rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-1064 SQLi in Uzay Baskul's Weighbridge Automation Software
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Uzay Baskul Weighbridge Automation Software allows SQL Injection.

This issue affects Weighbridge Automation Software: before 1.1.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Uzay Baskul
product: Weighbridge Automation Software
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Resul Melih MACIT
Published: 2023-03-01T12:51:08.179Z
CVE-2023-1065 
This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any direct security risk and no user data can be leaked. To exploit the vulnerability the attacker does not need to be authenticated to Snyk but does need to know the target's Integration ID (which may or may not be the same as the Organization ID, although this is an unpredictable UUID in either case).
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Snyk
product: Snyk Kubernetes Monitor
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Tesco CyberSecurity Team
Published: 2023-02-28T18:32:47.899Z
CVE-2023-1067 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2023-02-27T00:00:00.000Z
CVE-2023-1068 Download Read More Excerpt Link <= 1.6.0 - Cross-Site Request Forgery to Settings Update
The Download Read More Excerpt Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation on the read_more_excerpt_link_menu_options() function. This makes it possible for unauthenticated attackers to update he plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: teckel
product: Read More Excerpt Link
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-02-27T13:29:53.318Z
CVE-2023-1069 Complianz - GDPR/CCPA Cookie Consent < 6.4.2 - Contributor+ Stored XSS
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Complianz
default_status: unaffected
vendor: Unknown
product: Complianz Premium
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-03-27T15:37:34.972Z
CVE-2023-1070 External Control of File Name or Path in nilsteampassnet/teampass
External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: nilsteampassnet
product: nilsteampassnet/teampass
Published: 2023-02-27T00:00:00.000Z
CVE-2023-1071 
An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue from an epic.
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
Credits: lang: en
value: This vulnerability has been discovered internally by GitLab team.
Published: 2023-04-05T00:00:00.000Z
CVE-2023-1072 
An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details.
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [Nico Jones](https://gitlab.com/nico28) for reporting this vulnerability.
Published: 2023-03-09T00:00:00.000Z
CVE-2023-1073 
A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: kernel
Published: 2023-03-27T00:00:00.000Z
CVE-2023-1074 
A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service and someone connects to this service. This could allow a local user to starve resources, causing a denial of service.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: kernel
Published: 2023-03-27T00:00:00.000Z
CVE-2023-1075 
A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field that overlaps with rec->tx_ready.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: Linus kernel
Published: 2023-03-27T00:00:00.000Z
CVE-2023-1076 
A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.
Problem types: cwe_id: CWE-791
description: CWE-791
Affected products: vendor: n/a
product: Linux kernel
Published: 2023-03-27T00:00:00.000Z
CVE-2023-1077 
In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.
Problem types: cwe_id: CWE-843
description: CWE-843
Affected products: vendor: n/a
product: Linux kernel
Published: 2023-03-27T00:00:00.000Z
CVE-2023-1078 
A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: Linux kernel
Published: 2023-03-27T00:00:00.000Z
CVE-2023-1079 
A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: Linux kernel
Published: 2023-03-27T00:00:00.000Z
CVE-2023-1080 GN Publisher <= 1.5.5 - Reflected Cross-Site Scripting
The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: gnpublisher
product: GN Publisher: Google News Compatible RSS Feeds
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2023-02-28T12:52:17.573Z
CVE-2023-1081 Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2023-02-28T00:00:00.000Z
CVE-2023-1082 Welotec: Command injection vulnerability in TK500v1 router series
An remote attacker with low privileges can perform a command injection which can lead to root access.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Welotec
product: TK515L
default_status: unaffected
vendor: Welotec
product: TK515L Set
default_status: unaffected
vendor: Welotec
product: TK515L-W
default_status: unaffected
vendor: Welotec
product: TK515L-W Set
default_status: unaffected
vendor: Welotec
product: TK525L
default_status: unaffected
vendor: Welotec
product: TK525L Set
default_status: unaffected
vendor: Welotec
product: TK525L-W
default_status: unaffected
vendor: Welotec
product: TK525L-W Set
default_status: unaffected
vendor: Welotec
product: TK525U
default_status: unaffected
vendor: Welotec
product: TK525U Set
default_status: unaffected
vendor: Welotec
product: TK525W
default_status: unaffected
vendor: Welotec
product: TK525W Set
default_status: unaffected
vendor: Welotec
product: TK535L1
default_status: unaffected
vendor: Welotec
product: TK535L1 Set
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: BSI
Published: 2024-04-09T08:25:34.716Z
CVE-2023-1083 Welotec: improper access control in TK500v1 router series
An unauthenticated remote attacker who is aware of a MQTT  topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Welotec
product: TK515L
default_status: unaffected
vendor: Welotec
product: TK515L Set
default_status: unaffected
vendor: Welotec
product: TK515L-W
default_status: unaffected
vendor: Welotec
product: TK515L-W Set
default_status: unaffected
vendor: Welotec
product: TK525L
default_status: unaffected
vendor: Welotec
product: TK525L Set
default_status: unaffected
vendor: Welotec
product: TK525L-W
default_status: unaffected
vendor: Welotec
product: TK525L-W Set
default_status: unaffected
vendor: Welotec
product: TK525U
default_status: unaffected
vendor: Welotec
product: TK525U Set
default_status: unaffected
vendor: Welotec
product: TK525W
default_status: unaffected
vendor: Welotec
product: TK525W Set
default_status: unaffected
vendor: Welotec
product: TK535L1
default_status: unaffected
vendor: Welotec
product: TK535L1 Set
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: BSI
Published: 2024-04-09T08:25:46.915Z
CVE-2023-1084 
An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request.
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
Credits: lang: en
value: Thanks [@shubham_sohi](https://hackerone.com/shubham_sohi,) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-03-09T00:00:00.000Z
CVE-2023-1086 Preview Link Generator < 1.0.4  - Arbitrary Plugin Activation via CSRF
The Preview Link Generator WordPress plugin before 1.0.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Preview Link Generator
default_status: unaffected
Credits: lang: en
value: WPScan
lang: en
value: WPScan
Published: 2023-03-27T15:37:36.168Z
CVE-2023-1087 WC Sales Notification < 1.2.3 - Arbitrary Plugin Activation via CSRF
The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WC Sales Notification
default_status: unaffected
Credits: lang: en
value: WPScan
lang: en
value: WPScan
Published: 2023-03-27T15:37:45.104Z
CVE-2023-1088 WP Plugin Manager < 1.1.8 - Arbitrary Plugin Activation via CSRF
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP Plugin Manager
default_status: unaffected
Credits: lang: en
value: WPScan
lang: en
value: WPScan
Published: 2023-03-27T15:37:18.954Z
CVE-2023-1089 Coupon Zen < 1.0.6 - Arbitrary Plugin Activation via CSRF
The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Coupon Zen
default_status: unaffected
Credits: lang: en
value: WPScan
lang: en
value: WPScan
Published: 2023-03-27T15:37:20.593Z
CVE-2023-1090 WP SMTP Mailing Queue < 2.0.1 - Admin+ Stored XSS
The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: SMTP Mailing Queue
default_status: unaffected
Credits: lang: en
value: jidle
lang: en
value: WPScan
Published: 2023-05-02T07:04:58.593Z
CVE-2023-1091 SQL Injection found in ALPATA's Licensed Warehousing Automation System
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpata Licensed Warehousing Automation System allows Command Line Execution through SQL Injection.

