rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-28316 
A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.
Problem types: cwe_id: CWE-384
description: Session Fixation (CWE-384)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2023-05-09T00:00:00.000Z
CVE-2023-28317 
A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2023-05-09T00:00:00.000Z
CVE-2023-28318 
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2023-05-09T00:00:00.000Z
CVE-2023-28319 
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2023-05-26T00:00:00.000Z
CVE-2023-28320 
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2023-05-26T00:00:00.000Z
CVE-2023-28321 
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation (CWE-295)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2023-05-26T00:00:00.000Z
CVE-2023-28322 
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2023-05-26T00:00:00.000Z
CVE-2023-28323 
A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS (Operating System) vulnerabilities to escalate privileges on the machine or be used as a stepping stone to get to other network attached machines.

Affected products: vendor: Ivanti
product: Ivanti Endpoint Manager
default_status: unaffected
Published: 2023-06-30T23:40:30.788Z
CVE-2023-28324 
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution.
Affected products: vendor: Ivanti
product: Ivanti Endpoint Manager
default_status: unaffected
Published: 2023-06-30T23:40:19.571Z
CVE-2023-28325 
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2023-05-11T00:00:00.000Z
CVE-2023-28326 Apache OpenMeetings: allows user impersonation
Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0

Description: Attacker can elevate their privileges in any room



Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Apache Software Foundation
product: Apache OpenMeetings
default_status: unaffected
Credits: lang: en
value: Dennis Zimmt
Published: 2023-03-28T12:36:11.566Z
CVE-2023-28327 
A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Linux
Published: 2023-04-19T00:00:00.000Z
CVE-2023-28328 
A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Linux
Published: 2023-04-19T00:00:00.000Z
CVE-2023-28329 Moodle: authenticated sql injection via availability check
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: default_status: unaffected
Published: 2023-03-23T00:00:00.000Z
CVE-2023-28330 Moodle: authenticated arbitrary file read through malformed backup file
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Problem types: cwe_id: CWE-20
description: Improper Input Validation
Affected products: default_status: unaffected
Published: 2023-03-23T00:00:00.000Z
CVE-2023-28331 Moodle: xss risk when outputting database activity filter data
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: default_status: unaffected
Published: 2023-03-23T00:00:00.000Z
CVE-2023-28332 Moodle: algebra filter xss when filter is misconfigured
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: default_status: unaffected
Published: 2023-03-23T00:00:00.000Z
CVE-2023-28333 Moodle: pix helper potential mustache code injection risk
The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).
Problem types: cwe_id: CWE-94
description: Improper Control of Generation of Code ('Code Injection')
Affected products: default_status: unaffected
Published: 2023-03-23T00:00:00.000Z
CVE-2023-28334 Moodle: users' name enumeration possible via idor on learning plans page
Authenticated users were able to enumerate other users' names via the learning plans page.
Problem types: cwe_id: CWE-200
description: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: default_status: unaffected
Published: 2023-03-23T00:00:00.000Z
CVE-2023-28335 Moodle: csrf risk in resetting all templates of a database activity
The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: default_status: unaffected
Published: 2023-03-23T00:00:00.000Z
CVE-2023-28336 Moodle: teacher can access names of users they do not have permission to access
Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.
Problem types: cwe_id: CWE-200
description: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: default_status: unaffected
Published: 2023-03-23T00:00:00.000Z
CVE-2023-28337 
When uploading a firmware image to a Netgear Nighthawk Wifi6 Router (RAX30), a hidden “forceFWUpdate” parameter may be provided to force the upgrade to complete and bypass certain validation checks. End users can use this to upload modified, unofficial, and potentially malicious firmware to the device.
Problem types: description: Signature Bypass
Affected products: vendor: n/a
product: NETGEAR Nighthawk WiFi6 Router (RAX30)
Published: 2023-03-15T00:00:00.000Z
CVE-2023-28338 
Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result in the request body being written to “/tmp/mulipartFile” on the device itself. A sufficiently large file will cause device resources to be exhausted, resulting in the device becoming unusable until it is rebooted.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: NETGEAR Nighthawk WiFi6 Router (RAX30)
Published: 2023-03-15T00:00:00.000Z
CVE-2023-28339 
OpenDoas through 6.8.2, when TIOCSTI is available, allows privilege escalation because of sharing a terminal with the original session. NOTE: TIOCSTI is unavailable in OpenBSD 6.0 and later, and can be made unavailable in the Linux kernel 6.2 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-14T00:00:00.000Z
CVE-2023-28340 
Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2023-28341 
Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2023-28342 
Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-05T00:00:00.000Z
CVE-2023-28343 
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-14T00:00:00.000Z
CVE-2023-28344 
An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly updated screenshots of student desktops and to submit falsified screenshots on behalf of students. Attackers are able to view screenshots of student desktops without their consent. These screenshots may potentially contain sensitive/personal data. Attackers can also rapidly submit falsified images, hiding the actual contents of student desktops from the Teacher Console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-28345 
