deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-33015
Published: 2023-09-05
Description: Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin
CVE: CVE-2023-33016
Published: 2023-09-05
Description: Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin
CVE: CVE-2023-33019
Published: 2023-09-05
Description: Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin
CVE: CVE-2023-33020
Published: 2023-09-05
Description: Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin
CVE: CVE-2023-33021
Published: 2023-09-05
Description: Memory corruption in Graphics while processing user packets for command submission.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin
CVE: CVE-2023-41908
Published: 2023-09-05
Description: Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/cerebrate-project/cerebrate/commit/9be[PII_REDACTED]9658243b5aa274b175064bfc6db; https://github.com/cerebrate-project/cerebrate/compare/v1.14...v1.15; https://github.com/cerebrate-project/cerebrate/commit/9be[PII_REDACTED]9658243b5aa274b175064bfc6db
CVE: CVE-2023-41909
Published: 2023-09-05
Description: An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/FRRouting/frr/pull/13222/commits/cfd04dcb3e689754a72507d086ba3b9709fc5ed8; https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/
CVE: CVE-2023-41910
Published: 2023-09-05
Description: An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/lldpd/lldpd/commit/a9aeabdf879c25c584852a0bb[PII_REDACTED]f099b; https://github.com/lldpd/lldpd/releases/tag/1.0.17; https://lists.debian.org/debian-lts-announce/2023/09/msg00025.html
CVE: CVE-2023-4540
Published: 2023-09-05
Description: Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service (DoS) attack to be executed by sending a properly crafted request to the server. 
Such a request causes the program to enter an infinite loop. 

This issue affects lua-http: all versions before commit ddab283.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://cert.pl/en/posts/2023/09/CVE-2023-4540/; https://cert.pl/posts/2023/09/CVE-2023-4540/; https://github.com/daurnimator/lua-http/commit/ddab2835c583d45dec62680ca8d3cbde55e0bae6
CVE: CVE-2023-38574
Published: 2023-09-05
Description: Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf; https://jvn.jp/en/jp/JVN60140221/; https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf
CVE: CVE-2023-39448
Published: 2023-09-05
Description: Path traversal vulnerability in SHIRASAGI prior to v1.18.0  allows a remote authenticated attacker to alter or create arbitrary files on the server, resulting in arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN82758000/; https://www.ss-proj.org/support/954.html; https://jvn.jp/en/jp/JVN82758000/
CVE: CVE-2023-39938
Published: 2023-09-05
Description: Reflected cross-site scripting vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to inject an arbitrary script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf; https://jvn.jp/en/jp/JVN60140221/; https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf
CVE: CVE-2023-40535
Published: 2023-09-05
Description: Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf; https://jvn.jp/en/jp/JVN60140221/; https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf
CVE: CVE-2023-40705
Published: 2023-09-05
Description: Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf; https://jvn.jp/en/jp/JVN60140221/; https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf
CVE: CVE-2023-36492
Published: 2023-09-05
Description: Reflected cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN82758000/; https://www.ss-proj.org/support/954.html; https://jvn.jp/en/jp/JVN82758000/
CVE: CVE-2023-38569
Published: 2023-09-05
Description: Stored cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN82758000/; https://www.ss-proj.org/support/954.html; https://jvn.jp/en/jp/JVN82758000/
CVE: CVE-2023-20897
Published: 2023-09-05
Description: Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL/; https://saltproject.io/security-announcements/2023-08-10-advisory/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL/
CVE: CVE-2023-20898
Published: 2023-09-05
Description: Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.
CVSS Score: 4.2 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL/; https://saltproject.io/security-announcements/2023-08-10-advisory/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL/
CVE: CVE-2022-41763
Published: 2023-09-05
Description: An issue was discovered in NOKIA AMS 9.7.05. Remote Code Execution exists via the debugger of the ipAddress variable. A remote user, authenticated to the AMS server, could inject code in the PING function. The privileges of the command executed depend on the user that runs the service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2023-2453
Published: 2023-09-05
Description: There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known means in PHPFusion through which an attacker can upload and target a ‘.php’ file payload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829, CWE-829
References: https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-advisory-cve-2023-2453/; https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-advisory-cve-2023-2453/
CVE: CVE-2023-32086
Published: 2023-09-05
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-40743
Published: 2023-09-05
Description: ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.

As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from  https://github.com/apache/axis-axis1-java/commit/7e[PII_REDACTED]6590d6def0125e448d[PII_REDACTED] . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-75
References: https://github.com/apache/axis-axis1-java/commit/7e[PII_REDACTED]6590d6def0125e448d[PII_REDACTED]; https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82; https://lists.debian.org/debian-lts-announce/2023/10/msg00025.html
CVE: CVE-2023-4480
Published: 2023-09-05
Description: 
Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation. 