This issue affects Licensed Warehousing Automation System: through 2023.1.01.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Alpata
product: Licensed Warehousing Automation System
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Resul Melih MACIT
Published: 2023-03-10T07:02:09.307Z
CVE-2023-1092 OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: MiniOrange
product: OAuth Single Sign On Free
default_status: unaffected
vendor: MiniOrange
product: OAuth Single Sign On Standard
default_status: unaffected
vendor: MiniOrange
product: OAuth Single Sign On Premium
default_status: unaffected
vendor: MiniOrange
product: OAuth Single Sign On Enterprise
default_status: unaffected
Credits: lang: en
value: Nguyen Thuc Tuyen
lang: en
value: WPScan
Published: 2023-03-27T15:39:36.079Z
CVE-2023-1093 OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: OAuth Single Sign On
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-03-27T15:37:22.994Z
CVE-2023-1094 
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food parameter.
Problem types: description: Stored cross-site scripting (XSS)
Affected products: vendor: n/a
product: MonicaHQ
Published: 2023-05-08T00:00:00.000Z
CVE-2023-1095 
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Linux kernel netfilter subsystem.
Published: 2023-02-28T00:00:00.000Z
CVE-2023-1096 
SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to gain access as an admin user.
Problem types: description: Authentication Bypass
Affected products: vendor: n/a
product: SnapCenter
Published: 2023-05-12T00:00:00.000Z
CVE-2023-1097 Unauthenticated Command Injection EG7035-M11 Series
Baicells EG7035-M11 devices with firmware through  BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party analyst and have been confirmed exploitable special thanks to Lionel Musonza for the discovery.






Problem types: cwe_id: CWE-94
description:  CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Baicells
product: EG7035-M11
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lionel Musonza
lang: en
value: Baicells Security Team
Published: 2023-03-01T19:29:26.456Z
CVE-2023-1098 
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.
Problem types: description: Information exposure through an error message in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [tennox_](https://hackerone.com/tennox_) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-04-05T00:00:00.000Z