An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to the affected endpoint and obtain the teacher's password. This enables them to log into the Teacher Console and begin trivially attacking student machines.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-28346 
An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate with the private API endpoints exposed at /login, /consoleSettings, /console, etc. despite Virtual Host Routing being used to block this access. Remote attackers can interact with private pages on the web server, enabling them to perform privileged actions such as logging into the console and changing console settings if they have valid credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-28347 
An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that functions similarly to a Student Console, providing unauthenticated attackers with the ability to exploit XSS vulnerabilities within the Teacher Console application and achieve remote code execution as NT AUTHORITY/SYSTEM on all connected Student Consoles and the Teacher Console in a Zero Click manner.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-28348 
An issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker could perform a man-in-the-middle attack on either a connected student or teacher, enabling them to intercept student keystrokes or modify executable files being sent from teachers to students.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-28349 
An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be compelled to write arbitrary files to arbitrary locations on disk with NT AUTHORITY/SYSTEM level permissions, enabling remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-28350 
An issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized before being rendered in both the Teacher and Student Console applications, enabling an attacker to execute JavaScript in these applications. Due to the rich and highly privileged functionality offered by the Teacher Console, the ability to silently exploit Cross Site Scripting (XSS) on the Teacher Machine enables remote code execution on any connected student machine (and the teacher's machine).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-28351 
An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with the Student application installed is logged to a world-readable directory. A local attacker can trivially extract these cleartext keystrokes, potentially enabling them to obtain PII and/or to compromise personal accounts owned by the victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-28352 
An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery system, an attacker-controlled artificial Student Console can connect to and attack a Teacher Console even after Enhanced Security Mode has been enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-28353 
An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to chain this vulnerability with others to cause a deployed DLL file to immediately execute as NT AUTHORITY/SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-28354 
An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against affected targets, specifying known NRPE plugins, which in default installations are configured to accept command control characters and pass them to command-line interpreters for NRPE plugin execution. This allows the attacker to escape NRPE plugin execution and execute commands remotely on the target as NT_AUTHORITY\SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-09T00:00:00.000Z
CVE-2023-28356 
A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one of the processes, consuming ~120% CPU and rendering the service unresponsive.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2023-05-11T00:00:00.000Z
CVE-2023-28357 
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a member of a channel that they do not have access to.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2023-05-11T00:00:00.000Z
CVE-2023-28358 
A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2023-05-11T00:00:00.000Z
CVE-2023-28359 
A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the potential for limited impact.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2023-05-11T00:00:00.000Z
CVE-2023-28360 
An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no download safety check dialog presented to the user.
Problem types: cwe_id: CWE-223
description: Omission of Security-relevant Information (CWE-223)
Affected products: vendor: n/a
product: https://laptop-updates.brave.com/latest/winx64
Published: 2023-05-11T00:00:00.000Z
CVE-2023-28361 
A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM ProfessionalUDM SEUDRMitigation:Update affected products to UniFi OS 3.0.13 or later.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: UniFi OS
Published: 2023-05-11T00:00:00.000Z
CVE-2023-28362 
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
Affected products: vendor: Rails
product: Action Pack
default_status: unaffected
Published: 2025-01-09T00:33:47.730Z
CVE-2023-28364 
An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned URLs automatically without showing the URL first. Now the user must manually navigate to the URL.
Affected products: vendor: Brave Software
product: Brave Browser Android
default_status: unaffected
Published: 2023-06-30T23:20:12.719Z
CVE-2023-28365 
A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored.
Affected products: vendor: Ubiquiti Inc.
product: UniFi Network application
default_status: unaffected
Published: 2023-06-30T23:40:13.388Z
CVE-2023-28366 
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-01T00:00:00.000Z
CVE-2023-28367 
Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script.
Problem types: description: Cross-site scripting
Affected products: vendor: Vektor,Inc.
product: VK All in One Expansion Unit
Published: 2023-05-23T00:00:00.000Z
CVE-2023-28368 
TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator may be tricked to login to the fake device, the credential information for the affected device may be obtained.
Problem types: description: Use of weak credentials
Affected products: vendor: TP-Link Corporation Limited
product: T2600G-28SQ
Published: 2023-04-11T00:00:00.000Z