deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-40530
Published: 2023-08-25
Description: Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android  6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-862
References: https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478; https://jvn.jp/en/jp/JVN03447226/; https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto
CVE: CVE-2023-32755
Published: 2023-08-25
Description: 
e-Excellence U-Office Force generates an error message in webiste service. An unauthenticated remote attacker can obtain partial sensitive system information from error message by sending a crafted command.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.twcert.org.tw/tw/cp-132-7328-d4112-1.html; https://www.twcert.org.tw/tw/cp-132-7328-d4112-1.html
CVE: CVE-2023-41173
Published: 2023-08-25
Description: AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://adguard-dns.io/en/versions.html#2.2; https://adguard-dns.io/en/versions.html#2.2
CVE: CVE-2023-32756
Published: 2023-08-25
Description: 
e-Excellence U-Office Force has a path traversal vulnerability within its file uploading and downloading functions. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary system files, but can’t control system or disrupt service.


CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7329-d8e4c-1.html; https://www.twcert.org.tw/tw/cp-132-7329-d8e4c-1.html
CVE: CVE-2023-32757
Published: 2023-08-25
Description: 
e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.twcert.org.tw/tw/cp-132-7330-94442-1.html; https://www.twcert.org.tw/tw/cp-132-7330-94442-1.html
CVE: CVE-2023-32518
Published: 2023-08-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ono Oogami WP Chinese Conversion plugin <= 1.1.16 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-chinese-conversion/wordpress-wp-chinese-conversion-plugin-1-1-16-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-chinese-conversion/wordpress-wp-chinese-conversion-plugin-1-1-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32576
Published: 2023-08-25
Description: Auth. (subscriber+) Stored Cross-Site Scripting') vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.18 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/locatoraid/wordpress-locatoraid-store-locator-plugin-3-9-18-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/locatoraid/wordpress-locatoraid-store-locator-plugin-3-9-18-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32577
Published: 2023-08-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eji Osigwe DevBuddy Twitter Feed plugin <= 4.0.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/devbuddy-twitter-feed/wordpress-devbuddy-twitter-feed-plugin-4-0-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/devbuddy-twitter-feed/wordpress-devbuddy-twitter-feed-plugin-4-0-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-32584
Published: 2023-08-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in John Newcombe eBecas plugin <= 3.1.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ebecas/wordpress-ebecas-plugin-3-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ebecas/wordpress-ebecas-plugin-3-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32591
Published: 2023-08-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cloud Primero B.V DBargain plugin <= 3.0.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/d-bargain/wordpress-dbargain-plugin-3-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/d-bargain/wordpress-dbargain-plugin-3-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-3406
Published: 2023-08-25
Description: Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server
CVSS Score: 7.7 (HIGH)
CWE: CWE-22, CWE-22
References: https://empower.m-files.com/security-advisories/CVE-2023-3406; https://product.m-files.com/security-advisories/cve-2023-3406/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-3406
CVE: CVE-2023-3425
Published: 2023-08-25
Description: Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://empower.m-files.com/security-advisories/CVE-2023-3425; https://product.m-files.com/security-advisories/cve-2023-3425/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-3425
CVE: CVE-2023-25649
Published: 2023-08-25
Description: 
There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544
CVE: CVE-2023-25981
Published: 2023-08-25
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form plugin <= 2.8.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/buddyforms/wordpress-buddyforms-plugin-2-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/buddyforms/wordpress-buddyforms-plugin-2-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-4478
Published: 2023-08-25
Description: Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-24394
Published: 2023-08-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy iframe popup plugin <= 3.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/iframe-popup/wordpress-iframe-popup-plugin-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/iframe-popup/wordpress-iframe-popup-plugin-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32575
