deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41987
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/badgeos/wordpress-badgeos-plugin-3-7-1-6-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/badgeos/wordpress-badgeos-plugin-3-7-1-6-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-43490
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in XWP Stream plugin <= 3.9.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/stream/wordpress-stream-plugin-3-9-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stream/wordpress-stream-plugin-3-9-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-45371
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wpmet ShopEngine plugin <= 4.1.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/shopengine/wordpress-shopengine-plugin-4-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shopengine/wordpress-shopengine-plugin-4-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-45815
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes GDPR Compliance & Cookie Consent plugin <= 1.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/gdpr-compliance-cookie-consent/wordpress-gdpr-compliance-cookie-consent-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gdpr-compliance-cookie-consent/wordpress-gdpr-compliance-cookie-consent-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-46810
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-thank-you-page-customizer/wordpress-thank-you-page-customizer-for-woocommerce-increase-your-sales-plugin-1-0-13-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/woo-thank-you-page-customizer/wordpress-thank-you-page-customizer-for-woocommerce-increase-your-sales-plugin-1-0-13-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-46814
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pierre Lebedel Kodex Posts likes plugin <= 2.4.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/kodex-posts-likes/wordpress-kodex-posts-likes-plugin-2-4-3-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/kodex-posts-likes/wordpress-kodex-posts-likes-plugin-2-4-3-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-46820
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPJoli Joli Table Of Contents plugin <= 1.3.9 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/joli-table-of-contents/wordpress-joli-table-of-contents-plugin-1-3-9-cross-site-request-forgery-csrf-on-reset-settings?_s_id=cve; https://patchstack.com/database/vulnerability/joli-table-of-contents/wordpress-joli-table-of-contents-plugin-1-3-9-cross-site-request-forgery-csrf-on-reset-settings?_s_id=cve
CVE: CVE-2022-46856
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in ORION Woocommerce Products Designer plugin <= 4.3.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-products-designer/wordpress-woocommerce-products-designer-by-orion-online-product-customizer-for-t-shirts-print-cards-phone-cases-lettering-decals-plugin-4-3-3-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-products-designer/wordpress-woocommerce-products-designer-by-orion-online-product-customizer-for-t-shirts-print-cards-phone-cases-lettering-decals-plugin-4-3-3-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47136
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ninja-tables/wordpress-ninja-tables-best-data-table-plugin-for-wordpress-plugin-4-3-4-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/ninja-tables/wordpress-ninja-tables-best-data-table-plugin-for-wordpress-plugin-4-3-4-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47144
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/mediamatic/wordpress-mediamatic-media-library-folders-plugin-2-8-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/mediamatic/wordpress-mediamatic-media-library-folders-plugin-2-8-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47178
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Simple Share Buttons Simple Share Buttons Adder plugin <= 8.4.7 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/simple-share-buttons-adder/wordpress-simple-share-buttons-adder-plugin-8-4-6-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/simple-share-buttons-adder/wordpress-simple-share-buttons-adder-plugin-8-4-6-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-45366
Published: 2023-05-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-slimstat/wordpress-slimstat-analytics-plugin-5-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-slimstat/wordpress-slimstat-analytics-plugin-5-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-47174
Published: 2023-05-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/performance-lab/wordpress-performance-lab-plugin-2-2-0-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/performance-lab/wordpress-performance-lab-plugin-2-2-0-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-2888
Published: 2023-05-25
Description: A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100. This affects an unknown part of the file /admin.php?c=upload&f=zip&_noCache=0[PII_REDACTED]. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The identifier VDB-229953 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://gitee.com/phpok/phpok/issues/I72D24; https://vuldb.com/?ctiid.229953; https://vuldb.com/?id.229953
CVE: CVE-2023-0459
Published: 2023-05-25
Description: Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-763, CWE-763
References: https://github.com/torvalds/linux/commit/4b842e4e25b12951fa10dedb4bc16bc47e3b850c; https://github.com/torvalds/linux/commit/74e19ef0ff8061ef55957c3abd71614ef0f42f47; https://github.com/torvalds/linux/commit/4b842e4e25b12951fa10dedb4bc16bc47e3b850c
CVE: CVE-2023-22504
Published: 2023-05-25
Description: Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://jira.atlassian.com/browse/CONFSERVER-83218; https://jira.atlassian.com/browse/CONFSERVER-83218
CVE: CVE-2023-2480
Published: 2023-05-25
Description: Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications
CVSS Score: 7.5 (HIGH)
CWE: CWE-280, CWE-862
References: https://empower.m-files.com/security-advisories/CVE-2023-2480; https://product.m-files.com/security-advisories/cve-2023-2480/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2480/
CVE: CVE-2023-2798
Published: 2023-05-25
Description: Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue affects htmlunit before 2.70.0.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54613; https://github.com/HtmlUnit/htmlunit/commit/940dc7fd; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54613
CVE: CVE-2023-2851
Published: 2023-05-25
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AGT Tech Ceppatron allows Command Line Execution through SQL Injection, SQL Injection.This issue affects all versions of the sofware also EOS when CVE-ID assigned.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0294; https://www.usom.gov.tr/bildirim/tr-23-0294
CVE: CVE-2023-33355
Published: 2023-05-25
Description: IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitive information.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Thecosy/IceCMS/issues/7; https://github.com/Thecosy/IceCMS/issues/7
CVE: CVE-2023-33356
Published: 2023-05-25
Description: IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Thecosy/IceCMS/issues/8; https://github.com/Thecosy/IceCMS/issues/8
CVE: CVE-2023-32694
Published: 2023-05-25
Description: Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could affect the database integrity such as marking an order as paid when it is not. This issue has been patched in versions 3.7.68, 3.8.40, 3.9.49, 3.10.36, 3.11.35, 3.12.25, and 3.13.16.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-203, CWE-208, CWE-203
References: https://github.com/saleor/saleor/commit/1328274e1a3d04ab87d7daee90229ff47b3bc35e; https://github.com/saleor/saleor/security/advisories/GHSA-3rqj-9v87-2x3f; https://github.com/saleor/saleor/commit/1328274e1a3d04ab87d7daee90229ff47b3bc35e
CVE: CVE-2023-33750
Published: 2023-05-25
Description: A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description parameter at /index.php?s=/article/ApiAdminArticle/itemAdd.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sansanyun/mipjz/issues/15; https://github.com/sansanyun/mipjz/issues/15
CVE: CVE-2023-33751
Published: 2023-05-25
Description: A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter at /app/tag/controller/ApiAdminTagCategory.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sansanyun/mipjz/issues/14; https://github.com/sansanyun/mipjz/issues/14
CVE: CVE-2023-30615
Published: 2023-05-25
Description: Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations . The vulnerability in allows an attacker to inject malicious scripts into the application, which are then executed when a user visits the affected locations. This can lead to unauthorized access, data theft, or other malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue was patched in version 2.2.1 of iris-web. 

