CVE-2023-22377

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an attacker may obtain an arbitrary file which meets a certain condition by reading a specially crafted XML file.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Feb 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-223786.5A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows a CVE-2023-223795.5Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information d CVE-2023-223806.5A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages s CVE-2023-223818.8A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single CVE-2023-223828.2Weak configuration in Automotive while VM is processing a listener request from TEE.CVE-2023-223837.8Memory Corruption in camera while installing a fd for a particular DMA buffer.CVE-2023-223847.8Memory Corruption in VR Service while sending data using Fast Message Queue (FMQ).CVE-2023-223859.8Memory Corruption in Data Modem while making a MO call or MT VOLTE call.CVE-2023-223867.8Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.CVE-2023-223877.8Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.CVE-2023-223889.8Memory Corruption in Multi-mode Call Processor while processing bit mask API.CVE-2023-223896.5Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via