deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-5593
Published: 2023-11-20
Description: The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software version 4.0.4.0 could allow an authenticated local user to gain a privilege escalation by sending a crafted CREATE message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-secuextender-ssl-vpn-client-software; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-secuextender-ssl-vpn-client-software
CVE: CVE-2023-6045
Published: 2023-11-20
Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
CVE: CVE-2023-47772
Published: 2023-11-20
Description: Contributor+ Stored Cross-Site Scripting (XSS) vulnerability in Slider Revolution <= 6.6.14.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-6-14-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-6-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48039
Published: 2023-11-20
Description: GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/gpac/gpac/issues/2679; https://github.com/gpac/gpac/issues/2679
CVE: CVE-2023-48090
Published: 2023-11-20
Description: GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329.
CVSS Score: 7.1 (HIGH)
CWE: CWE-401
References: https://github.com/gpac/gpac/issues/2680; https://github.com/gpac/gpac/issues/2680
CVE: CVE-2023-6196
Published: 2023-11-20
Description: The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the function audio_merchant_add_audio_file function. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/audio-merchant/trunk/audio-merchant.php#L1298; https://www.wordfence.com/threat-intel/vulnerabilities/id/06513dfe-f263-48b7-ba01-2c205247095b?source=cve; https://plugins.trac.wordpress.org/browser/audio-merchant/trunk/audio-merchant.php#L1298
CVE: CVE-2023-6197
Published: 2023-11-20
Description: The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the audio_merchant_save_settings function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/audio-merchant/trunk/audio-merchant.php#L951; https://www.wordfence.com/threat-intel/vulnerabilities/id/d7911337-57fa-4268-8366-d37ff13fae86?source=cve; https://plugins.trac.wordpress.org/browser/audio-merchant/trunk/audio-merchant.php#L951
CVE: CVE-2023-36013
Published: 2023-11-20
Description: PowerShell Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798, CWE-668
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36013; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36013
CVE: CVE-2023-29155
Published: 2023-11-20
Description: Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device. This could allow an attacker to obtain admin-level access to the host system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02
CVE: CVE-2023-35762
Published: 2023-11-20
Description: 
Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution.





CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02
CVE: CVE-2023-48218
Published: 2023-11-20
Description: The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39; https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4; https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7
CVE: CVE-2023-48221
Published: 2023-11-20
Description: wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 9.2.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available.
CVSS Score: 7.3 (HIGH)
CWE: CWE-134
References: https://github.com/wireapp/wire-avs/commit/364c3326a1331a84607bce2e17126306d39150cd; https://github.com/wireapp/wire-avs/security/advisories/GHSA-m4xg-fcr3-w3pq; https://github.com/wireapp/wire-avs/commit/364c3326a1331a84607bce2e17126306d39150cd
CVE: CVE-2023-48223
Published: 2023-11-20
Description: fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work if the victim application utilizes a public key containing the `BEGIN RSA PUBLIC KEY` header. Applications using the RS256 algorithm, a public key with a `BEGIN RSA PUBLIC KEY` header, and calling the verify function without explicitly providing an algorithm, are vulnerable to this algorithm confusion attack which allows attackers to sign arbitrary payloads which will be accepted by the verifier. Version 3.3.2 contains a patch for this issue. As a workaround, change line 29 of `blob/master/src/crypto.js` to include a regular expression.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://github.com/nearform/fast-jwt/blob/master/src/crypto.js#L29; https://github.com/nearform/fast-jwt/releases/tag/v3.3.2; https://github.com/nearform/fast-jwt/security/advisories/GHSA-c2ff-88x2-x9pg
CVE: CVE-2023-48240
Published: 2023-11-20
Description: XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other domains and include all cookies that were sent in the original request to ensure that images with restricted view right can be compared. Starting in version 11.10.1 and prior to versions 14.10.15, 15.5.1, and 15.6, this allows an attacker to steal login and session cookies that allow impersonating the current user who views the diff. The attack can be triggered with an image that references the rendered diff, thus making it easy to trigger. Apart from stealing login cookies, this also allows server-side request forgery (the result of any successful request is returned in the image's source) and viewing protected content as once a resource is cached, it is returned for all users. As only successful requests are cached, the cache will be filled by the first user who is allowed to access the resource. This has been patched in XWiki 14.10.15, 15.5.1 and 15.6. The rendered diff now only downloads images from trusted domains. Further, cookies are only sent when the image's domain is the same the requested domain. The cache has been changed to be specific for each user. As a workaround, the image embedding feature can be disabled by deleting `xwiki-platform-diff-xml-<version>.jar` in `WEB-INF/lib/`.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-201, CWE-281, CWE-918, CWE-918
References: https://github.com/xwiki/xwiki-platform/commit/bff0203e739b6e3eb90af5736f04278c73c2a8bb; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7rfg-6273-f5wp; https://jira.xwiki.org/browse/XWIKI-20818
CVE: CVE-2023-48241
Published: 2023-11-20
Description: XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wikis to anybody who has access to it, by default it is public. This exposes all information stored in the wiki (but not some protected information like password hashes). While there is a right check normally, the right check can be circumvented by explicitly requesting fields from Solr that don't include the data for the right check. This has been fixed in XWiki 15.6RC1, 15.5.1 and 14.10.15 by not listing documents whose rights cannot be checked. No known workarounds are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://github.com/xwiki/xwiki-platform/commit/93b8ec702d7075f0f5794bb05dfb[PII_REDACTED]64; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7fqr-97j7-jgf4; https://jira.xwiki.org/browse/XWIKI-21138
CVE: CVE-2023-48292
Published: 2023-11-20
Description: The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like  `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell commands isn't needed.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://github.com/xwiki-contrib/application-admintools/commit/03815c505c9f37006a0c56495e862dc549a39da8; https://github.com/xwiki-contrib/application-admintools/security/advisories/GHSA-8jpr-ff92-hpf9; https://jira.xwiki.org/browse/ADMINTOOL-91
CVE: CVE-2021-22636
Published: 2023-11-20
Description: 






Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution. 








CVSS Score: 7.4 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04; https://www.ti.com/tool/TI-RTOS-MCU; https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04
CVE: CVE-2021-27429
Published: 2023-11-20
Description: 
Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in 'HeapTrack_alloc' and result in code execution. 


CVSS Score: 7.4 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04; https://www.ti.com/tool/TI-RTOS-MCU; https://www.cisa.gov/news-events/ics-advisories/icsa-21-119-04
CVE: CVE-2023-38879
Published: 2023-11-20
Description: The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38879; https://www.os4ed.com/
CVE: CVE-2023-38880
Published: 2023-11-20
Description: The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisBackup<date>.sql" (e.g. "opensisBackup07-20-2023.sql"), i.e. can easily be guessed. This file can be accessed by any unauthenticated actor and contains a dump of the whole database including password hashes.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38880; https://www.os4ed.com/
CVE: CVE-2023-38881
Published: 2023-11-20
Description: A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id', 'school_date', 'month' or 'year' parameters in 'CalendarModal.php'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38881; https://www.os4ed.com/
CVE: CVE-2023-38882
Published: 2023-11-20
Description: A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php'
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38882; https://www.os4ed.com/
CVE: CVE-2023-38883
Published: 2023-11-20
Description: A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in 'ParentLookup.php'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38883; https://www.os4ed.com/
CVE: CVE-2023-38884
Published: 2023-11-20
Description: An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/<studentId>-<filename>'
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38884; https://www.os4ed.com/
CVE: CVE-2023-38885
Published: 2023-11-20
Description: OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885; https://www.os4ed.com/
CVE: CVE-2023-48293
Published: 2023-11-20
Description: The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. Among other things, this allows modifying and deleting all data of the wiki. This could be both used to damage the wiki and to create an account with elevated privileges for the attacker, thus impacting the confidentiality, integrity and availability of the whole XWiki instance. A possible attack vector are comments on the wiki, by embedding an image with wiki syntax like `[[image:path:/xwiki/bin/view/Admin/QueryOnXWiki?query=DELETE%20FROM%20xwikidoc]]`, all documents would be deleted from the database when an admin user views this comment. This has been patched in Admin Tools Application 4.5.1 by adding form token checks. Some workarounds are available. The patch can also be applied manually to the affected pages. Alternatively, if the query tool is not needed, by deleting the document `Admin.SQLToolsGroovy`, all database query tools can be deactivated.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/xwiki-contrib/application-admintools/commit/45298b4fbcafba6914537dcdd798a1e1385f9e46; https://github.com/xwiki-contrib/application-admintools/security/advisories/GHSA-4f4c-rhjv-4wgv; https://jira.xwiki.org/browse/ADMINTOOL-92
CVE: CVE-2023-48300
Published: 2023-11-20
Description: The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_opt_out` shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 1.8.1 contains a patch for this issue.

