deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4985
Published: 2023-09-15
Description: A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901. Affected is an unknown function of the file Project.xml. The manipulation leads to improper authentication. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239796. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: https://drive.google.com/file/d/1V_O95QddCGdZzYGgx7tkMOYQ5i_alv69/view?usp=drive_link; https://vuldb.com/?ctiid.239796; https://vuldb.com/?id.239796
CVE: CVE-2023-4986
Published: 2023-09-15
Description: A vulnerability classified as problematic was found in Supcon InPlant SCADA up to 20230901. Affected by this vulnerability is an unknown functionality of the file Project.xml. The manipulation leads to password hash with insufficient computational effort. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-239797 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.5 (LOW)
CWE: CWE-916
References: https://drive.google.com/file/d/1V_O95QddCGdZzYGgx7tkMOYQ5i_alv69/view?usp=drive_link; https://vuldb.com/?ctiid.239797; https://vuldb.com/?id.239797
CVE: CVE-2023-4987
Published: 2023-09-15
Description: A vulnerability, which was classified as critical, has been found in infinitietech taskhub 2.8.7. Affected by this issue is some unknown functionality of the file /home/get_tasks_list of the component GET Parameter Handler. The manipulation of the argument project/status/user_id/sort/search leads to sql injection. VDB-239798 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/174760/Taskhub-2.8.7-SQL-Injection.html; https://vuldb.com/?ctiid.239798; https://vuldb.com/?id.239798
CVE: CVE-2022-38636
Published: 2023-09-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-47848
Published: 2023-09-15
Description: An issue was discovered in Bezeq Vtech NB403-IL version BZ_2.02.07.09.13.01 and Vtech IAD604-IL versions BZ_2.02.07.09.13.01, BZ_2.02.07.09.13T, and BZ_2.02.07.09.09T, allows remote attackers to gain sensitive information via rootDesc.xml page of the UPnP service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://00xbyte.github.io/posts/bezeq-router-auth-bypass/; https://00xbyte.github.io/posts/bezeq-router-auth-bypass/
CVE: CVE-2023-4988
Published: 2023-09-15
Description: A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?module=system&action=uploadImg. The manipulation of the argument imgFile leads to unrestricted upload. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-239799.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://vuldb.com/?ctiid.239799; https://vuldb.com/?id.239799; https://vuldb.com/?ctiid.239799
CVE: CVE-2023-4991
Published: 2023-09-15
Description: A vulnerability was found in NextBX QWAlerter 4.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file QWAlerter.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. The identifier of this vulnerability is VDB-239804. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://vuldb.com/?ctiid.239804; https://vuldb.com/?id.239804; https://vuldb.com/?ctiid.239804
CVE: CVE-2023-28614
Published: 2023-09-15
Description: Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0012.md; https://www.freewillsolutions.com/smart-trade-ifis; https://www.kb.cert.org/vuls/id/947701
CVE: CVE-2023-42398
Published: 2023-09-15
Description: An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/laterfuture/php-audit/blob/main/CVE-2023-42398%E2%80%94%E2%80%94ZZCMS2023%20SSRF; https://github.com/laterfuture/php-audit/blob/main/CVE-2023-42398%E2%80%94%E2%80%94ZZCMS2023%20SSRF
CVE: CVE-2023-36472
Published: 2023-09-15
Description: Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/strapi/strapi/releases/tag/v4.11.7; https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4; https://github.com/strapi/strapi/releases/tag/v4.11.7
CVE: CVE-2023-36479
Published: 2023-09-15
Description: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
CVSS Score: 3.5 (LOW)
CWE: CWE-149
References: https://github.com/eclipse/jetty.project/pull/9516; https://github.com/eclipse/jetty.project/pull/9888; https://github.com/eclipse/jetty.project/pull/9889
CVE: CVE-2023-37263
Published: 2023-09-15
Description: Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible. Version 4.12.1 has a fix for this issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-400
References: https://github.com/strapi/strapi/releases/tag/v4.12.1; https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc; https://github.com/strapi/strapi/releases/tag/v4.12.1
CVE: CVE-2023-37281
Published: 2023-09-15
Description: Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when processing the various IPv6 header fields during IPHC header decompression, Contiki-NG confirms the received packet buffer contains enough data as needed for that field. But no similar check is done before decompressing the IPv6 address. Therefore, up to 16 bytes can be read out of bounds on the line with the statement `memcpy(&ipaddr->u8[16 - postcount], iphc_ptr, postcount);`. The value of `postcount` depends on the address compression used in the received packet and can be controlled by the attacker. As a result, an attacker can inject a packet that causes an out-of-bound read. As of time of publication, a patched version is not available. As a workaround, one can apply the changes in Contiki-NG pull request #2509 to patch the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://github.com/contiki-ng/contiki-ng/pull/2509; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-2v4c-9p48-g9pr; https://github.com/contiki-ng/contiki-ng/pull/2509
