Latest vulnerabilities [Friday, December 22, 2023]

Latest vulnerabilities [Friday, December 22, 2023]
{{titre}}

Last update performed on 12/22/2023 at 11:57:05 PM

(9) CRITICAL VULNERABILITIES [9.0, 10.0]

Source : fluidattacks.com

Vulnerability ID : CVE-2023-49684

First published on : 22-12-2023 00:15:35
Last modified on : 22-12-2023 12:18:32

Description :
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtTitle' parameter of the Employer/InsertWalkin.php resource does not validate the characters received and they are sent unfiltered to the database.

CVE ID : CVE-2023-49684
Source : help@fluidattacks.com
CVSS Score : 9.8

References :
https://fluidattacks.com/advisories/pollini/ | source : help@fluidattacks.com
https://www.kashipara.com/ | source : help@fluidattacks.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-49685

First published on : 22-12-2023 00:15:35
Last modified on : 22-12-2023 12:18:32

Description :
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtTime' parameter of the Employer/InsertWalkin.php resource does not validate the characters received and they are sent unfiltered to the database.

CVE ID : CVE-2023-49685
Source : help@fluidattacks.com
CVSS Score : 9.8

References :
https://fluidattacks.com/advisories/pollini/ | source : help@fluidattacks.com
https://www.kashipara.com/ | source : help@fluidattacks.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-49686

First published on : 22-12-2023 00:15:35
Last modified on : 22-12-2023 12:18:32

Description :
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtTotal' parameter of the Employer/InsertWalkin.php resource does not validate the characters received and they are sent unfiltered to the database.

CVE ID : CVE-2023-49686
Source : help@fluidattacks.com
CVSS Score : 9.8

References :
https://fluidattacks.com/advisories/pollini/ | source : help@fluidattacks.com
https://www.kashipara.com/ | source : help@fluidattacks.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-49687

First published on : 22-12-2023 00:15:35
Last modified on : 22-12-2023 12:18:32

Description :
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtPass' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.

CVE ID : CVE-2023-49687
Source : help@fluidattacks.com
CVSS Score : 9.8

References :
https://fluidattacks.com/advisories/pollini/ | source : help@fluidattacks.com
https://www.kashipara.com/ | source : help@fluidattacks.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-49688

First published on : 22-12-2023 00:15:35
Last modified on : 22-12-2023 12:18:32

Description :
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtUser' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.

CVE ID : CVE-2023-49688
Source : help@fluidattacks.com
CVSS Score : 9.8

References :
https://fluidattacks.com/advisories/pollini/ | source : help@fluidattacks.com
https://www.kashipara.com/ | source : help@fluidattacks.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-49689

First published on : 22-12-2023 00:15:36
Last modified on : 22-12-2023 12:18:32

Description :
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'JobId' parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered to the database.

CVE ID : CVE-2023-49689
Source : help@fluidattacks.com
CVSS Score : 9.8

References :
https://fluidattacks.com/advisories/pollini/ | source : help@fluidattacks.com
https://www.kashipara.com/ | source : help@fluidattacks.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-49690

First published on : 22-12-2023 00:15:36
Last modified on : 22-12-2023 12:18:32

Description :
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'WalkinId' parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered to the database.

CVE ID : CVE-2023-49690
Source : help@fluidattacks.com
CVSS Score : 9.8

References :
https://fluidattacks.com/advisories/pollini/ | source : help@fluidattacks.com
https://www.kashipara.com/ | source : help@fluidattacks.com

Vulnerability : CWE-89


Source : github.com

Vulnerability ID : CVE-2023-50254

First published on : 22-12-2023 17:15:09
Last modified on : 22-12-2023 20:32:34

Description :
Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.

CVE ID : CVE-2023-50254
Source : security-advisories@github.com
CVSS Score : 9.3

References :
https://github.com/linuxdeepin/deepin-reader/commit/4db7a079fb7bd77257b1b9208a7ab26aade8fe04 | source : security-advisories@github.com
https://github.com/linuxdeepin/deepin-reader/commit/c192fd20a2fe4003e0581c3164489a89e06420c6 | source : security-advisories@github.com
https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-q9jr-726g-9495 | source : security-advisories@github.com

Vulnerability : CWE-22
Vulnerability : CWE-27


Vulnerability ID : CVE-2023-50731

First published on : 22-12-2023 21:15:08
Last modified on : 22-12-2023 21:15:08

Description :
MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. Later in the method, the temporary directory is deleted on line 151, but since we can write outside of the directory using the path injection vulnerability, the potentially dangerous file is not deleted. Arbitrary file contents can be written due to `f.write(chunk)` on line 125. Mindsdb does check later on line 149 in the `save_file` method in `file-controller.py` which calls the `_handle_source` method in `file_handler.py` if a file is of one of the types `csv`, `json`, `parquet`, `xls`, or `xlsx`. However, since the check happens after the file has already been written, the files will still exist (and will not be removed due to the path injection described earlier), just the `_handle_source` method will return an error. The same user-controlled source source is used also in another path injection sink on line 138. This leads to another path injection, which allows an attacker to delete any `zip` or `tar.gz` files on the server.

CVE ID : CVE-2023-50731
Source : security-advisories@github.com
CVSS Score : 9.1

References :
https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125 | source : security-advisories@github.com
https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138 | source : security-advisories@github.com
https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhj | source : security-advisories@github.com
https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb/ | source : security-advisories@github.com

Vulnerability : CWE-918


(14) HIGH VULNERABILITIES [7.0, 8.9]

Source : github.com

Vulnerability ID : CVE-2023-49085

First published on : 22-12-2023 17:15:07
Last modified on : 22-12-2023 20:32:34

Description :
Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.

