer-tools/umbraco-forms; http://umbraco.com
CVE: CVE-2021-33387
Published: 2023-02-24
Description: Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/bg5sbk/MiniCMS/issues/40; https://github.com/bg5sbk/MiniCMS/issues/40
CVE: CVE-2021-34064
Published: 2023-02-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-33563. Reason: This candidate is a duplicate of CVE-2021-33563. Notes: All CVE users should reference CVE-2021-33563 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2021-35369
Published: 2023-02-24
Description: Arbitrary File Read vulnerability found in Peacexie ImCat v.5.2 fixed in v.5.4 allows attackers to obtain sensitive information via the filtering_get_contents function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/peacexie/imcat/issues/7; https://github.com/peacexie/imcat/issues/7
CVE: CVE-2021-35370
Published: 2023-02-24
Description: An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/peacexie/imcat/issues/8; https://github.com/peacexie/imcat/issues/8
CVE: CVE-2023-23205
Published: 2023-02-24
Description: An issue was discovered in lib60870 v2.3.2. There is a memory leak in lib60870/lib60870-C/examples/multi_client_server/multi_client_server.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/mz-automation/lib60870/issues/132; https://github.com/mz-automation/lib60870/issues/132
CVE: CVE-2023-0481
Published: 2023-02-24
Description: In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.
CVSS Score: 3.3 (LOW)
CWE: CWE-378, CWE-668
References: https://github.com/quarkusio/quarkus/pull/30694; https://github.com/quarkusio/quarkus/pull/30694
CVE: CVE-2022-44310
Published: 2023-02-24
Description: In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668, CWE-668
References: https://github.com/developmentil/ecdh/issues/3; https://github.com/developmentil/ecdh/issues/3
CVE: CVE-2023-1029
Published: 2023-02-24
Description: The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the regenerateSitemaps function. This makes it possible for unauthenticated attackers to regenerate Sitemaps via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/2870465/wp-meta-seo/trunk?contextall=1&old=2869205&old_path=%2Fwp-meta-seo%2Ftrunk#file2; https://www.wordfence.com/threat-intel/vulnerabilities/id/764aec73-f291-4372-9dde-812ffaf025ed?source=cve; https://plugins.trac.wordpress.org/changeset/2870465/wp-meta-seo/trunk?contextall=1&old=2869205&old_path=%2Fwp-meta-seo%2Ftrunk#file2
CVE: CVE-2023-1030
Published: 2023-02-24
Description: A vulnerability has been found in SourceCodester/code-projects Online Boat Reservation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /boat/login.php of the component POST Parameter Handler. The manipulation of the argument un leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/jidle123/bug_report/blob/main/vendors/winex01/Online%20Boat%20Reservation%20System/XSS-1.md#online-boat-reservation-system-v10-by-winex01-has-cross-site-scripting-reflected; https://vuldb.com/?ctiid.221755; https://vuldb.com/?id.221755
CVE: CVE-2021-34167
Published: 2023-02-24
Description: Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/taogogo/taocms/issues/6; https://github.com/taogogo/taocms/issues/6
CVE: CVE-2021-34248
Published: 2023-02-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-25905. Reason: This candidate is a duplicate of CVE-2020-25905. Notes: All CVE users should reference CVE-2020-25905 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2021-34249
Published: 2023-02-24
Description: SQL injection vulnerability in sourcecodester online-book-store 1.0 allows remote attackers to view sensitive information via the id paremeter in application URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://packetstormsecurity.com/files/159000/Online-Book-Store-1.0-SQL-Injection.html; https://www.exploit-db.com/exploits/48775; https://packetstormsecurity.com/files/159000/Online-Book-Store-1.0-SQL-Injection.html
CVE: CVE-2021-35290
Published: 2023-02-24
Description: File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/anibalgomezprojects/balerocms-src/issues/2; https://github.com/anibalgomezprojects/balerocms-src/issues/2
CVE: CVE-2023-24189
Published: 2023-02-24
Description: An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://github.com/Venus-WQLab/bug_report/blob/main/ureport/ureport-cve-2023-24189.md; https://github.com/youseries/urule; https://github.com/Venus-WQLab/bug_report/blob/main/ureport/ureport-cve-2023-24189.md
CVE: CVE-2022-23535
Published: 2023-02-24
Description: LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a special field in JSON documents to cast different types from `BsonDocument` to POCO classes. When instances of an object are not the same of class, `BsonMapper` use a special field `_type` string info with full class name with assembly to be loaded and fit into your model. If your end-user can send to your app a plain JSON string, deserialization can load an unsafe  object to fit into your model. This issue is patched in version 5.0.13 with some basic fixes to avoid this, but is not 100% guaranteed when using `Object` type. The next major version will contain an allow-list to select what kind of Assembly can be loaded. Workarounds are detailed in the vendor advisory.
