rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-5985 



A CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability
exists that could cause compromise of a user’s browser when an attacker with admin privileges
has modified system values.




Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Schneider Electric
product: ION8650
default_status: unaffected
vendor: Schneider Electric
product: ION8800 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-11-15T03:35:17.617Z
CVE-2023-5986 

A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input
attackers can cause the software’s web application to redirect to the chosen domain after a
successful login is performed. 



Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Schneider Electric
product: EcoStruxure Power Monitoring Expert (PME)
default_status: unaffected
vendor: Schneider Electric
product: EcoStruxure Power Operation (EPO) – Advanced Reporting and Dashboards Module
default_status: unaffected
vendor: Schneider Electric
product: EcoStruxure Power SCADA Operation (PSO) - Advanced Reporting and Dashboards Module
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
version: 3.1
Published: 2023-11-15T03:47:17.684Z
CVE-2023-5987 

A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
vulnerability that could cause a vulnerability leading to a cross site scripting condition where
attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing
the injected payload.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Schneider Electric
product: EcoStruxure Power Monitoring Expert (PME)
default_status: unaffected
vendor: Schneider Electric
product: EcoStruxure Power Operation (EPO) – Advanced Reporting and Dashboards Module
default_status: unaffected
vendor: Schneider Electric
product: EcoStruxure Power SCADA Operation (PSO) - Advanced Reporting and Dashboards Module
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-11-15T03:48:50.993Z
CVE-2023-5988 Reflected XSS in Uyumsoft ERP
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies LioXERP allows Reflected XSS.

This issue affects LioXERP: before v.146.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Uyumsoft Information System and Technologies
product: LioXERP
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Yusuf Kamil Çavuşoğlu
Published: 2023-12-21T09:40:25.554Z
CVE-2023-5989 Stored XSS in Uyumsoft ERP
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies' LioXERP allows an authenticated user to execute Stored XSS.



This issue affects LioXERP: before v.146.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Uyumsoft Information System and Technologies
product: LioXERP
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Yusuf Kamil Çavuşoğlu
Published: 2023-12-21T09:45:37.933Z
CVE-2023-5990 Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor
default_status: unaffected
Credits: lang: en
value: Nguyen Duc Manh
lang: en
value: WPScan
Published: 2023-12-04T21:29:10.777Z
CVE-2023-5991 Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Hotel Booking Lite
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając (CERT PL)
lang: en
value: WPScan
Published: 2023-12-26T18:33:14.275Z
CVE-2023-5992 Opensc: side-channel leaks while stripping encryption pkcs#1 padding
A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.
Problem types: cwe_id: CWE-203
description: Observable Discrepancy
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: This issue was discovered by Hubert Kario (Red Hat).
Published: 2024-01-31T14:05:07.630Z
CVE-2023-5993 Privilege Escalation in SafeNet Authentication Client Installer
A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Thales
product: SafeNet Authentication Client
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kravets Vasiliy, xi-tauw@xi-tauw.info
Published: 2024-02-27T10:42:08.287Z
CVE-2023-5995 Incorrect Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-12-01T07:01:28.253Z
CVE-2023-5996 
Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2023-11-08T19:18:30.927Z
CVE-2023-5997 
Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2023-11-15T17:19:43.599Z
CVE-2023-5998 Out-of-bounds Read in gpac/gpac
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: gpac
product: gpac/gpac
Published: 2023-11-07T18:45:03.305Z
CVE-2023-6000 Popup Builder < 4.2.3 - Unauthenticated Stored XSS
The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Popup Builder
default_status: unaffected
Credits: lang: en
value: Marc Montpas
lang: en
value: WPScan
Published: 2024-01-01T14:18:56.633Z
CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication
Prometheus metrics are available without
authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: YugabyteDB
product: YugabyteDB Anywhere
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-11-07T23:25:16.135Z
CVE-2023-6002 Log Injection
YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