CVE ID : CVE-2023-49085
Source : security-advisories@github.com
CVSS Score : 8.8

References :
https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/pollers.php#L451 | source : security-advisories@github.com
https://github.com/Cacti/cacti/security/advisories/GHSA-vr3c-38wh-g855 | source : security-advisories@github.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-51448

First published on : 22-12-2023 17:15:09
Last modified on : 22-12-2023 20:32:34

Description :
Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.

CVE ID : CVE-2023-51448
Source : security-advisories@github.com
CVSS Score : 8.8

References :
https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/managers.php#L941 | source : security-advisories@github.com
https://github.com/Cacti/cacti/security/advisories/GHSA-w85f-7c4w-7594 | source : security-advisories@github.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-51661

First published on : 22-12-2023 15:15:08
Last modified on : 22-12-2023 20:32:41

Description :
Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.

CVE ID : CVE-2023-51661
Source : security-advisories@github.com
CVSS Score : 8.4

References :
https://github.com/wasmerio/wasmer/commit/4d63febf9d8b257b0531963b85df48d45d0dbf3c | source : security-advisories@github.com
https://github.com/wasmerio/wasmer/issues/4267 | source : security-advisories@github.com
https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5j | source : security-advisories@github.com

Vulnerability : CWE-284


Vulnerability ID : CVE-2023-51386

First published on : 22-12-2023 22:15:07
Last modified on : 22-12-2023 22:15:07

Description :
Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting information on planned events, timeframes, budgets and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. This issue has been patched in version 1.10.0.

CVE ID : CVE-2023-51386
Source : security-advisories@github.com
CVSS Score : 7.8

References :
https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79 | source : security-advisories@github.com
https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-p7w3-j66h-m7mx | source : security-advisories@github.com

Vulnerability : CWE-269


Vulnerability ID : CVE-2022-39337

First published on : 22-12-2023 15:15:07
Last modified on : 22-12-2023 20:32:41

Description :
Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.

CVE ID : CVE-2022-39337
Source : security-advisories@github.com
CVSS Score : 7.5

References :
https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 | source : security-advisories@github.com
https://github.com/dromara/hertzbeat/issues/377 | source : security-advisories@github.com
https://github.com/dromara/hertzbeat/pull/382 | source : security-advisories@github.com
https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6 | source : security-advisories@github.com

Vulnerability : CWE-284
Vulnerability : CWE-863


Vulnerability ID : CVE-2023-50730

First published on : 22-12-2023 21:15:07
Last modified on : 22-12-2023 21:15:07

Description :
Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn't checked, and queries with cyclic fragments would have been accepted for type checking and compilation. The attempted compilation of such fragments would result in a JVM `StackOverflowError` being thrown. Some knowledge of an applications GraphQL schema would be required to construct such a query, however no knowledge of any application-specific performance or other behavioural characteristics would be needed. Grackle uses the cats-parse library for parsing GraphQL queries. Prior to version 0.18.0, Grackle made use of the cats-parse `recursive` operator. However, `recursive` is not currently stack safe. `recursive` was used in three places in the parser: nested selection sets, nested input values (lists and objects), and nested list type declarations. Consequently, queries with deeply nested selection sets, input values or list types could be constructed which exploited this, causing a JVM `StackOverflowException` to be thrown during parsing. Because this happens very early in query processing, no specific knowledge of an applications GraphQL schema would be required to construct such a query. The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability. This potentially affects all applications using Grackle which have untrusted users. Both stack overflow issues have been resolved in the v0.18.0 release of Grackle. As a workaround, users could interpose a sanitizing layer in between untrusted input and Grackle query processing.

CVE ID : CVE-2023-50730
Source : security-advisories@github.com
CVSS Score : 7.5

References :
https://github.com/typelevel/grackle/commit/56e244b91659cf385df590fc6c46695b6f36cbfd | source : security-advisories@github.com
https://github.com/typelevel/grackle/releases/tag/v0.18.0 | source : security-advisories@github.com
https://github.com/typelevel/grackle/security/advisories/GHSA-g56x-7j6w-g8r8 | source : security-advisories@github.com

Vulnerability : CWE-400
Vulnerability : CWE-770


Vulnerability ID : CVE-2023-51650

First published on : 22-12-2023 21:15:09
Last modified on : 22-12-2023 21:15:09

Description :
Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue.

CVE ID : CVE-2023-51650
Source : security-advisories@github.com
CVSS Score : 7.5

References :
https://github.com/dromara/hertzbeat/releases/tag/v1.4.1 | source : security-advisories@github.com
https://github.com/dromara/hertzbeat/security/advisories/GHSA-rrc5-qpxr-5jm2 | source : security-advisories@github.com

Vulnerability : CWE-862


Vulnerability ID : CVE-2023-50924

First published on : 22-12-2023 21:15:08
Last modified on : 22-12-2023 21:15:08

Description :
Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user's context. This vulnerability enables an authenticated user to inject Javascript into other user's sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1.

CVE ID : CVE-2023-50924
Source : security-advisories@github.com
CVSS Score : 7.3

References :
https://github.com/engelsystem/engelsystem/commit/efda1ffc1ce59f02a7d237d9087adea26e73ec5f | source : security-advisories@github.com
https://github.com/engelsystem/engelsystem/security/advisories/GHSA-p5ch-rrpm-wvhm | source : security-advisories@github.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-51387

First published on : 22-12-2023 21:15:08
Last modified on : 22-12-2023 21:15:08

Description :
Hertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be some simple expressions. However, due to improper sanitization for alert expressions in version prior to 1.4.1, a malicious user can use a crafted alert expression to execute any command on hertzbeat server. A malicious user who has access to alert define function can execute any command in hertzbeat instance. This issue is fixed in version 1.4.1.

