stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-36507 (severity: MEDIUM, weakness: CWE-200)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.64.
CVE-2023-36508 (severity: CRITICAL, weakness: CWE-89)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db allows SQL Injection.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.1.
CVE-2023-36509 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Suresh Chand CHP Ads Block Detector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CHP Ads Block Detector: from n/a through 3.9.5.
CVE-2023-3651 (severity: CRITICAL, weakness: CWE-89)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Ant E-Commerce Software allows SQL Injection.This issue affects E-Commerce Software: before 11.
CVE-2023-36510 (severity: HIGH, weakness: CWE-862)
Missing Authorization vulnerability in Reservation Diary ReDi Restaurant Reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReDi Restaurant Reservation: from n/a through 23.0211.
CVE-2023-36511 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <= 1.6.4 versions.
CVE-2023-36512 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Woo AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.5.
CVE-2023-36513 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions.
CVE-2023-36514 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.
CVE-2023-36515 (severity: CRITICAL, weakness: CWE-862)
Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.
CVE-2023-36516 (severity: HIGH, weakness: CWE-862)
Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.
CVE-2023-36517 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.2 versions.
CVE-2023-36518 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Hugh Lashbrooke Post Hit Counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Hit Counter: from n/a through 1.3.2.
CVE-2023-36519 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in wpthemego SW Product Bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SW Product Bundles: from n/a through 2.0.15.
CVE-2023-3652 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Reflected XSS.This issue affects E-Commerce Software: before 11.
CVE-2023-36520 (severity: HIGH, weakness: CWE-639)
Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12.
CVE-2023-36521 (severity: HIGH, weakness: CWE-770)
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). The result synchronization server of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation of all socket-based communication of the affected products if the result server is enabled.
CVE-2023-36522 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in WePupil Quiz Expert plugin <= 1.5.0 versions.
CVE-2023-36523 (severity: MEDIUM, weakness: CWE-200)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7.
CVE-2023-36526 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Inqsys Technology Duplicate Post Page Menu & Custom Post Type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Duplicate Post Page Menu & Custom Post Type: from n/a through 2.4.1.
CVE-2023-36527 (severity: HIGH, weakness: CWE-1236)
Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft: from n/a through 1.4.0.
CVE-2023-36528 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.3.
CVE-2023-36529 (severity: CRITICAL, weakness: CWE-89)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQL Injection.This issue affects Houzez - Real Estate WordPress Theme: from n/a through 1.3.4.
CVE-2023-3653 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Stored XSS.This issue affects E-Commerce Software: before 11.
CVE-2023-36530 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smartypants SP Project & Document Manager plugin <= 4.67 versions.
CVE-2023-36531 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.68.
CVE-2023-36532 (severity: HIGH, weakness: CWE-122)
Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access.
CVE-2023-36533 (severity: HIGH, weakness: CWE-772)
Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network access.
CVE-2023-36534 (severity: CRITICAL, weakness: CWE-22)
Path traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
CVE-2023-36535 (severity: MEDIUM, weakness: CWE-449)
Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access.
CVE-2023-36536 (severity: HIGH, weakness: CWE-426)
Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
CVE-2023-36537 (severity: HIGH, weakness: CWE-354)
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
CVE-2023-36538 (severity: HIGH, weakness: CWE-426)
Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
CVE-2023-36539 (severity: HIGH, weakness: CWE-200)
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.
CVE-2023-3654 (severity: CRITICAL, weakness: CWE-346)
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the host header in an HTTP request. This vulnerability can be triggered by an HTTP endpoint exposed to the network.
CVE-2023-36540 (severity: HIGH, weakness: CWE-426)
Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
CVE-2023-36541 (severity: HIGH, weakness: CWE-345)
Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access.
CVE-2023-36542 (severity: HIGH, weakness: CWE-94)
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.
CVE-2023-36543 (severity: MEDIUM, weakness: CWE-1333)
Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected
CVE-2023-36547 (severity: CRITICAL, weakness: CWE-78)
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
CVE-2023-36548 (severity: CRITICAL, weakness: CWE-78)
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
CVE-2023-36549 (severity: CRITICAL, weakness: CWE-78)
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
CVE-2023-3655 (severity: HIGH, weakness: CWE-749)
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that allows to leak the database (system settings, user accounts,...). This vulnerability can be triggered by an HTTP endpoint exposed to the network.
CVE-2023-36550 (severity: CRITICAL, weakness: CWE-78)
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
CVE-2023-36551 (severity: MEDIUM, weakness: CWE-200)
A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to information disclosure via a crafted http request.
CVE-2023-36553 (severity: CRITICAL, weakness: CWE-78)
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to execute unauthorized code or commands via crafted API requests.
CVE-2023-36554 (severity: CRITICAL, weakness: CWE-284)
A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 all versions allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.
CVE-2023-36555 (severity: MEDIUM, weakness: CWE-80)
An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components.
CVE-2023-36556 (severity: HIGH, weakness: CWE-863)
An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests.
CVE-2023-36557 (severity: HIGH, weakness: NVD-CWE-Other)
PrintHTML API Remote Code Execution Vulnerability
CVE-2023-36558 (severity: MEDIUM, weakness: NVD-CWE-Other)
ASP.NET Core Security Feature Bypass Vulnerability
CVE-2023-36559 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2023-3656 (severity: CRITICAL, weakness: CWE-94)
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network.