Published: 2023-08-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/product-page-shipping-calculator-for-woocommerce/wordpress-product-page-shipping-calculator-for-woocommerce-plugin-1-3-25-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/product-page-shipping-calculator-for-woocommerce/wordpress-product-page-shipping-calculator-for-woocommerce-plugin-1-3-25-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32595
Published: 2023-08-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/fast-search-powered-by-solr/wordpress-sunny-search-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fast-search-powered-by-solr/wordpress-sunny-search-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32596
Published: 2023-08-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wolfgang Ertl weebotLite plugin <= 1.0.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/weebotlite/wordpress-weebotlite-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/weebotlite/wordpress-weebotlite-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32598
Published: 2023-08-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in A. R. Jones Featured Image Pro Post Grid plugin <= 5.14 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/featured-image-pro/wordpress-featured-image-pro-post-grid-plugin-5-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/featured-image-pro/wordpress-featured-image-pro-post-grid-plugin-5-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32603
Published: 2023-08-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy – Smart Donations plugin <= 4.0.12 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/smart-donations/wordpress-donations-made-easy-smart-donations-plugin-4-0-12-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smart-donations/wordpress-donations-made-easy-smart-donations-plugin-4-0-12-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32797
Published: 2023-08-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution video carousel slider with lightbox plugin <= 1.0.22 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-responsive-video-gallery-with-lightbox/wordpress-video-carousel-slider-with-lightbox-plugin-1-0-22-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-responsive-video-gallery-with-lightbox/wordpress-video-carousel-slider-with-lightbox-plugin-1-0-22-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41248
Published: 2023-08-25
Description: In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-41249
Published: 2023-08-25
Description: In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-41250
Published: 2023-08-25
Description: In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-39742
Published: 2023-08-25
Description: giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://gist.github.com/huanglei3/ec9090096aa92445cf0a8baa8e929084; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O4RLSFGPBPR3FMIUJCWPGVIYIU35YGQX/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPNBOB65TEA4ZEPLVENI26BY4LEX7TEF/
CVE: CVE-2023-41167
Published: 2023-08-25
Description: @webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the editor.js rich text editor to handle rich text content. The CMS stores rich text content from the editor.js into the database. When the @webiny/react-rich-text-renderer is used to render such content, it uses the dangerouslySetInnerHTML prop, without applying HTML sanitization. The issue arises when an actor, who in this context would specifically be a content manager with access to the CMS, inserts a malicious script as part of the user-defined input. This script is then injected and executed within the user's browser when the main page or admin page loads.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/webiny/webiny-js/security/advisories/GHSA-3x59-vrmc-5mx6; https://webiny.com; https://github.com/webiny/webiny-js/security/advisories/GHSA-3x59-vrmc-5mx6
CVE: CVE-2022-4452
Published: 2023-08-25
Description: Insufficient data validation in crosvm in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
References: https://bugs.chromium.org/p/chromium/issues/detail?id=1372457; https://crbug.com/1372457; https://bugs.chromium.org/p/chromium/issues/detail?id=1372457
CVE: CVE-2023-40799
Published: 2023-08-25
Description: Tenda AC23 Vv16.03.07.45_cn is vulnerable to Buffer Overflow via sub_450A4C function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/lst-oss/Vulnerability/blob/main/Tenda/AC23/sub_450A4C; https://github.com/lst-oss/Vulnerability/blob/main/Tenda/AC23/sub_450A4C
CVE: CVE-2023-40800
Published: 2023-08-25
Description: The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/compare_parentcontrol_time; https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/compare_parentcontrol_time
CVE: CVE-2023-40801
Published: 2023-08-25
Description: The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/sub_451784; https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/sub_451784
CVE: CVE-2023-40802
Published: 2023-08-25
Description: The get_parentControl_list_Info function does not verify the parameters entered by the user, causing a post-authentication heap overflow vulnerability in Tenda AC23 v16.03.07.45_cn
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/get_parentControl_list_Info; https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/get_parentControl_list_Info
CVE: CVE-2023-40915
Published: 2023-08-25