CVE ID : CVE-2023-51387
Source : security-advisories@github.com
CVSS Score : 7.2

References :
https://github.com/dromara/hertzbeat/blob/6b599495763120ad1df6f4ed4b6713bb4885d8e2/home/blog/2023-09-26-hertzbeat-v1.4.1.md | source : security-advisories@github.com
https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2 | source : security-advisories@github.com
https://github.com/dromara/hertzbeat/security/advisories/GHSA-4576-m8px-w9qj | source : security-advisories@github.com

Vulnerability : CWE-94


Vulnerability ID : CVE-2023-50928

First published on : 22-12-2023 21:15:08
Last modified on : 22-12-2023 21:15:08

Description :
"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.

CVE ID : CVE-2023-50928
Source : security-advisories@github.com
CVSS Score : 7.1

References :
https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79 | source : security-advisories@github.com
https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-cg8w-7q5v-g32r | source : security-advisories@github.com

Vulnerability : CWE-284


Vulnerability ID : CVE-2023-48704

First published on : 22-12-2023 16:15:08
Last modified on : 22-12-2023 20:32:41

Description :
ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.

CVE ID : CVE-2023-48704
Source : security-advisories@github.com
CVSS Score : 7.0

References :
https://github.com/ClickHouse/ClickHouse/pull/57107 | source : security-advisories@github.com
https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5rmf-5g48-xv63 | source : security-advisories@github.com

Vulnerability : CWE-120
Vulnerability : CWE-122


Source : us.ibm.com

Vulnerability ID : CVE-2023-42017

First published on : 22-12-2023 16:15:07
Last modified on : 22-12-2023 20:32:41

Description :
IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious script, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 265567.

CVE ID : CVE-2023-42017
Source : psirt@us.ibm.com
CVSS Score : 8.0

References :
https://exchange.xforce.ibmcloud.com/vulnerabilities/265567 | source : psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7096528 | source : psirt@us.ibm.com

Vulnerability : CWE-434


Source : emc.com

Vulnerability ID : CVE-2023-48670

First published on : 22-12-2023 16:15:08
Last modified on : 22-12-2023 20:32:41

Description :
Dell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the installer. A local low privileged authenticated attacker may potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges.

CVE ID : CVE-2023-48670
Source : security_alert@emc.com
CVSS Score : 7.3

References :
https://www.dell.com/support/kbdoc/en-us/000220677/dsa-2023-468-security-update-for-dell-supportassist-for-home-pcs-installer-file-local-privilege-escalation-vulnerability | source : security_alert@emc.com

Vulnerability : CWE-426


Vulnerability ID : CVE-2023-43088

First published on : 22-12-2023 18:15:07
Last modified on : 22-12-2023 20:32:34

Description :
Dell Client BIOS contains a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device.

CVE ID : CVE-2023-43088
Source : security_alert@emc.com
CVSS Score : 7.2

References :
https://www.dell.com/support/kbdoc/en-us/000218223/dsa-2023-377 | source : security_alert@emc.com

Vulnerability : CWE-16


(23) MEDIUM VULNERABILITIES [4.0, 6.9]

Source : github.com

Vulnerability ID : CVE-2023-50714

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.

CVE ID : CVE-2023-50714
Source : security-advisories@github.com
CVSS Score : 6.8

References :
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 | source : security-advisories@github.com
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 | source : security-advisories@github.com
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420 | source : security-advisories@github.com
https://github.com/yiisoft/yii2-authclient/commit/721ed974bc44137437b0cdc8454e137fff8db213 | source : security-advisories@github.com
https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-rw54-6826-c8j5 | source : security-advisories@github.com

Vulnerability : CWE-347
Vulnerability : CWE-918


Vulnerability ID : CVE-2023-50725

First published on : 22-12-2023 20:15:07
Last modified on : 22-12-2023 20:32:25

Description :
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=<script>alert(document.cookie)</script>" and "/queues/><img src=a onerror=alert(document.cookie)>". This issue has been patched in version 2.2.1.

CVE ID : CVE-2023-50725
Source : security-advisories@github.com
CVSS Score : 6.3

References :
https://github.com/resque/resque/commit/ee99d2ed6cc75d9d384483b70c2d96d312115f07 | source : security-advisories@github.com
https://github.com/resque/resque/pull/1790 | source : security-advisories@github.com
https://github.com/resque/resque/security/advisories/GHSA-gc3j-vvwf-4rp8 | source : security-advisories@github.com
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque/CVE-2023-50725.yml | source : security-advisories@github.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-50727

First published on : 22-12-2023 21:15:07
Last modified on : 22-12-2023 21:15:07

Description :
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /"><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0.

CVE ID : CVE-2023-50727
Source : security-advisories@github.com
CVSS Score : 6.3

References :
https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a | source : security-advisories@github.com
https://github.com/resque/resque/pull/1865 | source : security-advisories@github.com
https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g | source : security-advisories@github.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-49086

First published on : 22-12-2023 00:15:34
Last modified on : 22-12-2023 12:18:32

Description :
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). Bypassing an earlier fix (CVE-2023-39360) that leads to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. Impact of the vulnerability - execution of arbitrary javascript code in the attacked user's browser. This issue has been patched in version 1.2.26.