CVE-2023-36560 (severity: HIGH, weakness: NVD-CWE-Other)
ASP.NET Security Feature Bypass Vulnerability
CVE-2023-36561 (severity: HIGH, weakness: CWE-284)
Azure DevOps Server Elevation of Privilege Vulnerability
CVE-2023-36562 (severity: HIGH, weakness: CWE-416)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-36563 (severity: MEDIUM, weakness: CWE-20)
Microsoft WordPad Information Disclosure Vulnerability
CVE-2023-36564 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Search Security Feature Bypass Vulnerability
CVE-2023-36565 (severity: HIGH, weakness: CWE-416)
Microsoft Office Graphics Elevation of Privilege Vulnerability
CVE-2023-36566 (severity: MEDIUM, weakness: CWE-20)
Microsoft Common Data Model SDK Denial of Service Vulnerability
CVE-2023-36567 (severity: HIGH, weakness: CWE-908)
Windows Deployment Services Information Disclosure Vulnerability
CVE-2023-36568 (severity: HIGH, weakness: CWE-59)
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
CVE-2023-36569 (severity: HIGH, weakness: CWE-269)
Microsoft Office Elevation of Privilege Vulnerability
CVE-2023-3657 (severity: CRITICAL, weakness: CWE-89)
A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. This issue affects some unknown processing of the file Master.php?f=save_book of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-234011.
CVE-2023-36570 (severity: HIGH, weakness: CWE-94)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36571 (severity: HIGH, weakness: CWE-94)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36572 (severity: HIGH, weakness: CWE-94)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36573 (severity: HIGH, weakness: CWE-94)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36574 (severity: HIGH, weakness: CWE-94)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36575 (severity: HIGH, weakness: CWE-94)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36576 (severity: MEDIUM, weakness: CWE-190)
Windows Kernel Information Disclosure Vulnerability
CVE-2023-36577 (severity: HIGH, weakness: CWE-122)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2023-36578 (severity: HIGH, weakness: CWE-843)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36579 (severity: HIGH, weakness: CWE-400)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2023-3658 (severity: CRITICAL, weakness: CWE-89)
A vulnerability, which was classified as critical, was found in SourceCodester AC Repair and Services System 1.0. Affected is an unknown function of the file Master.php?f=delete_book of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234012.
CVE-2023-36581 (severity: HIGH, weakness: CWE-126)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2023-36582 (severity: HIGH, weakness: CWE-190)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36583 (severity: HIGH, weakness: CWE-416)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36584 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2023-36585 (severity: HIGH, weakness: CWE-20)
Windows upnphost.dll Denial of Service Vulnerability
CVE-2023-36589 (severity: HIGH, weakness: CWE-94)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-3659 (severity: MEDIUM, weakness: CWE-79)
A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/?page=user/manage_user. The manipulation of the argument firstname/middlename leads to cross site scripting. The attack can be launched remotely. The identifier VDB-234013 was assigned to this vulnerability.
CVE-2023-36590 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36591 (severity: HIGH, weakness: CWE-94)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36592 (severity: HIGH, weakness: CWE-94)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36593 (severity: HIGH, weakness: CWE-190)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36594 (severity: HIGH, weakness: CWE-843)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2023-36596 (severity: HIGH, weakness: CWE-822)
Remote Procedure Call Information Disclosure Vulnerability
CVE-2023-36598 (severity: HIGH, weakness: CWE-122)
Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability
CVE-2023-3660 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/add_user_modal.php. The manipulation of the argument un leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-234014 is the identifier assigned to this vulnerability.
CVE-2023-36602 (severity: HIGH, weakness: CWE-476)
Windows TCP/IP Denial of Service Vulnerability
CVE-2023-36603 (severity: HIGH, weakness: CWE-476)
Windows TCP/IP Denial of Service Vulnerability
CVE-2023-36605 (severity: HIGH, weakness: CWE-416)
Windows Named Pipe Filesystem Elevation of Privilege Vulnerability
CVE-2023-36606 (severity: HIGH, weakness: CWE-400)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2023-36607 (severity: MEDIUM, weakness: CWE-862)
The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents.
CVE-2023-36608 (severity: MEDIUM, weakness: CWE-327)
The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.
CVE-2023-36609 (severity: HIGH, weakness: CWE-829)
The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.
CVE-2023-3661 (severity: CRITICAL, weakness: CWE-89)
A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. This affects an unknown part of the file /classes/Master.php?f=save_inquiry. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-234015.
CVE-2023-36610 (severity: MEDIUM, weakness: CWE-331)
​The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values. An attacker with this knowledge could successfully brute force the token and authenticate themselves.
CVE-2023-36611 (severity: MEDIUM, weakness: CWE-285)
The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges to access files requiring higher privileges by establishing an SSH session and providing the other tokens.
CVE-2023-36612 (severity: HIGH, weakness: CWE-22)
Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses (containing sensitive information) to third-party applications by using a custom-crafted deeplink scheme.
CVE-2023-36617 (severity: MEDIUM, weakness: CWE-1333)
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
CVE-2023-36618 (severity: HIGH, weakness: CWE-78)
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authenticated users.
CVE-2023-36619 (severity: CRITICAL, weakness: CWE-20)
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.
CVE-2023-3662 (severity: HIGH, weakness: CWE-427)
In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .
CVE-2023-36620 (severity: MEDIUM, weakness: CWE-284)
An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is used to authenticate requests to the API.
CVE-2023-36621 (severity: CRITICAL, weakness: CWE-862)
An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions temporarily or uninstall the application without the parents noticing.
CVE-2023-36622 (severity: HIGH, weakness: CWE-78)
The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commands via the timezone parameter.
CVE-2023-36623 (severity: HIGH, weakness: CWE-798)
The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC address. This allows a local user to calculate the root password and escalate privileges.