Description: Tenda AX3 v16.03.12.11 has a stack buffer overflow vulnerability detected at function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ssid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/Korey0sh1/IoT_vuln/blob/main/Tenda/AX3/form_fast_setting_wifi_set.md; https://github.com/Korey0sh1/IoT_vuln/blob/main/Tenda/AX3/form_fast_setting_wifi_set.md
CVE: CVE-2023-4534
Published: 2023-08-25
Description: A vulnerability, which was classified as problematic, was found in NeoMind Fusion Platform up to 20230731. Affected is an unknown function of the file /fusion/portal/action/Link. The manipulation of the argument link leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238026 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://l6x.notion.site/PoC-9f23bb9757374f82981de81604500d98?pvs=4; https://vuldb.com/?ctiid.238026; https://vuldb.com/?id.238026
CVE: CVE-2020-11711
Published: 2023-08-25
Description: An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possible to inject malicious HTML content in order to execute JavaScript inside a victim's browser. This results in a stored XSS on the authentication interface of the admin panel. Moreover, an unsecured authentication form is present on the authentication interface of the SSL VPN captive portal. Users are allowed to save their credentials inside the browser. If an administrator saves his credentials through this unsecured form, these credentials could be stolen via the stored XSS on the admin panel without user interaction. Another possible exploitation would be modification of the authentication form of the admin panel into a malicious form.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://advisories.stormshield.eu/2020-011/; https://twitter.com/_ACKNAK_; https://www.digitemis.com/category/blog/actualite/
CVE: CVE-2023-40796
Published: 2023-08-25
Description: Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://github.com/lst-oss/Vulnerability/tree/main/Phicomm/k2; https://github.com/lst-oss/Vulnerability/tree/main/Phicomm/k2
CVE: CVE-2023-40797
Published: 2023-08-25
Description: In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authentication stack overflow vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/sub_4781A4; https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/sub_4781A4
CVE: CVE-2023-40798
Published: 2023-08-25
Description: In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/formSetIPv6status-formGetWanParameter; https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/formSetIPv6status-formGetWanParameter
CVE: CVE-2023-38201
Published: 2023-08-25
Description: A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://access.redhat.com/errata/RHSA-2023:5080; https://access.redhat.com/security/cve/CVE-2023-38201; https://bugzilla.redhat.com/show_bug.cgi?id=2222693
CVE: CVE-2019-13689
Published: 2023-08-25
Description: Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Critical)
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://bugs.chromium.org/p/chromium/issues/detail?id=960109; https://crbug.com/960109; https://bugs.chromium.org/p/chromium/issues/detail?id=960109
CVE: CVE-2019-13690
Published: 2023-08-25
Description: Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://bugs.chromium.org/p/chromium/issues/detail?id=960111; https://crbug.com/960111; https://bugs.chromium.org/p/chromium/issues/detail?id=960111
CVE: CVE-2023-25848
Published: 2023-08-25
Description: ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. 

The information disclosed is limited to a single attribute in a database connection string. No business data is disclosed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-map-and-feature-service-security-2023-update-1-patch/; https://www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-map-and-feature-service-security-2023-update-1-patch/
CVE: CVE-2021-27932
Published: 2023-08-25
Description: Stormshield Network Security (SNS) VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions.
CVSS Score: 7.8 (HIGH)
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2021-004/; https://advisories.stormshield.eu
CVE: CVE-2023-24620
Published: 2023-08-25
Description: An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://contrastsecurity.com; https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.md; https://github.com/EsotericSoftware
CVE: CVE-2023-24621
Published: 2023-08-25
Description: An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://contrastsecurity.com; https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.md; https://github.com/EsotericSoftware
CVE: CVE-2023-36198
Published: 2023-08-25
Description: Buffer Overflow vulnerability in skalenetwork sgxwallet v.1.9.0 allows an attacker to cause a denial of service via the trustedBlsSignMessage function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/skalenetwork/sgxwallet/issues/419; https://github.com/skalenetwork/sgxwallet/issues/419
CVE: CVE-2023-36199
Published: 2023-08-25
Description: An issue in skalenetwork sgxwallet v.1.9.0 and below allows an attacker to cause a denial of service via the trustedGenerateEcdsaKey component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/skalenetwork/sgxwallet/issues/419; https://github.com/skalenetwork/sgxwallet/issues/419