deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4257
Published: 2023-10-13
Description: Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.
CVSS Score: 7.6 (HIGH)
CWE: CWE-120, CWE-131, CWE-131
References: http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html; http://seclists.org/fulldisclosure/2023/Nov/1; http://www.openwall.com/lists/oss-security/2023/11/07/1
CVE: CVE-2023-45674
Published: 2023-10-14
Description: Farmbot-Web-App is a web control interface for the Farmbot farm automation platform. An SQL injection vulnerability was found in FarmBot's web app that allows authenticated attackers to extract arbitrary data from its database (including the user table). This issue may lead to Information Disclosure. This issue has been patched in version 15.8.4. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89
References: https://github.com/FarmBot/Farmbot-Web-App/security/advisories/GHSA-pgq5-ff74-g7xq; https://github.com/FarmBot/Farmbot-Web-App/security/advisories/GHSA-pgq5-ff74-g7xq
CVE: CVE-2023-45852
Published: 2023-10-14
Description: In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://connectivity.viessmann.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html; https://github.com/Push3AX/vul/blob/main/viessmann/Vitogate300_RCE.md; https://connectivity.viessmann.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html
CVE: CVE-2023-45853
Published: 2023-10-14
Description: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: http://www.openwall.com/lists/oss-security/2023/10/20/9; http://www.openwall.com/lists/oss-security/2024/01/24/10; https://chromium.googlesource.com/chromium/src/+/d709fb[PII_REDACTED]7131027da95ef4c548813356
CVE: CVE-2023-30148
Published: 2023-10-14
Description: Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allows remote authenticated users to inject arbitrary web script or HTML via the body_text or body_text_rude field in /sourcefiles/BlockhtmlClass.php and /sourcefiles/blockhtml.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security.friendsofpresta.org/modules/2023/10/10/opartmultihtmlblock.html; https://security.friendsofpresta.org/modules/2023/10/10/opartmultihtmlblock.html
CVE: CVE-2023-30154
Published: 2023-10-14
Description: Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the 'id_product' parameter in hooks DisplayRightColumnProduct and DisplayProductButtons.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/10/aftermailpresta.html; https://security.friendsofpresta.org/modules/2023/10/10/aftermailpresta.html
CVE: CVE-2023-26155
Published: 2023-10-14
Description: All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the input pdf file path.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78, CWE-77
References: https://github.com/nrhirani/node-qpdf/issues/23; https://security.snyk.io/vuln/SNYK-JS-NODEQPDF-5747918; https://github.com/nrhirani/node-qpdf/issues/23
CVE: CVE-2023-44037
Published: 2023-10-14
Description: An issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows a remote attacker to obtain sensitive information via the TACACS+ server component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://psirt.zpesystems.com/portal/en/kb/articles/security-advisory-zpe-ng-2023-002; https://psirt.zpesystems.com/portal/en/kb/articles/security-advisory-zpe-ng-2023-002
CVE: CVE-2023-45855
Published: 2023-10-14
Description: qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/SunshineOtaku/Report-CVE/blob/main/qdPM/9.2/Directory%20Traversal.md; https://qdpm.net; https://github.com/SunshineOtaku/Report-CVE/blob/main/qdPM/9.2/Directory%20Traversal.md
CVE: CVE-2023-45856
Published: 2023-10-14
Description: qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/SunshineOtaku/Report-CVE/blob/main/qdPM/9.2/RCE.md; https://qdpm.net; https://github.com/SunshineOtaku/Report-CVE/blob/main/qdPM/9.2/RCE.md
CVE: CVE-2023-42663
Published: 2023-10-14
Description: Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.
Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2023/11/12/2; https://github.com/apache/airflow/pull/34315; https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9
CVE: CVE-2023-42780
Published: 2023-10-14
Description: Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors.
Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/apache/airflow/pull/34355; https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d; https://github.com/apache/airflow/pull/34355
CVE: CVE-2023-42792
Published: 2023-10-14
Description: Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't.

Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668, CWE-668
References: http://www.openwall.com/lists/oss-security/2023/12/21/1; https://github.com/apache/airflow/pull/34366; https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq
CVE: CVE-2023-45348
Published: 2023-10-14
Description: Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "non-sensitive-only". The `expose_config` option is False by default.
It is recommended to upgrade to a version that is not affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2023/10/23/2; https://github.com/apache/airflow/pull/34712; https://lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9
CVE: CVE-2023-5578
Published: 2023-10-14
Description: A vulnerability was found in Portábilis i-Educar up to 2.7.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file \intranet\agenda_imprimir.php of the component HTTP GET Request Handler. The manipulation of the argument cod_agenda with the input ");'> <script>alert(document.cookie)</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-242143. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.242143; https://vuldb.com/?id.242143; https://vuldb.com/?ctiid.242143
CVE: CVE-2023-1259
Published: 2023-10-14
Description: The Hotjar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hotjar_site_id in versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/hotjar/tags/1.0.14/includes/class-hotjar.php#L40; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2983524%40hotjar&new=2983524%40hotjar&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9c640bcb-b6bf-4865-b713-32ca846e4ed9?source=cve
CVE: CVE-2023-5579
Published: 2023-10-14
Description: A vulnerability was found in yhz66 Sandbox 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /im/user/ of the component User Data Handler. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-242144.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://github.com/cojoben/Sendbox/blob/main/README.md; https://vuldb.com/?ctiid.242144; https://vuldb.com/?id.242144
CVE: CVE-2023-5580
Published: 2023-10-14
Description: A vulnerability classified as critical has been found in SourceCodester Library System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-242145 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/GodRone/CVE/blob/main/SerBermz_SQL%20injection.md; https://vuldb.com/?ctiid.242145; https://vuldb.com/?id.242145
CVE: CVE-2023-5581
Published: 2023-10-14
Description: A vulnerability classified as problematic was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file index.php. The manipulation of the argument page leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-242146 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/GodRone/MedicineTrackerSystem/blob/main/Medicine%20Tracker%20System_XSS.md; https://vuldb.com/?ctiid.242146; https://vuldb.com/?id.242146
CVE: CVE-2023-5582
Published: 2023-10-14
Description: A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Profile Page. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-242147.
CVSS Score: 3.5 (LOW)
CWE: CWE-80
References: https://github.com/Jacky-Y/vuls/blob/main/vul8.md; https://vuldb.com/?ctiid.242147; https://vuldb.com/?id.242147
CVE: CVE-2022-32755
Published: 2023-10-14
Description: IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  228505.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-91, CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228505; https://www.ibm.com/support/pages/node/7047428; https://exchange.xforce.ibmcloud.com/vulnerabilities/228505
CVE: CVE-2022-33161
Published: 2023-10-14
Description: IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  X-Force ID:  228569.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228569; https://www.ibm.com/support/pages/node/7047116; https://www.ibm.com/support/pages/node/7047428
CVE: CVE-2022-33165
Published: 2023-10-14
Description: IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  228582.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228582; https://www.ibm.com/support/pages/node/7047116; https://www.ibm.com/support/pages/node/7047428
CVE: CVE-2022-43740
Published: 2023-10-14
Description: IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption.  IBM X-Force ID:  238921.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238921; https://www.ibm.com/support/pages/node/7028513; https://exchange.xforce.ibmcloud.com/vulnerabilities/238921
CVE: CVE-2022-43868
Published: 2023-10-14
Description: IBM Security Verify Access OIDC Provider could disclose directory information that could aid attackers in further attacks against the system.  IBM X-Force ID:  239445.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239445; https://www.ibm.com/support/pages/node/7028513; https://exchange.xforce.ibmcloud.com/vulnerabilities/239445
CVE: CVE-2023-35024
Published: 2023-10-14
Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  258349.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/258349; https://www.ibm.com/support/pages/node/7047198; https://exchange.xforce.ibmcloud.com/vulnerabilities/258349
CVE: CVE-2023-45176
Published: 2023-10-14
