Publish Advisories

GHSA-5cw2-v2x8-w9xg GHSA-66jv-2xqf-9p8x GHSA-6q84-3g95-w6vx GHSA-8crg-9wvr-72vm GHSA-9mr3-mrj5-pc9x GHSA-jfmg-667v-4gmf GHSA-m54p-35qp-m26h GHSA-w3rp-w7w7-6prp GHSA-wh77-275q-j2qw
2026-05-22 18:04:22 -07:00 · 2023-12-25 03:31:39 +00:00
parent ddaa324918
commit d3028785d6
9 changed files with 406 additions and 0 deletions
@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5cw2-v2x8-w9xg",
+  "modified": "2023-12-25T03:30:27Z",
+  "published": "2023-12-25T03:30:27Z",
+  "aliases": [
+    "CVE-2023-7099"
+  ],
+  "details": "A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file bwdates-report-result.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248951.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7099"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/laoquanshi/heishou/blob/main/niv%20-SQL"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/laoquanshi/heishou/blob/main/sqlmap.png"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.248951"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.248951"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-25T03:15:08Z"
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-66jv-2xqf-9p8x",
+  "modified": "2023-12-25T03:30:27Z",
+  "published": "2023-12-25T03:30:27Z",
+  "aliases": [
+    "CVE-2023-7098"
+  ],
+  "details": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects unknown code of the file app/hide.php. The manipulation of the argument key leads to path traversal: '../filedir'. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-248950 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7098"
+    },
+    {
+      "type": "WEB",
+      "url": "https://note.zhaoj.in/share/MHnV2WLY9rxU"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.248950"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.248950"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-24"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-25T02:15:44Z"
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6q84-3g95-w6vx",
+  "modified": "2023-12-25T03:30:27Z",
+  "published": "2023-12-25T03:30:27Z",
+  "aliases": [
+    "CVE-2023-7095"
+  ],
+  "details": "A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7095"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/unpWn4bL3/iot-security/blob/main/2.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.248942"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.248942"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-120"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-25T01:15:08Z"
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8crg-9wvr-72vm",
+  "modified": "2023-12-25T03:30:27Z",
+  "published": "2023-12-25T03:30:27Z",
+  "aliases": [
+    "CVE-2023-7100"
+  ],
+  "details": "A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248952.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7100"
+    },
+    {
+      "type": "WEB",
+      "url": "https://medium.com/@2839549219ljk/restaurant-table-booking-system-sql-injection-vulnerability-30708cfabe03"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.248952"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.248952"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-25T03:15:08Z"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9mr3-mrj5-pc9x",
+  "modified": "2023-12-25T03:30:27Z",
+  "published": "2023-12-25T03:30:27Z",
+  "aliases": [
+    "CVE-2023-49880"
+  ],
+  "details": "In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN messages are assumed to be immutable. However, an attacker might modify these elements of a business transaction.  IBM X-Force ID:  273183.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49880"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/273183"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7101167"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-25T03:15:08Z"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jfmg-667v-4gmf",
+  "modified": "2023-12-25T03:30:27Z",
+  "published": "2023-12-25T03:30:27Z",
+  "aliases": [
+    "CVE-2021-38927"
+  ],
+  "details": "IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  210322.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38927"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/210322"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7101252"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-25T03:15:07Z"
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-m54p-35qp-m26h",
+  "modified": "2023-12-25T03:30:27Z",
+  "published": "2023-12-25T03:30:27Z",
+  "aliases": [
+    "CVE-2023-7096"
+  ],
+  "details": "A vulnerability was found in code-projects Faculty Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/php/crud.php. The manipulation of the argument fieldname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248948.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7096"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Glunko/vulnerability/blob/main/Faculty-Management-System_sql.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.248948"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.248948"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-25T01:15:08Z"
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-w3rp-w7w7-6prp",
+  "modified": "2023-12-25T03:30:27Z",
+  "published": "2023-12-25T03:30:27Z",
+  "aliases": [
+    "CVE-2023-7097"
+  ],
+  "details": "A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248949 was assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7097"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Glunko/vulnerability/blob/main/Water-Billing-System_sql.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.248949"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.248949"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-25T02:15:44Z"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wh77-275q-j2qw",
+  "modified": "2023-12-25T03:30:27Z",
+  "published": "2023-12-25T03:30:27Z",
+  "aliases": [
+    "CVE-2023-43064"
+  ],
+  "details": "Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call.  A malicious actor could cause arbitrary code to run with the privilege of the user invoking the facsimile support.  IBM X-Force ID:  267689.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43064"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/267689"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7101330"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-427"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-25T03:15:08Z"
+  }
+}