CVE ID : CVE-2023-49086
Source : security-advisories@github.com
CVSS Score : 6.1

References :
https://github.com/Cacti/cacti/security/advisories/GHSA-wc73-r2vw-59pr | source : security-advisories@github.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-49088

First published on : 22-12-2023 17:15:08
Last modified on : 22-12-2023 20:32:34

Description :
Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.

CVE ID : CVE-2023-49088
Source : security-advisories@github.com
CVSS Score : 6.1

References :
https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/data_debug.php | source : security-advisories@github.com
https://github.com/Cacti/cacti/security/advisories/GHSA-hrg9-qqqx-wc4h | source : security-advisories@github.com
https://github.com/Cacti/cacti/security/advisories/GHSA-q7g7-gcf6-wh4x | source : security-advisories@github.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-50708

First published on : 22-12-2023 19:15:08
Last modified on : 22-12-2023 20:32:25

Description :
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.

CVE ID : CVE-2023-50708
Source : security-advisories@github.com
CVSS Score : 6.1

References :
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 | source : security-advisories@github.com
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 | source : security-advisories@github.com
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420 | source : security-advisories@github.com
https://github.com/yiisoft/yii2-authclient/commit/dabddf2154ab7e7703740205a069202554089248 | source : security-advisories@github.com
https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp | source : security-advisories@github.com

Vulnerability : CWE-203


Vulnerability ID : CVE-2023-51662

First published on : 22-12-2023 17:15:10
Last modified on : 22-12-2023 20:32:34

Description :
The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.

CVE ID : CVE-2023-51662
Source : security-advisories@github.com
CVSS Score : 6.0

References :
https://docs.snowflake.com/release-notes/clients-drivers/dotnet-2023#version-2-1-5-december-18-2023 | source : security-advisories@github.com
https://github.com/snowflakedb/snowflake-connector-net/security/advisories/GHSA-hwcc-4cv8-cf3h | source : security-advisories@github.com

Vulnerability : CWE-295


Vulnerability ID : CVE-2023-51651

First published on : 22-12-2023 21:15:09
Last modified on : 22-12-2023 21:15:09

Description :
AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.

CVE ID : CVE-2023-51651
Source : security-advisories@github.com
CVSS Score : 6.0

References :
https://github.com/aws/aws-sdk-php/commit/aebc9f801438746ac4ade327551576cb75f635f2 | source : security-advisories@github.com
https://github.com/aws/aws-sdk-php/releases/tag/3.288.1 | source : security-advisories@github.com
https://github.com/aws/aws-sdk-php/security/advisories/GHSA-557v-xcg6-rm5m | source : security-advisories@github.com

Vulnerability : CWE-22


Vulnerability ID : CVE-2023-51449

First published on : 22-12-2023 21:15:09
Last modified on : 22-12-2023 21:15:09

Description :
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.

CVE ID : CVE-2023-51449
Source : security-advisories@github.com
CVSS Score : 5.6

References :
https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76 | source : security-advisories@github.com
https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055 | source : security-advisories@github.com
https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2 | source : security-advisories@github.com

Vulnerability : CWE-22


Vulnerability ID : CVE-2023-49791

First published on : 22-12-2023 17:15:08
Last modified on : 22-12-2023 20:32:34

Description :
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

CVE ID : CVE-2023-49791
Source : security-advisories@github.com
CVSS Score : 5.4

References :
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f8p-6qww-2prr | source : security-advisories@github.com
https://github.com/nextcloud/server/pull/41520 | source : security-advisories@github.com
https://hackerone.com/reports/2120667 | source : security-advisories@github.com

Vulnerability : CWE-284
Vulnerability : CWE-287


Vulnerability ID : CVE-2023-50250

First published on : 22-12-2023 17:15:09
Last modified on : 22-12-2023 20:32:34

Description :
Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.

CVE ID : CVE-2023-50250
Source : security-advisories@github.com
CVSS Score : 5.4

References :
https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/templates_import.php | source : security-advisories@github.com
https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73 | source : security-advisories@github.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-49792

First published on : 22-12-2023 17:15:08
Last modified on : 22-12-2023 20:32:34

Description :
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

CVE ID : CVE-2023-49792
Source : security-advisories@github.com
CVSS Score : 5.3

References :
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5j2p-q736-hw98 | source : security-advisories@github.com
https://github.com/nextcloud/server/pull/41526 | source : security-advisories@github.com
https://hackerone.com/reports/2230915 | source : security-advisories@github.com

Vulnerability : CWE-307


Vulnerability ID : CVE-2023-50258

First published on : 22-12-2023 17:15:09
Last modified on : 22-12-2023 20:32:34

Description :
Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testDiscord` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `discord_webhook` variable and passes it to the `notifiers.discord_notifier.test_notify` method, then `_notify_discord` and finally `_send_discord_msg` method, which sends a POST request to the user-controlled URL on line 64 in `/medusa/notifiers/discord.py`, which leads to a blind server-side request forgery. This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.

