stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-3632 (severity: CRITICAL, weakness: CWE-321)
Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, Authentication Bypass.This issue affects Kunduz - Homework Helper App: before 6.2.3.
CVE-2023-36321 (severity: HIGH, weakness: CWE-120)
Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c.
CVE-2023-36325 (severity: LOW, weakness: CWE-203)
i2p before 2.3.0 (Java) allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation attack across the IPv4 and IPv6 addresses that occurs when a tunneled, replayed message has a behavior discrepancy (it may be dropped, or may result in a Wrong Destination response). An attack would take days to complete.
CVE-2023-36326 (severity: CRITICAL, weakness: CWE-190)
Integer Overflow vulnerability in RELIC before commit 34580d840469361ba9b5f001361cad659687b9ab, allows attackers to execute arbitrary code, cause a denial of service, and escalate privileges when calling realloc function in bn_grow function.
CVE-2023-36327 (severity: CRITICAL, weakness: CWE-190)
Integer Overflow vulnerability in RELIC before commit 421f2e91cf2ba42473d4d54daf24e295679e290e, allows attackers to execute arbitrary code and cause a denial of service in pos argument in bn_get_prime function.
CVE-2023-36328 (severity: CRITICAL, weakness: CWE-190)
Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).
CVE-2023-3633 (severity: HIGH, weakness: CWE-787)
An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower.
CVE-2023-36339 (severity: HIGH, weakness: CWE-863)
An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request.
CVE-2023-36340 (severity: CRITICAL, weakness: CWE-787)
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
CVE-2023-36344 (severity: HIGH, weakness: CWE-427)
An issue in Diebold Nixdorf Vynamic View Console v.5.3.1 and before allows a local attacker to execute arbitrary code via not restricting the search path for required DLLs and not verifying the signature.
CVE-2023-36345 (severity: HIGH, weakness: CWE-79)
A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.
CVE-2023-36346 (severity: MEDIUM, weakness: CWE-79)
POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.
CVE-2023-36347 (severity: HIGH, weakness: CWE-306)
A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.
CVE-2023-36348 (severity: HIGH, weakness: CWE-862)
POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter.
CVE-2023-3635 (severity: HIGH, weakness: CWE-195)
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
CVE-2023-36351 (severity: HIGH, weakness: NVD-CWE-Other)
An issue in Viatom Health ViHealth for Android v.2.74.58 and before allows a remote attacker to execute arbitrary code via the com.viatom.baselib.mvvm.webWebViewActivity component.
CVE-2023-36354 (severity: HIGH, weakness: CWE-120)
TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR740N V1/V2, TL-WR940N V2/V3, and TL-WR941ND V5/V6 were discovered to contain a buffer overflow in the component /userRpm/AccessCtrlTimeSchedRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVE-2023-36355 (severity: CRITICAL, weakness: CWE-120)
TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVE-2023-36356 (severity: HIGH, weakness: CWE-125)
TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8, TL-WR941ND V5, and TL-WR740N V1/V2 were discovered to contain a buffer read out-of-bounds via the component /userRpm/VirtualServerRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVE-2023-36357 (severity: HIGH, weakness: CWE-770)
An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVE-2023-36358 (severity: HIGH, weakness: CWE-120)
TP-Link TL-WR940N V2/V3/V4, TL-WR941ND V5/V6, TL-WR743ND V1 and TL-WR841N V8 were discovered to contain a buffer overflow in the component /userRpm/AccessCtrlAccessTargetsRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVE-2023-36359 (severity: HIGH, weakness: CWE-120)
TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR940N V2/V3 and TL-WR941ND V5/V6 were discovered to contain a buffer overflow in the component /userRpm/QoSRuleListRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVE-2023-3636 (severity: HIGH, weakness: NVD-CWE-Other)
The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'save_users_map_name' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'usernames' parameter.
CVE-2023-36361 (severity: CRITICAL, weakness: CWE-89)
Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter.
CVE-2023-36362 (severity: HIGH, weakness: CWE-89)
An issue in the rel_sequences component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-36363 (severity: HIGH, weakness: CWE-89)
An issue in the __nss_database_lookup component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-36364 (severity: HIGH, weakness: CWE-89)
An issue in the rel_deps component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-36365 (severity: HIGH, weakness: CWE-770)
An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-36366 (severity: HIGH, weakness: CWE-770)
An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crafted SQL statements.