Description: IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of service for integration nodes on Windows.  IBM X-Force ID:  247998.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267998; https://www.ibm.com/support/pages/node/7051448; https://exchange.xforce.ibmcloud.com/vulnerabilities/267998
CVE: CVE-2023-30994
Published: 2023-10-14
Description: IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  254138
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254138; https://www.ibm.com/support/pages/node/7049133; https://exchange.xforce.ibmcloud.com/vulnerabilities/254138
CVE: CVE-2023-40367
Published: 2023-10-14
Description: IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  263376.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/263376; https://www.ibm.com/support/pages/node/7049133; https://exchange.xforce.ibmcloud.com/vulnerabilities/263376
CVE: CVE-2023-45862
Published: 2023-10-14
Description: An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.5; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce33e64c[PII_REDACTED]b61314b56935abd4bc97ef; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-45863
Published: 2023-10-14
Description: An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-787
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.3; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3bb2a01caa813d3a1845d378bbe4169ef280d394; https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE: CVE-2023-5585
Published: 2023-10-15
Description: A vulnerability was found in SourceCodester Online Motorcycle Rental System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/?page=bike of the component Bike List. The manipulation of the argument Model with the input "><script>confirm (document.cookie)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-242170 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.242170; https://vuldb.com/?id.242170; https://vuldb.com/?ctiid.242170
CVE: CVE-2023-45871
Published: 2023-10-15
Description: An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.3; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bb5ed01cd2428cd25b1c88a3a9cba87055eb289f; https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE: CVE-2023-5586
Published: 2023-10-15
Description: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://github.com/gpac/gpac/commit/ca1b48f0abe71bf81a58995d7d75dc27f5a17ddc; https://huntr.dev/bounties/d2a6ea71-3555-47a6-9b18-35455d103740; https://github.com/gpac/gpac/commit/ca1b48f0abe71bf81a58995d7d75dc27f5a17ddc
CVE: CVE-2023-40378
Published: 2023-10-15
Description: IBM Directory Server for IBM i contains a local privilege escalation vulnerability.  A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system.  IBM X-Force ID:  263584.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/263584; https://www.ibm.com/support/pages/node/7047240; https://exchange.xforce.ibmcloud.com/vulnerabilities/263584
CVE: CVE-2018-25091
Published: 2023-10-15
Description: urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/urllib3/urllib3/commit/adb358f8e06865406d1f05e581a16cbea2136fbc; https://github.com/urllib3/urllib3/compare/1.24.1...1.24.2; https://github.com/urllib3/urllib3/issues/1510
CVE: CVE-2023-38312
Published: 2023-10-15
Description: A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the underlying server via the motdfile console variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/MikeIsAStar/Counter-Strike-Arbitrary-File-Read; https://github.com/MikeIsAStar/Counter-Strike-Arbitrary-File-Read
CVE: CVE-2023-5587
Published: 2023-10-15
Description: A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /vm/admin/doctors.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-242186 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/GodRone/Hospital-Management-System_SQL-injection/blob/main/Hospital%20Management%20System_SQL%20injection.md; https://vuldb.com/?ctiid.242186; https://vuldb.com/?id.242186
CVE: CVE-2023-5588
Published: 2023-10-15
Description: A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/pack.ex. The manipulation of the argument name leads to path traversal. The complexity of an attack is rather high. The exploitability is told to be difficult. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 2c[PII_REDACTED]37a8607cc0d3b7f076a609636f40. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-242187.
CVSS Score: 2.6 (LOW)
CWE: CWE-22
References: https://github.com/kphrx/pleroma/commit/2c[PII_REDACTED]37a8607cc0d3b7f076a609636f40; https://github.com/kphrx/pleroma/pull/197; https://vuldb.com/?ctiid.242187
CVE: CVE-2023-5589
Published: 2023-10-15
Description: A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-242188.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/GodRone/Judging-Management-System_SQL-injection/blob/main/Judging%20Management%20System_SQL%20injection.md; https://vuldb.com/?ctiid.242188; https://vuldb.com/?id.242188
CVE: CVE-2023-5590
Published: 2023-10-15
Description: NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6; https://huntr.dev/bounties/e268cd68-4f34-49bd-878b-82b96dcc0c99; https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6