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-538, CWE-22
References: https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-advisory-cve-2023-2453/; https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-advisory-cve-2023-2453/
CVE: CVE-2023-36361
Published: 2023-09-05
Description: Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://audimex.com; http://audimexee.com; https://gist.github.com/Cameleon037/40b3b6f6729d1d0984d6ce5b6837c46b
CVE: CVE-2023-41012
Published: 2023-09-05
Description: An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the authentication mechanism.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: https://github.com/te5tb99/For-submitting/wiki/Command-Execution-Vulnerability-in-China-Mobile-Intelligent-Home-Gateway-HG6543C4-Identity-verification-has-design-flaws; https://github.com/te5tb99/For-submitting/wiki/Command-Execution-Vulnerability-in-China-Mobile-Intelligent-Home-Gateway-HG6543C4-Identity-verification-has-design-flaws
CVE: CVE-2023-41107
Published: 2023-09-05
Description: TEF portal 2023-07-17 is vulnerable to a persistent cross site scripting (XSS)attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-020.txt; https://www.syss.de/pentest-blog/sicherheitsschwachstellen-im-tef-haendlerportal-syss-2023-020/-021; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-020.txt
CVE: CVE-2023-41108
Published: 2023-09-05
Description: TEF portal 2023-07-17 is vulnerable to authenticated remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-021.txt; https://www.syss.de/pentest-blog/sicherheitsschwachstellen-im-tef-haendlerportal-syss-2023-020/-021; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-021.txt
CVE: CVE-2023-4778
Published: 2023-09-05
Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/gpac/gpac/commit/d553698050af478049e1a09e44a15ac884f223ed; https://huntr.dev/bounties/abb450fb-4ab2-49b0-90da-3d878eea5397; https://github.com/gpac/gpac/commit/d553698050af478049e1a09e44a15ac884f223ed
CVE: CVE-2023-31242
Published: 2023-09-05
Description: An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-287
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1769; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1769; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1769
CVE: CVE-2023-32271
Published: 2023-09-05
Description: An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to a disclosure of sensitive information. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1774; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1774; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1774
CVE: CVE-2023-32615
Published: 2023-09-05
Description: A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73, CWE-610
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1771; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1771; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1771
CVE: CVE-2023-34317
Published: 2023-09-05
Description: An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to unexpected data in the configuration. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1772; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1772; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1772
CVE: CVE-2023-34353
Published: 2023-09-05
Description: An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted network sniffing can lead to decryption of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1776; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1776; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1776
CVE: CVE-2023-34994
Published: 2023-09-05
Description: An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to creation of an arbitrary directory. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-770
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1773; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1773; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1773
CVE: CVE-2023-34998
Published: 2023-09-05
Description: An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary authentication. An attacker can sniff network traffic to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319, CWE-287
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1770; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1770; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1770
CVE: CVE-2023-35124
Published: 2023-09-05
Description: An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to a disclosure of sensitive information. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-209
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1775; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1775; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1775
CVE: CVE-2023-3374
Published: 2023-09-05
Description: Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation.This issue affects Bookreen: before 3.0.0.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-184
References: https://www.usom.gov.tr/bildirim/tr-23-0489; https://www.usom.gov.tr/bildirim/tr-23-0489
CVE: CVE-2023-3375
Published: 2023-09-05
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection.This issue affects Bookreen: before 3.0.0.


CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.usom.gov.tr/bildirim/tr-23-0489; https://www.usom.gov.tr/bildirim/tr-23-0489
CVE: CVE-2015-1390
Published: 2023-09-05
Description: Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt
CVE: CVE-2015-1391
Published: 2023-09-05
Description: Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt
CVE: CVE-2015-2201
Published: 2023-09-05
Description: Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt
CVE: CVE-2015-2202
Published: 2023-09-05
Description: Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt
CVE: CVE-2017-9453
Published: 2023-09-05
Description: BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-863
References: https://docs.bmc.com/docs/serverautomation/2002/notification-of-critical-security-issue-in-bmc-server-automation-cve-2017-9[PII_REDACTED]453.html; https://docs.bmc.com/docs/serverautomation/2002/notification-of-critical-security-issue-in-bmc-server-automation-cve-2017-9[PII_REDACTED]453.html
CVE: CVE-2023-35065
Published: 2023-09-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection.This issue affects Paint Production Management: before 2.1.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0490; https://www.usom.gov.tr/bildirim/tr-23-0490
CVE: CVE-2023-35068
Published: 2023-09-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection.This issue affects Personnel Tracking System: before 20230904.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0491; https://www.usom.gov.tr/bildirim/tr-23-0491
CVE: CVE-2023-35072
Published: 2023-09-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Coyav Travel Proagent allows SQL Injection.This issue affects Proagent: before 20230904 .


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0492; https://www.usom.gov.tr/bildirim/tr-23-0492
CVE: CVE-2023-39598
Published: 2023-09-05
Description: Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitrary code via a crafted payload to the mid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40muthumohanprasath.r/reflected-cross-site-scripting-on-icewarp-webclient-product-cve-2023-39598-9598b92da49c; https://medium.com/%40muthumohanprasath.r/reflected-cross-site-scripting-on-icewarp-webclient-product-cve-2023-39598-9598b92da49c
CVE: CVE-2023-39681
Published: 2023-09-05
Description: Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php. This vulnerability is triggered via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/yanbochen97/CuppaCMS_RCE; https://github.com/yanbochen97/CuppaCMS_RCE
CVE: CVE-2023-3616
Published: 2023-09-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mava Software Hotel Management System allows SQL Injection.This issue affects Hotel Management System: before 2.0.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0493; https://www.usom.gov.tr/bildirim/tr-23-0493