CVE: CVE-2023-37459
Published: 2023-09-15
Description: Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify that a full TCP header has been received. Specifically, the implementation attempts to access the flags field from the TCP buffer in the following conditional expression in the `check_for_tcp_syn` function. For this reason, an attacker can inject a truncated TCP packet, which will lead to an out-of-bound read from the packet buffer. As of time of publication, a patched version is not available. As a workaround, one can apply the changes in Contiki-NG pull request #2510 to patch the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://github.com/contiki-ng/contiki-ng/pull/2510; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-6648-m23r-hq8c; https://github.com/contiki-ng/contiki-ng/pull/2510
CVE: CVE-2023-38507
Published: 2023-09-15
Description: Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12.1 has a fix for this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-770
References: https://github.com/strapi/strapi/blob/32d68f1f5677ed9a9a505b718c182c0a3f885426/packages/core/admin/server/middlewares/rateLimit.js#L31; https://github.com/strapi/strapi/releases/tag/v4.12.1; https://github.com/strapi/strapi/security/advisories/GHSA-24q2-59hm-rh9r
CVE: CVE-2023-38706
Published: 2023-09-15
Description: Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/discourse/discourse/security/advisories/GHSA-7wpp-4pqg-gvp8; https://github.com/discourse/discourse/security/advisories/GHSA-7wpp-4pqg-gvp8
CVE: CVE-2023-40018
Published: 2023-09-15
Description: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.10, FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID. When an SDP is offered with any ICE candidates with an unknown component ID, FreeSWITCH will make an out of bounds write to its  arrays. By abusing this vulnerability, an attacker is able to corrupt FreeSWITCH memory leading to an undefined behavior of the system or a crash of it. Version 1.10.10 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/signalwire/freeswitch/releases/tag/v1.10.10; https://github.com/signalwire/freeswitch/security/advisories/GHSA-7mwp-86fv-hcg3; https://github.com/signalwire/freeswitch/releases/tag/v1.10.10
CVE: CVE-2023-40019
Published: 2023-09-15
Description: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.10, FreeSWITCH allows authorized users to cause a denial of service attack by sending re-INVITE with SDP containing duplicate codec names. When a call in FreeSWITCH completes codec negotiation, the `codec_string` channel variable is set with the result of the negotiation. On a subsequent re-negotiation, if an SDP is offered that contains codecs with the same names but with different formats, there may be too many codec matches detected by FreeSWITCH leading to overflows of its internal arrays. By abusing this vulnerability, an attacker is able to corrupt stack of FreeSWITCH leading to an undefined behavior of the system or simply crash it. Version 1.10.10 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/signalwire/freeswitch/releases/tag/v1.10.10; https://github.com/signalwire/freeswitch/security/advisories/GHSA-gjj5-79p2-9g3q; https://github.com/signalwire/freeswitch/releases/tag/v1.10.10
CVE: CVE-2023-40167
Published: 2023-09-15
Description: Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field.  This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses.  There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-130
References: https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6; https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html; https://www.debian.org/security/2023/dsa-5507
CVE: CVE-2023-40588
Published: 2023-09-15
Description: Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/discourse/discourse/security/advisories/GHSA-2hg5-3xm3-9vvx; https://github.com/discourse/discourse/security/advisories/GHSA-2hg5-3xm3-9vvx
CVE: CVE-2023-41042
Published: 2023-09-15
Description: Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/discourse/discourse/security/advisories/GHSA-2fq5-x3mm-v254; https://github.com/discourse/discourse/security/advisories/GHSA-2fq5-x3mm-v254
CVE: CVE-2023-41043
Published: 2023-09-15
Description: Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server processes to be killed and lead to downtime. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. This is only a concern for multisite installations. No action is required when the admins are trusted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/discourse/discourse/security/advisories/GHSA-28hh-h5xw-xgvx; https://github.com/discourse/discourse/security/advisories/GHSA-28hh-h5xw-xgvx
CVE: CVE-2023-41325
Published: 2023-09-15
Description: OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, `shdr_verify_signature` can make a double free. `shdr_verify_signature` used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (`sw_crypto_acipher_alloc_rsa_public_key`) will try to allocate a memory (which is optee’s heap memory). RSA key is consist of exponent and modulus (represent as variable `e`, `n`) and it allocation is not atomic way, so it may succeed in `e` but fail in `n`. In this case sw_crypto_acipher_alloc_rsa_public_key` will free on `e` and return as it is failed but variable ‘e’ is remained as already freed memory address . `shdr_verify_signature` will free again that memory (which is `e`) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available.