CVE ID : CVE-2023-50258
Source : security-advisories@github.com
CVSS Score : 5.3

References :
https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/notifiers/discord.py#L64 | source : security-advisories@github.com
https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/server/web/home/handler.py#L158 | source : security-advisories@github.com
https://github.com/pymedusa/Medusa/releases/tag/v1.0.19 | source : security-advisories@github.com
https://github.com/pymedusa/Medusa/security/advisories/GHSA-3hph-6586-qv9g | source : security-advisories@github.com
https://securitylab.github.com/advisories/GHSL-2023-201_GHSL-2023-202_Medusa/ | source : security-advisories@github.com

Vulnerability : CWE-918


Vulnerability ID : CVE-2023-50259

First published on : 22-12-2023 17:15:09
Last modified on : 22-12-2023 20:32:34

Description :
Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testslack` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `slack_webhook` variable and passes it to the `notifiers.slack_notifier.test_notify` method, then `_notify_slack` and finally `_send_slack` method, which sends a POST request to the user-controlled URL on line 103 in `/medusa/notifiers/slack.py`, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.

CVE ID : CVE-2023-50259
Source : security-advisories@github.com
CVSS Score : 5.3

References :
https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/notifiers/slack.py#L103 | source : security-advisories@github.com
https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/server/web/home/handler.py#L168 | source : security-advisories@github.com
https://github.com/pymedusa/Medusa/releases/tag/v1.0.19 | source : security-advisories@github.com
https://github.com/pymedusa/Medusa/security/advisories/GHSA-8mcr-vffr-jwxv | source : security-advisories@github.com
https://securitylab.github.com/advisories/GHSL-2023-201_GHSL-2023-202_Medusa/ | source : security-advisories@github.com

Vulnerability : CWE-918


Vulnerability ID : CVE-2023-50712

First published on : 22-12-2023 20:15:07
Last modified on : 22-12-2023 20:32:25

Description :
Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.3.7 of iris-web. No known workarounds are available.

CVE ID : CVE-2023-50712
Source : security-advisories@github.com
CVSS Score : 4.6

References :
https://github.com/dfir-iris/iris-web/releases/tag/v2.3.7 | source : security-advisories@github.com
https://github.com/dfir-iris/iris-web/security/advisories/GHSA-593r-747g-p92p | source : security-advisories@github.com

Vulnerability : CWE-79
Vulnerability : CWE-87


Vulnerability ID : CVE-2023-49790

First published on : 22-12-2023 17:15:08
Last modified on : 22-12-2023 20:32:34

Description :
The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4 digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workarounds are available.

CVE ID : CVE-2023-49790
Source : security-advisories@github.com
CVSS Score : 4.3

References :
https://github.com/nextcloud/ios/pull/2665 | source : security-advisories@github.com
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j8g7-88vv-rggv | source : security-advisories@github.com
https://hackerone.com/reports/2245437 | source : security-advisories@github.com

Vulnerability : CWE-287


Vulnerability ID : CVE-2023-51451

First published on : 22-12-2023 21:15:09
Last modified on : 22-12-2023 21:15:09

Description :
Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via Symbolicator's API. In affected Sentry instances, the data could be exposed through the Sentry API and user interface if the attacker has a registered account. The issue has been fixed in Symbolicator release 23.12.1, Sentry self-hosted release 23.12.1, and has already been mitigated on sentry.io on December 18, 2023. If updating is not possible, some other mitigations are available. One may disable JS processing by toggling the option `Allow JavaScript Source Fetching` in `Organization Settings > Security & Privacy` and/or disable all untrusted public repositories under `Project Settings > Debug Files`. Alternatively, if JavaScript and native symbolication are not required, disable Symbolicator completely in `config.yml`.

CVE ID : CVE-2023-51451
Source : security-advisories@github.com
CVSS Score : 4.3

References :
https://github.com/getsentry/self-hosted/releases/tag/23.12.1 | source : security-advisories@github.com
https://github.com/getsentry/symbolicator/pull/1343 | source : security-advisories@github.com
https://github.com/getsentry/symbolicator/releases/tag/23.12.1 | source : security-advisories@github.com
https://github.com/getsentry/symbolicator/security/advisories/GHSA-ghg9-7m82-h96r | source : security-advisories@github.com

Vulnerability : CWE-918


Source : emc.com

Vulnerability ID : CVE-2023-39251

First published on : 22-12-2023 18:15:07
Last modified on : 22-12-2023 20:32:34

Description :
Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability in order to corrupt memory on the system.

CVE ID : CVE-2023-39251
Source : security_alert@emc.com
CVSS Score : 6.7

References :
https://www.dell.com/support/kbdoc/en-us/000217707/dsa-2023-342 | source : security_alert@emc.com

Vulnerability : CWE-20


Source : vuldb.com

Vulnerability ID : CVE-2023-7058

First published on : 22-12-2023 05:15:13
Last modified on : 22-12-2023 12:18:32

Description :
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248749 was assigned to this vulnerability.

CVE ID : CVE-2023-7058
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/laoquanshi/Simple-Student-Attendance-System | source : cna@vuldb.com
https://vuldb.com/?ctiid.248749 | source : cna@vuldb.com
https://vuldb.com/?id.248749 | source : cna@vuldb.com

Vulnerability : CWE-24


Vulnerability ID : CVE-2023-7054

First published on : 22-12-2023 02:15:43
Last modified on : 22-12-2023 12:18:32

Description :
A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /user/add-notes.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248741 was assigned to this vulnerability.

CVE ID : CVE-2023-7054
Source : cna@vuldb.com
CVSS Score : 5.5

References :
https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/notes_malicious_fileupload.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.248741 | source : cna@vuldb.com
https://vuldb.com/?id.248741 | source : cna@vuldb.com

Vulnerability : CWE-434


Vulnerability ID : CVE-2023-7052

First published on : 22-12-2023 01:15:12
Last modified on : 22-12-2023 12:18:32

Description :
A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been classified as problematic. This affects an unknown part of the file /user/profile.php. The manipulation of the argument name leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248739.