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://github.com/dfir-iris/iris-web/releases/tag/v2.2.1; https://github.com/dfir-iris/iris-web/security/advisories/GHSA-gc6j-6276-2m49; https://github.com/dfir-iris/iris-web/releases/tag/v2.2.1
CVE: CVE-2023-30851
Published: 2023-05-25
Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.
CVSS Score: 2.6 (LOW)
CWE: CWE-693
References: https://github.com/cilium/cilium/releases/tag/v1.11.16; https://github.com/cilium/cilium/releases/tag/v1.12.9; https://github.com/cilium/cilium/releases/tag/v1.13.2
CVE: CVE-2023-26215
Published: 2023-05-25
Description: The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged application  access to read system files that are accessible to the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.16 and below.


CVSS Score: 7.7 (HIGH)
CWE: CWE-22, CWE-203
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2023-26216
Published: 2023-05-25
Description: The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory accessible by the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.16 and below.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2023-0950
Published: 2023-05-25
Description: Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to 7.5.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129, CWE-129
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00014.html; https://security.gentoo.org/glsa/202311-15; https://www.debian.org/security/2023/dsa-5415
CVE: CVE-2023-25439
Published: 2023-05-25
Description: Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content fields to the expenses, tasks, and customer details.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/172556/FusionInvoice-2023-1.0-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/172556/FusionInvoice-2023-1.0-Cross-Site-Scripting.html
CVE: CVE-2023-2255
Published: 2023-05-25
Description: Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00014.html; https://security.gentoo.org/glsa/202311-15; https://www.debian.org/security/2023/dsa-5415
CVE: CVE-2023-33263
Published: 2023-05-25
Description: In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WFTPD directory. NOTE: this is a product from 2006.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://packetstormsecurity.com/files/172560/WFTPD-3.25-Credential-Disclosure.html; https://packetstormsecurity.com/files/172560/WFTPD-3.25-Credential-Disclosure.html
CVE: CVE-2023-33278
Published: 2023-05-25
Description: In the Store Commander scexportcustomers module for PrestaShop through 3.6.1, sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scexportcustomers.html; https://www.storecommander.com/en/addons/480-customer-export-pro.html; https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scexportcustomers.html
CVE: CVE-2023-33279
Published: 2023-05-25
Description: In the Store Commander scfixmyprestashop module through 2023-05-09 for PrestaShop, sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scfixmyprestashop.html; https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scfixmyprestashop.html
CVE: CVE-2023-33280
Published: 2023-05-25
Description: In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scquickaccounting.html; https://www.storecommander.com/en/addons/440-order-export-pro.html; https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scquickaccounting.html
CVE: CVE-2023-2900
Published: 2023-05-25
Description: A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown function of the file /Login/CheckLogin. The manipulation leads to use of weak hash. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-229974 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-328, CWE-327
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/NFine-Rapid-development-platform-has-weak-password-vulnerability.md; https://vuldb.com/?ctiid.229974; https://vuldb.com/?id.229974
CVE: CVE-2023-2804
Published: 2023-05-25
Description: A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/security/cve/CVE-2023-2804; https://bugzilla.redhat.com/show_bug.cgi?id=2208447; https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9f756bc67a84d4566bf74a0c2432aa55da404021
CVE: CVE-2023-2901
Published: 2023-05-25
Description: A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /SystemManage/User/GetGridJson?_search=false&nd=[PII_REDACTED]50&rows=50&page=1&sidx=F_CreatorTime+desc&sord=asc. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229975. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/NFine%20rapid%20development%20platform%20User-GetGridJson%20has%20unauthorized%20access%20vulnerability.md; https://vuldb.com/?ctiid.229975; https://vuldb.com/?id.229975
CVE: CVE-2023-2902
Published: 2023-05-25
Description: A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /SystemManage/Organize/GetTreeGridJson?_search=false&nd=[PII_REDACTED]83&rows=10000&page=1&sidx=&sord=asc. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229976. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/The%20NFine%20rapid%20development%20platform%20Organize-GetTreeGridJson%20has%20unauthorized%20access%20vulnerability.md; https://vuldb.com/?ctiid.229976; https://vuldb.com/?id.229976
CVE: CVE-2023-31124
Published: 2023-05-25
Description: c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android.  This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.
CVSS Score: 3.7 (LOW)
CWE: CWE-330, CWE-330
References: https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1; https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/