CVE-2023-36367 (severity: HIGH, weakness: CWE-770)
An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-36368 (severity: HIGH, weakness: CWE-770)
An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-36369 (severity: HIGH, weakness: CWE-770)
An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-3637 (severity: MEDIUM, weakness: CWE-400)
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
CVE-2023-36370 (severity: HIGH, weakness: CWE-770)
An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-36371 (severity: HIGH, weakness: CWE-770)
An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-36375 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Guardian relation, complimentary address, city, permanent address, and city parameters in the Book Hostel & Room Details page.
CVE-2023-36376 (severity: MEDIUM, weakness: CWE-79)
Cross-Site Scripting (XSS) vulnerability in Hostel Management System v.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the add course section.
CVE-2023-36377 (severity: HIGH, weakness: CWE-120)
Buffer Overflow vulnerability in mtrojnar osslsigncode v.2.3 and before allows a local attacker to execute arbitrary code via a crafted .exe, .sys, and .dll files.
CVE-2023-3638 (severity: CRITICAL, weakness: CWE-287)
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.
CVE-2023-36380 (severity: HIGH, weakness: CWE-798)
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)). The affected devices contain a hard-coded ID in the SSH `authorized_keys` configuration file. An attacker with knowledge of the corresponding private key could login to the device via SSH. Only devices with activated debug support are affected.
CVE-2023-36381 (severity: HIGH, weakness: CWE-502)
Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5.
CVE-2023-36382 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 2.0.0 versions.
CVE-2023-36383 (severity: MEDIUM, weakness: CWE-79)
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.9.5 versions.
CVE-2023-36384 (severity: MEDIUM, weakness: CWE-79)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <= 1.2.40 versions.
CVE-2023-36385 (severity: MEDIUM, weakness: CWE-79)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpxpo PostX – Gutenberg Post Grid Blocks plugin <= 2.9.9 versions.
CVE-2023-36386 (severity: MEDIUM, weakness: CWE-79)
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link. The value is reflected in the response without sanitization while throwing an “invalid params element name” error on the get_elements parameters.
CVE-2023-36387 (severity: MEDIUM, weakness: CWE-863)
An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.
CVE-2023-36388 (severity: MEDIUM, weakness: CWE-918)
Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.
CVE-2023-36389 (severity: MEDIUM, weakness: CWE-79)
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link. The malformed value is reflected directly in the response without sanitization while throwing an “invalid path” error.
CVE-2023-36390 (severity: MEDIUM, weakness: CWE-79)
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link. The value is reflected in the response without sanitization while throwing an “invalid params element name” error on the action parameters.
CVE-2023-36391 (severity: HIGH, weakness: CWE-59)
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
CVE-2023-36392 (severity: HIGH, weakness: CWE-126)
DHCP Server Service Denial of Service Vulnerability
CVE-2023-36393 (severity: HIGH, weakness: CWE-426)
Windows User Interface Application Core Remote Code Execution Vulnerability
CVE-2023-36394 (severity: HIGH, weakness: CWE-59)
Windows Search Service Elevation of Privilege Vulnerability
CVE-2023-36395 (severity: HIGH, weakness: CWE-190)
Windows Deployment Services Denial of Service Vulnerability
CVE-2023-36396 (severity: HIGH, weakness: CWE-41)
Windows Compressed Folder Remote Code Execution Vulnerability
CVE-2023-36397 (severity: CRITICAL, weakness: CWE-126)
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVE-2023-36398 (severity: MEDIUM, weakness: CWE-908)
Windows NTFS Information Disclosure Vulnerability
CVE-2023-36399 (severity: HIGH, weakness: CWE-59)
Windows Storage Elevation of Privilege Vulnerability
CVE-2023-3640 (severity: HIGH, weakness: CWE-203)
A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize per-cpu entry area' feature was implemented in /arch/x86/mm/cpu_entry_area.c, which works through the init_cea_offsets() function when KASLR is enabled. However, despite this feature, there is still a risk of per-cpu entry area leaks. This issue could allow a local user to gain access to some important data with memory in an expected location and potentially escalate their privileges on the system.
