rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-0744 Improper Access Control in answerdev/answer
Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: answerdev
product: answerdev/answer
Published: 2023-02-08T00:00:00.000Z
CVE-2023-0745 Arbitrary File Write in High Availability Backup Upload

	
		
		
	
	
		
			
				
					The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary
files through the backup upload endpoint by using path traversal characters.



				


			


		


	
 This vulnerability is associated with program files PlatformReplicationManager.Java.

This issue affects YugabyteDB Anywhere: from 2.0.0.0 through 2.13.0.0


Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: YugabyteDB
product: YugabyteDB Anywhere
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-02-09T16:08:57.723Z
CVE-2023-0746 XSS Vulnerability in GigaVue-FM
The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user. An attacker could enforce a user into inserting malicious JavaScript code into the URI, that could lead to a Reflected Cross site Scripting.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Gigamon
product: GigaVUE-FM
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Credits: lang: en
value: Albert Sanchez Miñano
Published: 2023-03-10T00:00:00.000Z
CVE-2023-0747 Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: btcpayserver
product: btcpayserver/btcpayserver
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-02-08T00:00:00.000Z
CVE-2023-0748 Open Redirect in btcpayserver/btcpayserver
Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.


Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site
Affected products: vendor: btcpayserver
product: btcpayserver/btcpayserver
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-02-08T00:00:00.000Z
CVE-2023-0749 Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.
Problem types: description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: Ocean Extra
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-03-13T16:03:31.466Z
CVE-2023-0750 Yellowbrik PEC-1864 authentication bypass
Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface.  When the device can be accessed over the network an attacker could bypass authentication.




This would allow an attacker to : 
- Change the password, resulting in a DOS of the users

- Change the streaming source, compromising the integrity of the stream

- Change the streaming destination, compromising the confidentiality of the stream








This issue affects Yellowbrik: PEC 1864. No patch has been issued by the manufacturer as this model was discontinued.













Problem types: cwe_id: CWE-602
description: CWE-602: Client-Side Enforcement of Server-Side Security
Affected products: vendor: Lynx Technik AG
product: Yellowbrik
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Vincent Salvadori
Published: 2023-04-06T13:12:11.304Z
CVE-2023-0751 GELI silently omits the keyfile if read from stdin
When GELI reads a key file from standard input, it does not reuse the key file to initialize multiple providers at once resulting in the second and subsequent devices silently using a NULL key as the user key file. If a user only uses a key file without a user passphrase, the master key is encrypted with an empty key file allowing trivial recovery of the master key.

Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unaffected
Published: 2023-02-08T19:25:01.118Z
CVE-2023-0754 

The affected products are vulnerable to an integer
overflow or wraparound, which could  allow an attacker to crash the server and remotely
execute arbitrary code.
















Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: PTC
product: ThingWorx Edge C-SDK
default_status: unaffected
vendor: Microsoft
product: .NET-SDK
default_status: unaffected
vendor: PTC
product: ThingWorx Edge MicroServer (EMS)
default_status: unaffected
vendor: PTC
product: Kepware KEPServerEX
default_status: unaffected
vendor: PTC
product: ThingWorx Kepware Server 
default_status: unaffected
vendor: PTC
product: ThingWorx Industrial Connectivity
default_status: unaffected
vendor: PTC
product: ThingWorx Kepware Edge
default_status: unaffected
vendor: Rockwell Automation 
product: KEPServer Enterprise 
default_status: unaffected
vendor: General Electric 
product: Digital Industrial Gateway Server 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Chris Anastasio and Steven Seeley of Incite Team reported these vulnerabilities to CISA.
Published: 2023-02-23T21:27:09.964Z
CVE-2023-0755 

The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.