CVSS Score: 7.3 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f; https://github.com/mbdavid/LiteDB/security/advisories/GHSA-3x49-g6rc-c284; https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f
CVE: CVE-2023-25816
Published: 2023-02-25
Description: Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can configure a very long password, consuming more resources on password validation than desired. This issue is patched in 25.0.3 No workaround is available.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-53q2-cm29-7j83; https://github.com/nextcloud/server/pull/35965; https://hackerone.com/reports/1820864
CVE: CVE-2023-25821
Published: 2023-02-25
Description: Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. This issue is patched in versions 24.0.7 and 25.0.1. No workaround  is available.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7w6h-5qgw-4j94; https://github.com/nextcloud/server/pull/34502; https://hackerone.com/reports/1724016
CVE: CVE-2023-26033
Published: 2023-02-25
Description: Gentoo soko is the code that powers packages.gentoo.org. Versions prior to 1.0.1 are vulnerable to SQL Injection, leading to a Denial of Service. If the user selects (in user preferences) the "Recently Visited Packages" view for the index page, the value of the `search_history` cookie is used as a base64 encoded comma separated list of atoms. These are string loaded directly into the SQL query with `atom = '%s'` format string. As a result, any user can modify the browser's cookie value and inject most SQL queries. A proof of concept malformed cookie was generated that wiped the database or changed it's content. On the database, only public data is stored, so there is no confidentiality issues to site users. If it is known that the database was modified, a full restoration of data is possible by performing a full database wipe and performing full update of all components. This issue is patched with commit id 5ae9ca83b73. Version 1.0.1 contains the patch. If users are unable to upgrade immediately, the following workarounds may be applied: (1.) Use a proxy to always drop the `search_history` cookie until upgraded. The impact on user experience is low. (2.) Sanitize to the value of `search_history` cookie after base64 decoding it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/gentoo/soko/security/advisories/GHSA-gp8g-jfq9-5q2g; https://gitweb.gentoo.org/sites/soko.git/commit/?id=5ae9ca83b735804f2bd405592983a73d7fcc42f4; https://github.com/gentoo/soko/security/advisories/GHSA-gp8g-jfq9-5q2g
CVE: CVE-2023-1033
Published: 2023-02-25
Description: Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/froxlor/froxlor/commit/4003a8d2b60728a77476d1d4f5aa5c635f128950; https://huntr.dev/bounties/ba3cd929-8b60-4d8d-b77d-f28409ecf387; https://github.com/froxlor/froxlor/commit/4003a8d2b60728a77476d1d4f5aa5c635f128950
CVE: CVE-2023-25825
Published: 2023-02-25
Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field.  This is unescaped when viewing the logs in the web ui. This issue is patched in version 1.36.33. 
CVSS Score: 7.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/ZoneMinder/zoneminder/commit/4637eaf9ea530193e0897ec48899f5638bdd6d81; https://github.com/ZoneMinder/zoneminder/commit/57bf25d39f12d620693f26068b8441b4f3f0b6c0; https://github.com/ZoneMinder/zoneminder/commit/e1028c1d7f23cc1e0941b7b37bb6ae5a04364308
CVE: CVE-2023-26032
Published: 2023-02-25
Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL query to load the user.  If an attacker could determine the HASH key used by ZoneMinder, they could generate a malicious JWT token and use it to execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.
CVSS Score: 8.9 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-6c72-q9mw-mwx9; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-6c72-q9mw-mwx9
CVE: CVE-2023-26034
Published: 2023-02-25
Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are affected by a SQL Injection vulnerability. The (blind) SQL Injection vulnerability is present within the `filter[Query][terms][0][attr]` query string parameter of the  `/zm/index.php` endpoint. A user with the View or Edit permissions of Events may execute arbitrary SQL. The resulting impact can include unauthorized data access (and modification), authentication and/or authorization bypass, and remote code execution.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-222j-wh8m-xjrx; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-222j-wh8m-xjrx
CVE: CVE-2023-1034
Published: 2023-02-25
Description: Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-29
References: https://github.com/salesagility/suitecrm/commit/c19f221a41706efc8d73cef95c5e362c4f86bf06; https://huntr.dev/bounties/0c1365bc-8d9a-4ae0-8b55-615d492b3730; https://github.com/salesagility/suitecrm/commit/c19f221a41706efc8d73cef95c5e362c4f86bf06