CVSS Score: 7.4 (HIGH)
CWE: CWE-415
References: https://github.com/OP-TEE/optee_os/commit/e2ec831cb07ed0099535c7c140cb6338aa62816a; https://github.com/OP-TEE/optee_os/security/advisories/GHSA-jrw7-63cq-7vhm; https://github.com/OP-TEE/optee_os/commit/e2ec831cb07ed0099535c7c140cb6338aa62816a
CVE: CVE-2023-41880
Published: 2023-09-15
Description: Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a constant value that is larger than 32. Only x86_64 is affected so all other targets are not affected by this. The miscompilation results in the instruction producing an incorrect result, namely the low 32-bits of the second lane of the vector are derived from the low 32-bits of the second lane of the input vector instead of the high 32-bits. The primary impact of this issue is that any WebAssembly program using the `i64x2.shr_s` with a constant shift amount larger than 32 may produce an incorrect result.

This issue is not an escape from the WebAssembly sandbox. Execution of WebAssembly guest programs will still behave correctly with respect to memory sandboxing and isolation from the host. Wasmtime considers non-spec-compliant behavior as a security issue nonetheless.

This issue was discovered through fuzzing of Wasmtime's code generator Cranelift.

Wasmtime versions 10.0.2, 11.0.2, and 12.0.2 are all patched to no longer have this miscompilation. This issue only affects x86_64 hosts and the only workaround is to either scan for this pattern in wasm modules which is nontrivial or to disable the SIMD proposal for WebAssembly. Users prior to 10.0.0 are unaffected by this vulnerability.
CVSS Score: 2.2 (LOW)
CWE: CWE-193
References: https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_simd; https://github.com/bytecodealliance/wasmtime/commit/8d7eda15b0badcbea83a7aac2d08f80788b59240; https://github.com/bytecodealliance/wasmtime/pull/6372
CVE: CVE-2022-3261
Published: 2023-09-15
Description: A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-256, CWE-319
References: https://access.redhat.com/security/cve/CVE-2022-3261; https://bugzilla.redhat.com/show_bug.cgi?id=2128834; https://access.redhat.com/security/cve/CVE-2022-3261
CVE: CVE-2023-0813
Published: 2023-09-15
Description: A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285, CWE-287
References: https://access.redhat.com/errata/RHSA-2023:0786; https://access.redhat.com/security/cve/CVE-2023-0813; https://bugzilla.redhat.com/show_bug.cgi?id=2169468
CVE: CVE-2023-0923
Published: 2023-09-15
Description: A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://access.redhat.com/errata/RHSA-2023:0977; https://access.redhat.com/security/cve/CVE-2023-0923; https://bugzilla.redhat.com/show_bug.cgi?id=2171870
CVE: CVE-2023-41886
Published: 2023-09-15
Description: OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/OpenRefine/OpenRefine/commit/2de1439f5be63d9d0e89bbacbd24fa28c8c3e29d; https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qqh2-wvmv-h72m; https://github.com/OpenRefine/OpenRefine/commit/2de1439f5be63d9d0e89bbacbd24fa28c8c3e29d
CVE: CVE-2023-41887
Published: 2023-09-15
Description: OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OpenRefine/OpenRefine/commit/693fde606d4b5b78b16391c29d110389eb605511; https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-p3r5-x3hr-gpg5; https://github.com/OpenRefine/OpenRefine/commit/693fde606d4b5b78b16391c29d110389eb605511
CVE: CVE-2023-41889
Published: 2023-09-15
Description: SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happens when a logical validation or a security check is performed before a Unicode normalization. The Unicode character equivalent of a character would resurface after the normalization. The fix is initially performing the Unicode normalization and then strip for all whitespaces and then checking for a blank string. This issue has been fixed in version 1.18.0.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-176, CWE-116
References: https://github.com/shirasagi/shirasagi/blob/f249ce3f06f6bfbc0017b38f5c13de424334c3ea/app/models/concerns/rdf/object.rb#L68-L72; https://github.com/shirasagi/shirasagi/security/advisories/GHSA-xr45-c2jv-2v9r; https://sim4n6.beehiiv.com/p/unicode-characters-bypass-security-checks
CVE: CVE-2023-41900
Published: 2023-09-15
Description: Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-1390, CWE-287
References: https://github.com/eclipse/jetty.project/pull/9528; https://github.com/eclipse/jetty.project/pull/9660; https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48