CVE-2023-36400 (severity: HIGH, weakness: CWE-122)
Windows HMAC Key Derivation Elevation of Privilege Vulnerability
CVE-2023-36401 (severity: HIGH, weakness: CWE-190)
Microsoft Remote Registry Service Remote Code Execution Vulnerability
CVE-2023-36402 (severity: HIGH, weakness: CWE-122)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2023-36403 (severity: HIGH, weakness: CWE-591)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-36404 (severity: MEDIUM, weakness: CWE-284)
Windows Kernel Information Disclosure Vulnerability
CVE-2023-36405 (severity: HIGH, weakness: CWE-362)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-36406 (severity: MEDIUM, weakness: CWE-20)
Windows Hyper-V Information Disclosure Vulnerability
CVE-2023-36407 (severity: HIGH, weakness: CWE-20)
Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2023-36408 (severity: HIGH, weakness: CWE-122)
Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2023-36409 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2023-3641 (severity: MEDIUM, weakness: CWE-79)
A vulnerability has been found in khodakhah NodCMS 3.4.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /en/blog-comment-4 of the component POST Request Handler. The manipulation of the argument comment_name/comment_content leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233887.
CVE-2023-36410 (severity: MEDIUM, weakness: CWE-79)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36413 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Office Security Feature Bypass Vulnerability
CVE-2023-36414 (severity: HIGH, weakness: CWE-77)
Azure Identity SDK Remote Code Execution Vulnerability
CVE-2023-36415 (severity: HIGH, weakness: CWE-77)
Azure Identity SDK Remote Code Execution Vulnerability
CVE-2023-36416 (severity: MEDIUM, weakness: CWE-79)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36417 (severity: HIGH, weakness: CWE-122)
Microsoft SQL OLE DB Remote Code Execution Vulnerability
CVE-2023-36418 (severity: HIGH, weakness: CWE-415)
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVE-2023-36419 (severity: CRITICAL, weakness: CWE-611)
Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability
CVE-2023-3642 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in GZ Scripts Vacation Rental Website 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /VacationRentalWebsite/property/8/ad-has-principes/ of the component HTTP POST Request Handler. The manipulation of the argument username/title/comment leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233888.
CVE-2023-36420 (severity: HIGH, weakness: CWE-415)
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2023-36422 (severity: HIGH, weakness: CWE-426)
Microsoft Windows Defender Elevation of Privilege Vulnerability
CVE-2023-36423 (severity: HIGH, weakness: CWE-122)
Microsoft Remote Registry Service Remote Code Execution Vulnerability
CVE-2023-36424 (severity: HIGH, weakness: CWE-125)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2023-36425 (severity: HIGH, weakness: CWE-122)
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
CVE-2023-36427 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2023-36428 (severity: MEDIUM, weakness: CWE-125)
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
CVE-2023-36429 (severity: MEDIUM, weakness: CWE-643)
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2023-3643 (severity: CRITICAL, weakness: CWE-73)
A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233889 was assigned to this vulnerability.
CVE-2023-36431 (severity: HIGH, weakness: CWE-400)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2023-36433 (severity: MEDIUM, weakness: CWE-643)
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2023-36434 (severity: CRITICAL, weakness: CWE-307)
Windows IIS Server Elevation of Privilege Vulnerability
CVE-2023-36435 (severity: HIGH, weakness: CWE-400)
Microsoft QUIC Denial of Service Vulnerability
CVE-2023-36436 (severity: HIGH, weakness: NVD-CWE-Other)
Windows MSHTML Platform Remote Code Execution Vulnerability
CVE-2023-36437 (severity: HIGH, weakness: CWE-94)
Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-36438 (severity: HIGH, weakness: NVD-CWE-Other)
Windows TCP/IP Information Disclosure Vulnerability
CVE-2023-36439 (severity: HIGH, weakness: CWE-502)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-3644 (severity: CRITICAL, weakness: CWE-89)
A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /classes/Master.php?f=save_inquiry. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. VDB-233890 is the identifier assigned to this vulnerability.
CVE-2023-3645 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-36456 (severity: HIGH, weakness: CWE-436)
authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy are susceptible to this. Possible spoofing of IP addresses in logs, downstream applications proxied by (built in) outpost, IP bypassing in custom flows if used. This poses a possible security risk when someone has flows or policies that check the user's IP address, e.g. when they want to ignore the user's 2 factor authentication when the user is connected to the company network. A second security risk is that the IP addresses in the logfiles and user sessions are not reliable anymore. Anybody can spoof this address and one cannot verify that the user has logged in from the IP address that is in their account's log. A third risk is that this header is passed on to the proxied application behind an outpost. The application may do any kind of verification, logging, blocking or rate limiting based on the IP address, and this IP address can be overridden by anybody that want to. Versions 2023.4.3 and 2023.5.5 contain a patch for this issue.
CVE-2023-36457 (severity: HIGH, weakness: CWE-77)
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed in v1.3.6.
CVE-2023-36458 (severity: HIGH, weakness: CWE-77)
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. The vulnerability has been fixed in v1.3.6.