Problem types: cwe_id: CWE-117
description: CWE-117: Improper Output Neutralization for Logs
Affected products: vendor: YugabyteDB
product: YugabyteDB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2023-11-07T23:56:50.729Z
CVE-2023-6004 Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
Problem types: cwe_id: CWE-74
description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Norbert Pocs (libssh) and vinci@protonmail.ch for reporting this issue.
Published: 2024-01-03T17:01:38.672Z
CVE-2023-6005 EventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site Scripting
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: EventON
default_status: unaffected
vendor: Unknown
product: EventON
default_status: unaffected
Credits: lang: en
value: Miguel Santareno
lang: en
value: WPScan
Published: 2024-01-16T15:57:01.802Z
CVE-2023-6006 Privilege Escalation Vulnerability
This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access to the C Drive. In addition, Print Archiving must be enabled or the attacker needs to encounter a misconfigured system. This vulnerability does not apply to PaperCut NG installs that have Print Archiving enabled and configured as per the recommended set up procedure. This specific flaw exists within the pc-pdl-to-image process. The process loads an executable from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM

Note: This CVE has been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard network users on the host server.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: PaperCut
product: PaperCut NG, PaperCut MF
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Amol Dosanjh of Trend Micro
lang: en
value: Michael DePlante(@izobashi) of Trend Micro's ZDI
Published: 2023-11-14T04:04:03.280Z
CVE-2023-6007 UserPro <= 5.1.1 - Missing Authorization via multiple functions
The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.1.1. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: n/a
product: UserPro - Community and User Profile WordPress Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseScore: 7.3
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-11-22T15:33:25.681Z
CVE-2023-6008 UserPro <= 5.1.1 - Cross-Site Request Forgery via multiple functions
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: n/a
product: UserPro - Community and User Profile WordPress Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
baseScore: 6.3
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-11-22T15:33:38.202Z
CVE-2023-6009 UserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation
The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_update_user_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: n/a
product: UserPro - Community and User Profile WordPress Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-11-22T15:33:37.741Z
CVE-2023-6011 Stored XSS in Geodi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DECE Software Geodi allows Stored XSS.

This issue affects Geodi: before 8.0.0.27396.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: DECE Software
product: Geodi
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Serhat YAPICI
Published: 2023-11-22T09:06:44.398Z
CVE-2023-6012 Incorrect input data validation in Lanaccess ONSAFE MonitorHM Web Console
An improper input validation vulnerability has been found in Lanaccess ONSAFE MonitorHM affecting version 3.7.0. This vulnerability could lead a remote attacker to exploit the checkbox element and perform remote code execution, compromising the entire infrastructure.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lanaccess
product: ONSAFE MonitorHM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Petar Alexandrov Nikolov
Published: 2023-11-08T10:36:42.719Z
CVE-2023-6013 H2O Local File Include
H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: h2oai
product: h2oai/h2o-3
Published: 2023-11-16T16:07:17.441Z
CVE-2023-6014 MLflow Authentication Bypass
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
Problem types: cwe_id: CWE-598
description: CWE-598 Use of GET Request Method With Sensitive Query Strings
Affected products: vendor: mlflow
product: mlflow/mlflow
Published: 2023-11-16T21:07:36.577Z
CVE-2023-6015 MLflow Arbitrary File Upload
MLflow allowed arbitrary files to be PUT onto the server.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: mlflow
product: mlflow/mlflow
Published: 2023-11-16T16:06:11.032Z
CVE-2023-6016 H2O Remote Code Execution via POJO Model Import
An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code
Affected products: vendor: h2oai
product: h2oai/h2o-3
Published: 2023-11-16T16:06:24.520Z
CVE-2023-6017 H2O S3 Bucket Takeover
H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: h2oai
product: h2oai/h2o-3
Published: 2023-11-16T16:07:01.811Z
CVE-2023-6018 MLflow Arbitrary File Write
An attacker can overwrite any file on the server hosting MLflow without any authentication.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected products: vendor: mlflow
product: mlflow/mlflow
Published: 2023-11-16T16:05:14.579Z
CVE-2023-6019 Ray Command Injection in cpu_profile Parameter
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected products: vendor: ray-project
product: ray-project/ray
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-11-16T16:12:07.652Z
CVE-2023-6020 Ray Static File Local File Include
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: ray-project
product: ray-project/ray
Published: 2023-11-16T21:07:33.774Z