CVE ID : CVE-2023-7052
Source : cna@vuldb.com
CVSS Score : 4.3

References :
https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/csrf_profile_notes.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.248739 | source : cna@vuldb.com
https://vuldb.com/?id.248739 | source : cna@vuldb.com

Vulnerability : CWE-352


Vulnerability ID : CVE-2023-7055

First published on : 22-12-2023 03:15:09
Last modified on : 22-12-2023 12:18:32

Description :
A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profile.php of the component Contact Information Handler. The manipulation of the argument mobilenumber leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-248742 is the identifier assigned to this vulnerability.

CVE ID : CVE-2023-7055
Source : cna@vuldb.com
CVSS Score : 4.3

References :
https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/notes_parameter_tampering.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.248742 | source : cna@vuldb.com
https://vuldb.com/?id.248742 | source : cna@vuldb.com

Vulnerability : CWE-284


Source : us.ibm.com

Vulnerability ID : CVE-2023-45165

First published on : 22-12-2023 16:15:08
Last modified on : 22-12-2023 20:32:41

Description :
IBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM X-Force ID: 267963.

CVE ID : CVE-2023-45165
Source : psirt@us.ibm.com
CVSS Score : 6.2

References :
https://exchange.xforce.ibmcloud.com/vulnerabilities/267963 | source : psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7100970 | source : psirt@us.ibm.com

Vulnerability : CWE-20


(8) LOW VULNERABILITIES [0.1, 3.9]

Source : github.com

Vulnerability ID : CVE-2023-48308

First published on : 22-12-2023 00:15:34
Last modified on : 22-12-2023 12:18:32

Description :
Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3

CVE ID : CVE-2023-48308
Source : security-advisories@github.com
CVSS Score : 3.5

References :
https://github.com/nextcloud/calendar/pull/5553 | source : security-advisories@github.com
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8 | source : security-advisories@github.com

Vulnerability : CWE-1258


Vulnerability ID : CVE-2023-51649

First published on : 22-12-2023 17:15:10
Last modified on : 22-12-2023 20:32:34

Description :
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0

CVE ID : CVE-2023-51649
Source : security-advisories@github.com
CVSS Score : 3.5

References :
https://github.com/nautobot/nautobot/issues/4988 | source : security-advisories@github.com
https://github.com/nautobot/nautobot/pull/4993 | source : security-advisories@github.com
https://github.com/nautobot/nautobot/pull/4995 | source : security-advisories@github.com
https://github.com/nautobot/nautobot/security/advisories/GHSA-vf5m-xrhm-v999 | source : security-advisories@github.com

Vulnerability : CWE-863


Source : vuldb.com

Vulnerability ID : CVE-2023-7057

First published on : 22-12-2023 04:15:09
Last modified on : 22-12-2023 12:18:32

Description :
A vulnerability, which was classified as problematic, has been found in code-projects Faculty Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/pages/yearlevel.php. The manipulation of the argument Year Level/Section leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248744.

CVE ID : CVE-2023-7057
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://drive.google.com/file/d/1s2kLMjnUvlrD_XocoDl3-ABrWYTo5Azd/view?usp=sharing | source : cna@vuldb.com
https://vuldb.com/?ctiid.248744 | source : cna@vuldb.com
https://vuldb.com/?id.248744 | source : cna@vuldb.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-7059

First published on : 22-12-2023 05:15:14
Last modified on : 22-12-2023 12:18:32

Description :
A vulnerability was found in SourceCodester School Visitor Log e-Book 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file log-book.php. The manipulation of the argument Full Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248750 is the identifier assigned to this vulnerability.

CVE ID : CVE-2023-7059
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/school-visitors-log-e-book.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.248750 | source : cna@vuldb.com
https://vuldb.com/?id.248750 | source : cna@vuldb.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-7075

First published on : 22-12-2023 12:15:27
Last modified on : 22-12-2023 12:18:32

Description :
A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /main/checkout.php. The manipulation of the argument pt leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248846 is the identifier assigned to this vulnerability.

CVE ID : CVE-2023-7075
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/Glunko/vulnerability/blob/main/Point-of-Sales-And-Inventory-Management-System.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.248846 | source : cna@vuldb.com
https://vuldb.com/?id.248846 | source : cna@vuldb.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-7076

First published on : 22-12-2023 14:15:07
Last modified on : 22-12-2023 20:32:41

Description :
A vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of the file system/pages/bugtracker.php. The manipulation of the argument bug[2]['subject']/bug[2]['text']/report['subject'] leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.14 is able to address this issue. The name of the patch is 83a91ec540072d319dd338abff45f8d5ebf48190. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248848.

CVE ID : CVE-2023-7076
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/otsoft/myaac/commit/83a91ec540072d319dd338abff45f8d5ebf48190 | source : cna@vuldb.com
https://github.com/slawkens/myaac/releases/tag/v0.8.14 | source : cna@vuldb.com
https://vuldb.com/?ctiid.248848 | source : cna@vuldb.com
https://vuldb.com/?id.248848 | source : cna@vuldb.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-7053

First published on : 22-12-2023 02:15:43
Last modified on : 22-12-2023 12:18:32

Description :
A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/signup.php. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248740.

