rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-2480 Elevation of Privilege in M-Files Desktop Client
Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications
Problem types: cwe_id: CWE-280
description: CWE-280 Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: M-Files
product: M-Files Client
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-05-25T13:28:29.204Z
CVE-2023-2481 Key duplication in GSDK

Compiler removal of buffer clearing in 



sli_se_opaque_import_key


 in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


Problem types: cwe_id: CWE-14
description: CWE-14: Compiler Removal of Code to Clear Buffers
Affected products: vendor: silabs.com
product: Gecko Platform
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-05-18T18:44:48.742Z
CVE-2023-2482 Responsive CSS EDITOR <= 1.0 - Admin+ SQLi
The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Responsive CSS EDITOR
default_status: affected
Credits: lang: en
value: Chien Vuong
lang: en
value: WPScan
Published: 2023-06-27T13:17:10.255Z
CVE-2023-2484 Active Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injection
The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: cyberlord92
product: Active Directory Integration / LDAP Integration
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Marco Wotschka
Published: 2023-06-09T05:33:14.991Z
CVE-2023-2485 Incorrect Privilege Assignment in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.
Problem types: cwe_id: CWE-266
description: CWE-266: Incorrect Privilege Assignment
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Thanks [theluci](https://hackerone.com/theluci) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-06-07T00:00:00.000Z
CVE-2023-2487 WordPress WP Ultimate Exporter Plugin <= 2.4.1 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Smackcoders
product: Export All Posts, Products, Orders, Refunds & Users
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Jonas Höbenreich (Patchstack Alliance)
Published: 2023-12-21T14:08:49.034Z
CVE-2023-2488 Stop Spammers Security < 2023 - Reflected XSS
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Stop Spammers Security | Block Spam Users, Comments, Forms
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-06-05T13:38:59.394Z
CVE-2023-2489 Stop Spammers Security < 2023 - Admin+ Stored XSS
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Stop Spammers Security | Block Spam Users, Comments, Forms
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-06-05T13:38:59.037Z
CVE-2023-2490 WordPress UserAgent-Spy Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fernando Briano UserAgent-Spy plugin <= 1.3.1 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Fernando Briano
product: UserAgent-Spy
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Yash Kanchhal (Patchstack Alliance)
Published: 2023-05-11T09:46:03.191Z
CVE-2023-2491 
A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Problem types: cwe_id: CWE-77
description: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: n/a
product: emacs
Published: 2023-05-17T00:00:00.000Z
CVE-2023-2492 QueryWall: Plug'n Play Firewall <= 1.1.1 - Admin+ SQLi
The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: QueryWall: Plug'n Play Firewall
default_status: affected
Credits: lang: en
value: Chien Vuong
lang: en
value: WPScan
Published: 2023-06-19T10:52:44.610Z
CVE-2023-2493 All In One Redirection < 2.2.0 - Admin+ SQLi
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: All In One Redirection
default_status: unaffected
Credits: lang: en
value: Chien Vuong
lang: en
value: WPScan
Published: 2023-07-10T12:40:10.450Z
CVE-2023-2494 Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege Granting
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to modify access to the plugin when it should only be the administrator's privilege.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Granth
product: Go Pricing - WordPress Responsive Pricing Tables
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
baseScore: 4.6
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-05-23T23:36:47.546Z
CVE-2023-2495 Greeklish-permalink < 3.5 - Unauthenticated Post Slug Update
The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.
Problem types: description: CWE-269 Improper Privilege Management
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Greeklish-permalink
default_status: affected
Credits: lang: en
value: Jonas Höbenreich
lang: en
value: WPScan
Published: 2023-07-10T12:40:36.457Z
CVE-2023-2496 Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Improper Authorization to Arbitrary File Upload
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability check on the 'validate_upload' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: Granth
product: Go Pricing - WordPress Responsive Pricing Tables
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.1
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-05-23T23:36:47.080Z
CVE-2023-2497 UserPro <= 5.1.0 - Cross-Site Request Forgery to PHP Object Injection
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers to exploit PHP Object Injection due to the use of unserialize() on the user supplied parameter via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: n/a
product: UserPro - Community and User Profile WordPress Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-11-22T15:33:39.114Z
CVE-2023-2498 Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.19 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Granth
product: Go Pricing - WordPress Responsive Pricing Tables
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-05-23T23:36:46.492Z
CVE-2023-2499 RegistrationMagic <= 5.2.1.0 - Authentication Bypass
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: metagauss
product: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: István Márton
Published: 2023-05-16T08:40:01.163Z
CVE-2023-2500 Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Subscriber+) PHP Object Injection
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'go_pricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Granth
product: Go Pricing - WordPress Responsive Pricing Tables
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-05-24T23:38:16.209Z
CVE-2023-2503 10WebSocial < 1.2.9 - Reflected XSS
The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: 10Web Social Post Feed
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-06-05T13:38:58.202Z
CVE-2023-2504 





Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials.





Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: BirdDog
product: STUDIO R3
default_status: unaffected
vendor: BirdDog
product: 4K QUAD
default_status: unaffected
vendor: BirdDog
product: MINI
default_status: unaffected
vendor: BirdDog
product: A300 EYES
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Alan Cao reported these vulnerabilities to CISA.
Published: 2023-05-22T21:10:48.553Z
CVE-2023-2505 

The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files.





Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: BirdDog
product: STUDIO R3
default_status: unaffected
vendor: BirdDog
product: 4K QUAD
default_status: unaffected
vendor: BirdDog
product: MINI
default_status: unaffected
vendor: BirdDog
product: A300 EYES
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Alan Cao reported these vulnerabilities to CISA.
Published: 2023-05-22T21:01:56.372Z
CVE-2023-2507 CleverTap Cordova Plugin 2.6.2 - Reflected XSS
CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker.

This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: CleverTap
product: Cordova Plugin
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2023-07-15T18:45:18.866Z
CVE-2023-2508 CSRF in PaperCutNG Mobility Print leads to sophisticated phishing
The `PaperCutNG Mobility Print` version 1.0.3512 application allows an

unauthenticated attacker to perform a CSRF attack on an instance

administrator to configure the clients host (in the "configure printer

discovery" section). This is possible because the application has no

protections against CSRF attacks, like Anti-CSRF tokens, header origin

validation, samesite cookies, etc.




Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: PaperCut MF/NG
product: Mobility Print
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Published: 2023-09-20T15:05:35.512Z
CVE-2023-2509 A Cross-Site Scripting(XSS) vulnerability was found on ADM
A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. An attacker can exploit this vulnerability to inject malicious scripts into the target applications to access any cookies or sensitive information retained by the browser and used with that application. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below, LooksGood 2.0.0.R129 and below and SoundsGood 2.3.0.r1027 and below.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ASUSTOR
product: ADM
default_status: unaffected
vendor: ASUSTOR
product: LooksGood
default_status: unaffected
vendor: ASUSTOR
product: SoundsGood
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Zhiyong Xing, Inner Mongolia Xinyuan Network Security Technology Co., Ltd., China
Published: 2023-05-17T06:33:37.536Z
CVE-2023-2512 Buffer under-read in workerd
Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the forEach() method could end up reading from the wrong location in memory while iterating over elements. This would most likely lead to a segmentation fault, but could theoretically allow arbitrary undefined behavior.


In order for the bug to be exploitable, the process would need to be able to allocate 160GB of RAM. Due to this, the bug was never exploitable on the Cloudflare Workers platform, but could theoretically be exploitable on deployments of workerd running on machines with a huge amount of memory. Moreover, in order to be remotely exploited, an attacker would have to upload a single form-encoded HTTP request of at least tens of gigabytes in size. The application code would then have to use request.formData() to parse the request and formData.forEach() to iterate over this data. Due to these limitations, the exploitation likelihood was considered Low.

A fix that addresses this vulnerability has been released in version v1.20230419.0 and users are encouraged to update to the latest version available.



Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Cloudflare
product: workerd
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
version: 3.1
Credits: lang: en
value: ubercomp
Published: 2023-05-12T10:09:06.905Z
CVE-2023-2513 
A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: Linux kernel ext4 filesystem
Published: 2023-05-08T00:00:00.000Z
CVE-2023-2514 DB username/password revealed in application logs
Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. 

Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Stylianos Rigas
Published: 2023-05-12T08:56:56.250Z