rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-3632 Hard-coded Cryptographic Key in Kunduz - Homework Helper App
Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, Authentication Bypass.

This issue affects Kunduz - Homework Helper App: before 6.2.3.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: Sifir Bes Education and Informatics
product: Kunduz - Homework Helper App
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Gokhan CICEK
Published: 2023-08-09T08:05:57.144Z
CVE-2023-3633 Out of Bounds Memory Corruption Issue in CEVA Engine
An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Bitdefender
product: Engines
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-07-14T19:29:34.392Z
CVE-2023-3634 Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.
Problem types: cwe_id: CWE-1242
description: CWE-1242 Inclusion of Undocumented Features or Chicken Bits
Affected products: vendor: Festo
product: MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD
default_status: unaffected
vendor: Festo
product: MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L5-AGD
default_status: unaffected
vendor: Festo
product: MSE6-C2M-5000-FB43-D-M-RG-BAR-M12L4-MQ1-AGD
default_status: unaffected
vendor: Festo
product: MSE6-C2M-5000-FB43-D-M-RG-BAR-M12L5-MQ1-AGD
default_status: unaffected
vendor: Festo
product: MSE6-C2M-5000-FB44-D-M-RG-BAR-AMI-AGD
default_status: unaffected
vendor: Festo
product: MSE6-C2M-5000-FB44-D-RG-BAR-AMI-AGD
default_status: unaffected
vendor: Festo
product: MSE6-D2M-5000-CBUS-S-RG-BAR-VCB-AGD
default_status: unaffected
vendor: Festo
product: MSE6-E2M-5000-FB13-AGD
default_status: unaffected
vendor: Festo
product: MSE6-E2M-5000-FB36-AGD
default_status: unaffected
vendor: Festo
product: MSE6-E2M-5000-FB37-AGD
default_status: unaffected
vendor: Festo
product: MSE6-E2M-5000-FB43-AGD
default_status: unaffected
vendor: Festo
product: MSE6-E2M-5000-FB44-AGD
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-04-16T04:40:29.960Z
CVE-2023-3635 Okio GzipSource unhandled exception Denial of Service
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.


Problem types: cwe_id: CWE-195
description: CWE-195: Signed to Unsigned Conversion Error
Affected products: default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-07-12T18:34:31.609Z
CVE-2023-3636 WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'save_users_map_name' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'usernames' parameter.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: wedevs
product: Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Chloe Chamberland
lang: en
value: István Márton
Published: 2023-08-31T05:33:09.460Z
CVE-2023-3637 Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Problem types: cwe_id: CWE-400
description: Uncontrolled Resource Consumption
Affected products: vendor: Red Hat
product: Red Hat OpenStack Platform 16.2
cpes: cpe:/a:redhat:openstack:16.2::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 13 (Queens) Operational Tools
cpes: cpe:/a:redhat:openstack-optools:13
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 16.1
cpes: cpe:/a:redhat:openstack:16.1
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenStack Platform 17.0
cpes: cpe:/a:redhat:openstack:17.0
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenStack Platform 17.1
cpes: cpe:/a:redhat:openstack:17.1
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenStack Platform 18.0
cpes: cpe:/a:redhat:openstack:18.0
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-07-25T12:47:31.531Z
CVE-2023-3638 GeoVision GV-ADR2701 Improper Authentication
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.


Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: GeoVision 
product: GV-ADR2701
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-07-19T14:22:13.198Z
CVE-2023-3640 Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space
A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize per-cpu entry area' feature was implemented in /arch/x86/mm/cpu_entry_area.c, which works through the init_cea_offsets() function when KASLR is enabled. However, despite this feature, there is still a risk of per-cpu entry area leaks. This issue could allow a local user to gain access to some important data with memory in an expected location and potentially escalate their privileges on the system.
Problem types: cwe_id: CWE-203
description: Observable Discrepancy
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank 77pray (Syclover Security Team) for reporting this issue.
Published: 2023-07-24T15:19:29.983Z
CVE-2023-3641 khodakhah NodCMS POST Request blog-comment-4 cross site scripting
A vulnerability has been found in khodakhah NodCMS 3.4.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /en/blog-comment-4 of the component POST Request Handler. The manipulation of the argument comment_name/comment_content leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233887.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: khodakhah
product: NodCMS
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: skalvin (VulDB User)
Published: 2023-07-12T16:31:03.571Z
CVE-2023-3642 GZ Scripts Vacation Rental Website HTTP POST Request cross site scripting
A vulnerability was found in GZ Scripts Vacation Rental Website 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /VacationRentalWebsite/property/8/ad-has-principes/ of the component HTTP POST Request Handler. The manipulation of the argument username/title/comment leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233888.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: GZ Scripts
product: Vacation Rental Website
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: skalvin (VulDB User)
Published: 2023-07-12T17:00:03.821Z
CVE-2023-3643 Boss Mini document file inclusion
A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233889 was assigned to this vulnerability.
Problem types: cwe_id: CWE-73
description: CWE-73 File Inclusion
Affected products: vendor: n/a
product: Boss Mini
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: nltt0 (VulDB User)
Published: 2023-07-12T17:31:03.036Z
CVE-2023-3644 SourceCodester Service Provider Management System sql injection
A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /classes/Master.php?f=save_inquiry. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. VDB-233890 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Service Provider Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: TsingShui (VulDB User)
Published: 2023-07-12T18:00:04.970Z
CVE-2023-3645 Contact Form Builder by Bit Form < 2.2.0 - Admin+ Stored XSS
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Contact Form Builder by Bit Form
default_status: unaffected
Credits: lang: en
value: Dipak Panchal (th3.d1pak)
lang: en
value: WPScan
Published: 2023-08-14T19:10:16.523Z
CVE-2023-3646 On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.

Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Arista Networks
product: EOS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-08-29T16:31:57.668Z
CVE-2023-3647 IURNY by INDIGITALL < 3.2.3 - Admin+ Stored XSS
The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: IURNY by INDIGITALL
default_status: unaffected
Credits: lang: en
value: Dipak Panchal (th3.d1pak)
lang: en
value: WPScan
Published: 2024-01-16T15:54:00.796Z
CVE-2023-3648 Mismatched Memory Management Routines in Wireshark
Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file
Problem types: cwe_id: CWE-762
description: CWE-762: Mismatched Memory Management Routines
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2023-07-14T06:16:33.827Z
CVE-2023-3649 Buffer Over-read in Wireshark
iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2023-07-14T06:16:45.767Z
CVE-2023-3650 Bubble Menu < 3.0.5 - Admin+ Stored XSS 
The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Bubble Menu
default_status: unaffected
Credits: lang: en
value: Dipak Panchal (th3.d1pak)
lang: en
value: WPScan
Published: 2023-08-07T14:31:19.068Z
CVE-2023-3651 SQLi in Digital Ant E-Commerce Software
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Ant E-Commerce Software allows SQL Injection.

This issue affects E-Commerce Software: before 11.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Digital Ant
product: E-Commerce Software
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Kaan GUMUS
Published: 2023-08-08T14:39:15.109Z
CVE-2023-3652 Reflected XSS in Digital Ant E-Commerce Software
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Reflected XSS.

This issue affects E-Commerce Software: before 11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Digital Ant
product: E-Commerce Software
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Kaan GUMUS
Published: 2023-08-08T14:40:50.144Z
CVE-2023-3653 Stored XSS in Digital Ant E-Commerce Software
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Stored XSS.

This issue affects E-Commerce Software: before 11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Digital Ant
product: E-Commerce Software
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Resul Melih MACIT
Published: 2023-08-08T14:42:18.887Z
CVE-2023-3654 Origin Check Bypass
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the host header in an HTTP request. This vulnerability can be triggered by an HTTP endpoint exposed to the network.

Problem types: cwe_id: CWE-346
description: CWE-346 Origin Validation Error
Affected products: vendor: PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH
product: cashIT! - serving solutions.
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Michael Roland
lang: en
value: Tobias Höller
lang: en
value: Daniel Hofer
lang: en
value: Daniel Pekarek
lang: en
value: Michael Preisach
Published: 2023-10-03T08:10:48.186Z
CVE-2023-3655 Unauthenticated Remote Database Exfiltration
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that allows to leak the database (system settings, user accounts,...). This vulnerability can be triggered by an HTTP endpoint exposed to the network.

Problem types: cwe_id: CWE-749
description: CWE-749 Exposed Dangerous Method or Function
Affected products: vendor: PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH
product: cashIT! - serving solutions.
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Michael Roland
lang: en
value: Tobias Höller
lang: en
value: Daniel Hofer
lang: en
value: Daniel Pekarek
lang: en
value: Michael Preisach
Published: 2023-10-03T07:53:13.467Z
CVE-2023-3656 Unauthenticated Remote Code Execution
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network.
Problem types: cwe_id: CWE-749
description: CWE-749 Exposed Dangerous Method or Function
cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH
product: cashIT! - serving solutions.
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Roland
lang: en
value: Tobias Höller
lang: en
value: Daniel Hofer
lang: en
value: Daniel Pekarek
lang: en
value: Michael Preisach
Published: 2023-10-03T07:39:53.661Z
CVE-2023-3657 SourceCodester AC Repair and Services System HTTP POST Request sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. This issue affects some unknown processing of the file Master.php?f=save_book of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-234011.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: AC Repair and Services System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: fushuling (VulDB User)
Published: 2023-07-13T10:00:05.373Z