CVE ID : CVE-2023-7053
Source : cna@vuldb.com
CVSS Score : 3.1

References :
https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/note_weakpass.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.248740 | source : cna@vuldb.com
https://vuldb.com/?id.248740 | source : cna@vuldb.com

Vulnerability : CWE-521


Vulnerability ID : CVE-2023-7056

First published on : 22-12-2023 03:15:10
Last modified on : 22-12-2023 12:18:32

Description :
A vulnerability classified as problematic was found in code-projects Faculty Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/pages/subjects.php. The manipulation of the argument Description/Units leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248743.

CVE ID : CVE-2023-7056
Source : cna@vuldb.com
CVSS Score : 2.4

References :
https://drive.google.com/file/d/1XDGcSRytGV11YWuhIuW_4GvD7kEpgjZT/view?usp=sharing | source : cna@vuldb.com
https://vuldb.com/?ctiid.248743 | source : cna@vuldb.com
https://vuldb.com/?id.248743 | source : cna@vuldb.com

Vulnerability : CWE-79


(35) NO SCORE VULNERABILITIES [0.0, 0.0]

Source : mitre.org

Vulnerability ID : CVE-2023-51704

First published on : 22-12-2023 02:15:42
Last modified on : 22-12-2023 12:18:32

Description :
An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.

CVE ID : CVE-2023-51704
Source : cve@mitre.org
CVSS Score : /

References :
https://phabricator.wikimedia.org/T347726 | source : cve@mitre.org


Vulnerability ID : CVE-2023-51707

First published on : 22-12-2023 02:15:43
Last modified on : 22-12-2023 12:18:32

Description :
MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected.

CVE ID : CVE-2023-51707
Source : cve@mitre.org
CVSS Score : /

References :
https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Command_Injection_Attacks.pdf | source : cve@mitre.org


Vulnerability ID : CVE-2023-51708

First published on : 22-12-2023 02:15:43
Last modified on : 22-12-2023 12:18:32

Description :
Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For Transportation before 23.00.01.25.

CVE ID : CVE-2023-51708
Source : cve@mitre.org
CVSS Score : /

References :
https://www.bentley.com/advisories/be-2023-0002/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51713

First published on : 22-12-2023 03:15:09
Last modified on : 22-12-2023 12:18:32

Description :
make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.

CVE ID : CVE-2023-51713
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/proftpd/proftpd/blob/1.3.8/NEWS | source : cve@mitre.org
https://github.com/proftpd/proftpd/issues/1683 | source : cve@mitre.org
https://github.com/proftpd/proftpd/issues/1683#issuecomment-1712887554 | source : cve@mitre.org


Vulnerability ID : CVE-2022-47532

First published on : 22-12-2023 04:15:08
Last modified on : 22-12-2023 12:18:32

Description :
FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request.

CVE ID : CVE-2022-47532
Source : cve@mitre.org
CVSS Score : /

References :
https://herolab.usd.de/security-advisories/usd-2022-0064/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-24609

First published on : 22-12-2023 04:15:08
Last modified on : 22-12-2023 12:18:32

Description :
Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate.

CVE ID : CVE-2023-24609
Source : cve@mitre.org
CVSS Score : /

References :
https://www.rambus.com/security/software-protocols/tls-toolkit/ | source : cve@mitre.org
https://www.telekom.com/en/company/data-privacy-and-security/news/advisories-504842 | source : cve@mitre.org


Vulnerability ID : CVE-2023-43116

First published on : 22-12-2023 10:15:11
Last modified on : 22-12-2023 12:18:32

Description :
A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.

CVE ID : CVE-2023-43116
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-43741

First published on : 22-12-2023 10:15:11
Last modified on : 22-12-2023 12:18:32

Description :
A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.

CVE ID : CVE-2023-43741
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-49356

First published on : 22-12-2023 10:15:11
Last modified on : 22-12-2023 12:18:32

Description :
A stack buffer overflow vulnerability in MP3Gain v1.6.2 allows an attacker to cause a denial of service via the WriteMP3GainAPETag function at apetag.c:592.

CVE ID : CVE-2023-49356
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/linzc21/bug-reports/blob/main/reports/mp3gain/1.6.2/stack-buffer-overflow/CVE-2023-49356.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-49391

First published on : 22-12-2023 11:15:07
Last modified on : 22-12-2023 12:18:32

Description :
An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message.

CVE ID : CVE-2023-49391
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/free5gc/free5gc/issues/497 | source : cve@mitre.org


Vulnerability ID : CVE-2023-50569

First published on : 22-12-2023 11:15:07
Last modified on : 22-12-2023 12:18:32

Description :
Reflected Cross Site Scripting (XSS) vulnerability in Cacti v1.2.25, allows remote attackers to escalate privileges when uploading an xml template file via templates_import.php.

CVE ID : CVE-2023-50569
Source : cve@mitre.org
CVSS Score : /

References :
https://gist.github.com/ISHGARD-2/a6b57de899f977e2af41780e7428b4bf | source : cve@mitre.org


Vulnerability ID : CVE-2023-42465

First published on : 22-12-2023 16:15:08
Last modified on : 22-12-2023 20:32:41

Description :
Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.

CVE ID : CVE-2023-42465
Source : cve@mitre.org
CVSS Score : /

References :
https://arxiv.org/abs/2309.02545 | source : cve@mitre.org
https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f | source : cve@mitre.org
https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_15 | source : cve@mitre.org
https://www.openwall.com/lists/oss-security/2023/12/21/9 | source : cve@mitre.org
https://www.sudo.ws/releases/changelog/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-45957

First published on : 22-12-2023 16:15:08
Last modified on : 22-12-2023 20:32:41

Description :
A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.