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://d.pr/v/ORuIat; https://github.com/epiphyt/embed-privacy/commit/f80929992b2a5a66f4f4953cd6f46cc227154a5c; https://github.com/epiphyt/embed-privacy/issues/199
CVE: CVE-2023-48309
Published: 2023-11-20
Description: NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow (state, PKCE or nonce). Manually overriding the `next-auth.session-token` cookie value with this non-related JWT would let the user simulate a logged in user, albeit having no user information associated with it. (The only property on this user is an opaque randomly generated string). This vulnerability does not give access to other users' data, neither to resources that require proper authorization via scopes or other means. The created mock user has no information associated with it (ie. no name, email, access_token, etc.) This vulnerability can be exploited by bad actors to peek at logged in user states (e.g. dashboard layout). `next-auth` `v4.24.5` contains a patch for the vulnerability. As a workaround, using a custom authorization callback for Middleware, developers can manually do a basic authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://authjs.dev/guides/basics/role-based-access-control; https://github.com/nextauthjs/next-auth/commit/d237059b6d0cb868c041ba18b698e0cee20a2f10; https://github.com/nextauthjs/next-auth/security/advisories/GHSA-v64w-49xw-qq89
CVE: CVE-2023-4799
Published: 2023-11-20
Description: The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/04c71873-5ae7-4f94-8ba9-03e03ff55180; https://wpscan.com/vulnerability/04c71873-5ae7-4f94-8ba9-03e03ff55180
CVE: CVE-2023-4808
Published: 2023-11-20
Description: The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bb8e9f06-477b-4da3-b5a6-4f06084ecd57; https://wpscan.com/vulnerability/bb8e9f06-477b-4da3-b5a6-4f06084ecd57
CVE: CVE-2023-4824
Published: 2023-11-20
Description: The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/71c616ff-0a7e-4f6d-950b-79c469a28263; https://wpscan.com/vulnerability/71c616ff-0a7e-4f6d-950b-79c469a28263
CVE: CVE-2023-4970
Published: 2023-11-20
Description: The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/845bbfdd-fe9f-487c-91a0-5fe10403d8a2; https://wpscan.com/vulnerability/845bbfdd-fe9f-487c-91a0-5fe10403d8a2
CVE: CVE-2023-5119
Published: 2023-11-20
Description: The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/229207bb-8f8d-4579-a8e2-54516474ccb4; https://wpscan.com/vulnerability/229207bb-8f8d-4579-a8e2-54516474ccb4
CVE: CVE-2023-5140
Published: 2023-11-20
Description: The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ee1824e8-09a6-4763-b65e-03701dc3e171; https://wpscan.com/vulnerability/ee1824e8-09a6-4763-b65e-03701dc3e171