rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-0399 Image Over Image For WPBakery Page Builder < 3.0 - Contributor+ Stored XSS
The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Image Over Image For WPBakery Page Builder
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-04-03T14:38:29.299Z
CVE-2023-0400 

The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading sensitive data from a mapped drive into a web email client. Loading from a local driver was correctly prevented. Versions prior to 11.9 correctly detected and blocked the attempted upload of sensitive data.


Problem types: cwe_id: CWE-670
description: CWE-670 Always-Incorrect Control Flow Implementation
Affected products: vendor: Trellix
product: Data Loss Prevention (DLP)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Published: 2023-02-01T16:34:09.911Z
CVE-2023-0401 NULL dereference during PKCS7 data verification
A NULL pointer can be dereferenced when signatures are being
verified on PKCS7 signed or signedAndEnveloped data. In case the hash
algorithm used for the signature is known to the OpenSSL library but
the implementation of the hash algorithm is not available the digest
initialization will fail. There is a missing check for the return
value from the initialization function which later leads to invalid
usage of the digest API most likely leading to a crash.

The unavailability of an algorithm can be caused by using FIPS
enabled configuration of providers or more commonly by not loading
the legacy provider.

PKCS7 data is processed by the SMIME library calls and also by the
time stamp (TS) library calls. The TLS implementation in OpenSSL does
not call these functions however third party applications would be
affected if they call these functions to verify signatures on untrusted
data.
Problem types: description: NULL pointer deference
Affected products: vendor: OpenSSL
product: OpenSSL
default_status: unaffected
Credits: lang: en
value: Hubert Kario (Red Hat)
lang: en
value: Dmitry Belyavsky (Red Hat)
lang: en
value: Tomáš Mráz
Published: 2023-02-08T19:00:53.435Z
CVE-2023-0402 Social Warfare <= 4.3.0 - Missing Authorization
The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete post meta information and reset network access tokens.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: warfareplugins
product: Social Sharing Plugin – Social Warfare
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2023-01-19T14:07:08.694Z
CVE-2023-0403 Social Warfare <= 4.3.1 - Cross-Site Request Forgery
The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on several AJAX actions. This makes it possible for unauthenticated attackers to delete post meta information and reset network access tokens, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: warfareplugins
product: Social Sharing Plugin – Social Warfare
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2023-01-19T14:07:59.775Z
CVE-2023-0404 Events Made Easy <= 2.3.16 - Missing Authorization
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: liedekef
product: Events Made Easy
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2023-01-19T14:25:17.678Z
CVE-2023-0405 GPT3 AI Content Writer < 1.4.38 - Subscriber+ Arbitrary Post Content Update
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts.
Problem types: description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:23.773Z
CVE-2023-0406 Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: modoboa
product: modoboa/modoboa
Published: 2023-01-19T00:00:00.000Z
CVE-2023-0410 Cross-site Scripting (XSS) - Generic in builderio/qwik
Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: builderio
product: builderio/qwik
Published: 2023-01-20T00:00:00.000Z
CVE-2023-0411 
Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
Problem types: description: Excessive iteration in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2023-01-24T00:00:00.000Z
CVE-2023-0412 
TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
Problem types: description: Uncontrolled recursion in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2023-01-24T00:00:00.000Z
CVE-2023-0413 
Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
Problem types: description: Null pointer dereference in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2023-01-24T00:00:00.000Z
CVE-2023-0414 
Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture file
Problem types: description: Expired pointer dereference in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2023-01-24T00:00:00.000Z
CVE-2023-0415 
iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
Problem types: description: Null pointer dereference in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2023-01-24T00:00:00.000Z
CVE-2023-0416 
GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
Problem types: description: Expired pointer dereference in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2023-01-24T00:00:00.000Z
CVE-2023-0417 
Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
Problem types: description: Uncontrolled memory allocation in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2023-01-24T00:00:00.000Z
CVE-2023-0418 Video Central for WordPress <= 1.3.0 - Contributor+ Stored XSS
The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Video Central for WordPress
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-04-24T18:31:00.385Z
CVE-2023-0419 Shortcode for Font Awesome < 1.4.1 - Contributor+ Stored XSS
The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Shortcode for Font Awesome
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:51:05.416Z
CVE-2023-0420 Custom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRF
The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Custom Post Type and Taxonomy GUI Manager
default_status: affected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2023-04-24T18:30:49.071Z
CVE-2023-0421 Cloud Manager <= 1.0 - Reflected XSS
The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Cloud Manager
default_status: affected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2023-05-08T13:58:04.382Z
CVE-2023-0422 Article Directory <= 1.3 - Admin+ Stored XSS
The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Article Directory
default_status: affected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2023-04-10T13:18:01.633Z
CVE-2023-0423 WordPress Amazon S3 Plugin < 1.6 - Reflected XSS
The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Amazon S3 Plugin
default_status: unaffected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2023-04-10T13:18:02.898Z
CVE-2023-0424 MS-Reviews <= 1.5 - Subscriber+ Stored XSS
The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: MS-Reviews
default_status: affected
Credits: lang: en
value: Rio Darmawan
lang: en
value: WPScan
Published: 2023-04-24T18:30:57.743Z
CVE-2023-0425 Buffer overflow in global memory region

ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves
the reported vulnerabilities in the product versions under maintenance.
An attacker who successfully exploited one or more of these vulnerabilities could cause the product to
stop or make the product inaccessible. 

Numeric Range Comparison Without Minimum Check vulnerability in ABB Freelance controllers AC 700F (Controller modules), ABB Freelance controllers AC 900F (controller modules).This issue affects:

Freelance controllers AC 700F: 

from 9.0;0 through V9.2 SP2, through Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 2019 SP1 FP1; 

Freelance controllers AC 900F: 

Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 2019 SP1 FP1.


Problem types: cwe_id: CWE-839
description: CWE-839 Numeric Range Comparison Without Minimum Check
Affected products: vendor: ABB
product:  Freelance controllers AC 700F
default_status: unaffected
vendor: ABB
product:  Freelance controllers AC 900F
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: ABB thanks Nataliya Tlyapova and Denis Goryushev (Positive Technologies) for responsibly reporting the vulnerabilities and working with us as we addressed them.
Published: 2023-08-07T05:06:46.584Z
CVE-2023-0426 Stack overflow in filename or in boundary 

ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves
the reported vulnerabilities in the product versions under maintenance.
An attacker who successfully exploited one or more of these vulnerabilities could cause the product to
stop or make the product inaccessible. 



Stack-based Buffer Overflow vulnerability in ABB Freelance controllers AC 700F (conroller modules), ABB Freelance controllers AC 900F (controller modules).This issue affects:

 Freelance controllers AC 700F: 

from 9.0;0 through V9.2 SP2, through Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019 , through Freelance 2019 SP1, through Freelance 2019 SP1 FP1; 




Freelance controllers AC 900F: 

through Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 2019 SP1 FP1.


Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: ABB
product:  Freelance controllers AC 700F
default_status: unaffected
vendor: ABB
product:  Freelance controllers AC 900F
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: ABB thanks Nataliya Tlyapova and Denis Goryushev (Positive Technologies) for responsibly reporting the vulnerabilities and working with us as we addressed them.
Published: 2023-08-07T05:23:45.868Z
CVE-2023-0428 Watu Quiz < 3.3.8.2 - Reflected XSS
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Watu Quiz
default_status: unaffected
Credits: lang: en
value: Felipe Restrepo Rodriguez
lang: en
value: WPScan
Published: 2023-02-21T08:50:56.586Z
CVE-2023-0429 Watu Quiz < 3.3.8.3 - Admin+ Stored XSS
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Watu Quiz
default_status: unaffected
Credits: lang: en
value: Felipe Restrepo Rodriguez
lang: en
value: WPScan
Published: 2023-02-21T08:50:57.365Z
CVE-2023-0430 
Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1.
Problem types: description: Revocation status of S/Mime signature certificates was not checked
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2023-06-02T00:00:00.000Z
CVE-2023-0431 File Away <= 3.9.9.0.1 - Contributor+ Stored XSS via Shortcode
The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: File Away
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-06-12T17:28:21.850Z
CVE-2023-0432 CVE-2023-0432

The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system (OS) from the device in the context of the user "root." If the attacker has credentials for the web service, then the device could be fully compromised.




Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Delta Electronics
product: DX-2100-L1-CN
default_status: unaffected
Credits: lang: en
value: T. Weber of CyberDanube Security Research reported it to Delta Electronics. 
Published: 2023-03-31T15:51:02.512Z
CVE-2023-0433 Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2023-01-21T00:00:00.000Z
CVE-2023-0434 Improper Input Validation in pyload/pyload
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: pyload
product: pyload/pyload
Published: 2023-01-22T00:00:00.000Z
CVE-2023-0435 Excessive Attack Surface in pyload/pyload
Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.
Problem types: cwe_id: CWE-1125
description: CWE-1125 Excessive Attack Surface
Affected products: vendor: pyload
product: pyload/pyload
Published: 2023-01-22T00:00:00.000Z
CVE-2023-0436 Secret logging may occur in debug mode of Atlas Operator 
The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0.

Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version.
Required Configuration: 

DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg.  https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )


Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: MongoDB Inc
product: MongoDB Atlas Kubernetes Operator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-11-07T11:44:47.971Z