CVE ID : CVE-2023-45957
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/thirtybees/thirtybees/commit/f5b2c1e0094ce53fded1443bab99a604ae8e2968 | source : cve@mitre.org
https://github.com/thirtybees/thirtybees/compare/1.4.0...1.5.0 | source : cve@mitre.org
https://zigrin.com/advisories/thirty-bees-stored-cross-site-scripting-xss/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51023

First published on : 22-12-2023 18:15:07
Last modified on : 22-12-2023 20:32:34

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘host_time’ parameter of the NTPSyncWithHost interface of the cstecgi .cgi.

CVE ID : CVE-2023-51023
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031NTPSyncWithHost-host_time/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51024

First published on : 22-12-2023 18:15:07
Last modified on : 22-12-2023 20:32:34

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘tz’ parameter of the setNtpCfg interface of the cstecgi .cgi.

CVE ID : CVE-2023-51024
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setNtpCfg-tz/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51025

First published on : 22-12-2023 18:15:07
Last modified on : 22-12-2023 20:32:34

Description :
TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to an unauthorized arbitrary command execution in the ‘admuser’ parameter of the setPasswordCfg interface of the cstecgi .cgi.

CVE ID : CVE-2023-51025
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setPasswordCfg-admuser/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51026

First published on : 22-12-2023 18:15:07
Last modified on : 22-12-2023 20:32:34

Description :
TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘hour’ parameter of the setRebootScheCfg interface of the cstecgi .cgi.

CVE ID : CVE-2023-51026
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setRebootScheCfg-hour/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51027

First published on : 22-12-2023 18:15:07
Last modified on : 22-12-2023 20:32:34

Description :
TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘apcliAuthMode’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi.

CVE ID : CVE-2023-51027
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/3/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setWiFiExtenderConfig-apcliAuthMode/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51028

First published on : 22-12-2023 18:15:07
Last modified on : 22-12-2023 20:32:34

Description :
TOTOLINK EX1800T 9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the apcliChannel parameter of the setWiFiExtenderConfig interface of the cstecgi.cgi.

CVE ID : CVE-2023-51028
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/3/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setWiFiExtenderConfig-apcliChannel/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-50147

First published on : 22-12-2023 19:15:08
Last modified on : 22-12-2023 20:32:25

Description :
There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware version V9.1.2u.5822_B20200513.

CVE ID : CVE-2023-50147
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R%28setDiagnosisCfg%29/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51011

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanPriDns parameter’ of the setLanConfig interface of the cstecgi .cgi

CVE ID : CVE-2023-51011
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setLanConfig-lanPriDns/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51012

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanGateway parameter’ of the setLanConfig interface of the cstecgi .cgi.

CVE ID : CVE-2023-51012
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setLanConfig-lanGateway/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51013

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanNetmask parameter’ of the setLanConfig interface of the cstecgi .cgi.

CVE ID : CVE-2023-51013
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setLanConfig-lanNetmask/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51014

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOLINK EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanSecDns parameter’ of the setLanConfig interface of the cstecgi .cgi

CVE ID : CVE-2023-51014
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setLanConfig_lanSecDns/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51015

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOLINX EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘enable parameter’ of the setDmzCfg interface of the cstecgi .cgi

CVE ID : CVE-2023-51015
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setDmzCfg/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51016

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the setRebootScheCfg interface of the cstecgi .cgi.

CVE ID : CVE-2023-51016
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/10/EX1800T/TOTOlink%20EX1800T_V9.1.0cu.2112_B20220316%28setRebootScheCfg%29/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51017

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanIp parameter’ of the setLanConfig interface of the cstecgi .cgi.

CVE ID : CVE-2023-51017
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setLanConfig-lanIp/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51018

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘opmode’ parameter of the setWiFiApConfig interface of the cstecgi .cgi.

CVE ID : CVE-2023-51018
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setWiFiApConfig-opmode/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51019

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘key5g’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi.

CVE ID : CVE-2023-51019
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setWiFiExtenderConfig-key5g/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51020

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langType’ parameter of the setLanguageCfg interface of the cstecgi .cgi.

CVE ID : CVE-2023-51020
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setLanguageCfg-langType/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51021

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘merge’ parameter of the setRptWizardCfg interface of the cstecgi .cgi.

CVE ID : CVE-2023-51021
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setRptWizardCfg-merge/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51022

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langFlag’ parameter of the setLanguageCfg interface of the cstecgi .cgi.

CVE ID : CVE-2023-51022
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/11/EX1800T/2/3/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setLanguageCfg-langFlag/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51033

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi setOpModeCfg interface.

CVE ID : CVE-2023-51033
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/12/ex1200l/totolink_ex1200L_setOpModeCfg/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51034

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi UploadFirmwareFile interface.

CVE ID : CVE-2023-51034
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/12/ex1200l/totolink_ex1200L_UploadFirmwareFile/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-51035

First published on : 22-12-2023 19:15:09
Last modified on : 22-12-2023 20:32:25

Description :
TOTOLINK EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution on the cstecgi.cgi NTPSyncWithHost interface.

CVE ID : CVE-2023-51035
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/12/12/ex1200l/totolink_ex1200L_NTPSyncWithHost/ | source : cve@mitre.org


This website uses the NVD API, but is not approved or certified by it.

About the author
Julien B.

Securitricks

Up-to-Date Cybersecurity Insights & Malware Reports

Securitricks

Great! You’ve successfully signed up.

Welcome back! You've successfully signed in.

You've successfully subscribed to Securitricks.

Success! Check your email for magic link to sign-in.

Success! Your billing info has been updated.

Your billing was not updated.