Problem types: cwe_id: CWE-129
description: CWE-129 Improper Validation of Array Index
Affected products: vendor: PTC
product: ThingWorx Edge C-SDK
default_status: unaffected
vendor: Microsoft
product: .NET-SDK
default_status: unaffected
vendor: PTC
product: ThingWorx Edge MicroServer (EMS)
default_status: unaffected
vendor: PTC
product: Kepware KEPServerEX
default_status: unaffected
vendor: PTC
product: ThingWorx Kepware Server 
default_status: unaffected
vendor: PTC
product: ThingWorx Industrial Connectivity
default_status: unaffected
vendor: PTC
product: ThingWorx Kepware Edge
default_status: unaffected
vendor: Rockwell Automation 
product: KEPServer Enterprise 
default_status: unaffected
vendor: General Electric 
product: Digital Industrial Gateway Server 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Chris Anastasio and Steven Seeley of Incite Team reported these vulnerabilities to CISA.
Published: 2023-02-23T21:23:19.210Z
CVE-2023-0756 
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems.
Problem types: description: Improper control of generation of code ('code injection') in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [st4nly0n](https://hackerone.com/st4nly0n) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-05-03T00:00:00.000Z
CVE-2023-0757 Phoenix Contact ProConOS prone to Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: PHOENIX CONTACT
product: MULTIPROG
default_status: unaffected
vendor: PHOENIX CONTACT
product: ProConOS eCLR (SDK)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Reid Wightman from Dragos, Inc.
Published: 2023-12-14T14:04:10.708Z
CVE-2023-0758 glorylion JFinalOA SysOrg.java sql injection
A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: glorylion
product: JFinalOA
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: amazingday (VulDB User)
Published: 2023-02-09T10:59:53.003Z
CVE-2023-0759 Privilege Chaining in cockpit-hq/cockpit
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
Problem types: cwe_id: CWE-268
description: CWE-268 Privilege Chaining
Affected products: vendor: cockpit-hq
product: cockpit-hq/cockpit
Published: 2023-02-09T00:00:00.000Z
CVE-2023-0760 Heap-based Buffer Overflow in gpac/gpac
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to V2.1.0-DEV.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: gpac
product: gpac/gpac
Published: 2023-02-09T00:00:00.000Z
CVE-2023-0761 Clock In Portal <= 2.1 - Staff Deletion via CSRF
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which could allow attackers to make logged in admins delete arbitrary Staff via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Clock In Portal- Staff & Attendance Management
default_status: affected
Credits: lang: en
value: Sajjad Shariati
lang: en
value: WPScan
Published: 2023-05-15T12:15:43.882Z
CVE-2023-0762 Clock In Portal <= 2.1 - Designation Deletion via CSRF
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Clock In Portal- Staff & Attendance Management
default_status: affected
Credits: lang: en
value: Sajjad Shariati
lang: en
value: WPScan
Published: 2023-05-15T12:15:32.523Z
CVE-2023-0763 Clock In Portal <= 2.1 - Holidays Deletion via CSRF
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Clock In Portal- Staff & Attendance Management
default_status: affected
Credits: lang: en
value: Sajjad Shariati
lang: en
value: WPScan
Published: 2023-05-15T12:15:37.541Z
CVE-2023-0764 Gallery by BestWebSoft < 4.7.0 - Author+ Stored Cross-Site Scripting
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription vulnerability. The attacker must have at least the privileges of the Author role.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Gallery by BestWebSoft
default_status: unaffected
Credits: lang: en
value: dc11
lang: en
value: WPScan
Published: 2023-04-17T12:17:37.533Z
CVE-2023-0765 Gallery by BestWebSoft < 4.7.0 - Author+ SQL Injection
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Gallery by BestWebSoft
default_status: unaffected
Credits: lang: en
value: dc11
lang: en
value: WPScan
Published: 2023-04-17T12:17:39.159Z
CVE-2023-0766 Newsletter Popup <= 1.2 - Record Deletion via CSRF
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Newsletter Popup
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-05-30T07:49:19.438Z
CVE-2023-0767 
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
Problem types: description: Arbitrary memory write via PKCS 12 in NSS
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2023-06-02T00:00:00.000Z
CVE-2023-0768 Avirato hotels online booking engine <= 5.0.5 - Subscriber+ SQLi
The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Avirato hotels online booking engine
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-05-08T13:58:02.011Z
CVE-2023-0769 hiWeb Migration Simple <= 2.0.0.1 Reflected Cross-Site Scripting
The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: hiWeb Migration Simple
default_status: affected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2024-01-16T15:56:25.178Z
CVE-2023-0770 Stack-based Buffer Overflow in gpac/gpac
Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: gpac
product: gpac/gpac
Published: 2023-02-09T00:00:00.000Z
CVE-2023-0771  SQL Injection in ampache/ampache
SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: ampache
product: ampache/ampache
Published: 2023-02-10T00:00:00.000Z
CVE-2023-0772 Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure
The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
Problem types: description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: Popup Builder by OptinMonster
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-03-13T16:03:30.688Z
CVE-2023-0773 Unauthorized Access Control Vulnerability in Uniview IP Camera
The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.

Successful exploitation of this vulnerability could allow the attacker to gain complete control of the targeted device.

Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Uniview
product: Uniview IP Camera IPC322LB-SF28-A
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
version: 3.1
Credits: lang: en
value: This vulnerability is reported by Souvik Kandar and Arko Dhar from Redinent Innovations Engineering & Research Team, Karnataka, India.
Published: 2023-09-19T09:33:42.479Z
CVE-2023-0774 SourceCodester Medical Certificate Generator App action.php sql injection
A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affects unknown code of the file action.php. The manipulation of the argument lastname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-220558 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Medical Certificate Generator App
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Gab3 (VulDB User)
Published: 2023-02-10T11:52:38.683Z
CVE-2023-0775 Bluetooth LE Invalid prepare write request command leads to denial of service
An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent connection requests, resulting in a denial-of-service.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: silabs.com
product: GSDK
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-03-28T16:23:29.836Z
CVE-2023-0776 Remote Code Execution in Baicells QRTB Platform
Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. 



Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Baicells
product: Nova 436Q
default_status: unaffected
vendor: Baicells
product: Nova 430E
default_status: unaffected
vendor: Baicells
product: Nova 430I
default_status: unaffected
vendor: Baicells
product: Neutrino 430
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L
version: 3.1
Credits: lang: en
value: Rustam Amin
lang: en
value: Baicells Security Team
Published: 2023-02-10T21:50:42.853Z
CVE-2023-0777 Authentication Bypass by Primary Weakness in modoboa/modoboa
Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: modoboa
product: modoboa/modoboa
Published: 2023-02-10T00:00:00.000Z
CVE-2023-0778 
A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
Problem types: cwe_id: CWE-367
description: CWE-367
Affected products: vendor: n/a
product: podman
Published: 2023-03-27T00:00:00.000Z