Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2023-1941
A vulnerability, which was classified as critical, has been found in SourceCodester Simple and Beautiful Shopping Cart System 1.0. This issue affects some unknown processing of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225317 was assigned to this vulnerability.
Affected Products: Simple and Beautiful Shopping Cart System
References: [{'url': 'https://vuldb.com/?id.225317', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225317', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/anchnet-security/Mkshope/blob/main/simple%20and%20beautiful%20shopping%20cart%20system%20login.php%20has%20Sqlinjection.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1942
A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/?page=user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225319.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225319', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.225319', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/Upload%20any%20file%20at%20the%20administrator%20profile%20upload%20location.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1945
Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10.
Affected Products: Thunderbird
References: [{'url': 'https://www.mozilla.org/security/advisories/mfsa2023-15/'}, {'url': 'https://www.mozilla.org/security/advisories/mfsa2023-14/'}, {'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1777588'}]
CVE State: PUBLISHED
Explain CVE-2023-1946
A vulnerability was found in SourceCodester Survey Application System 1.0 and classified as problematic. This issue affects some unknown processing of the component Add New Handler. The manipulation of the argument Title with the input <script>prompt(document.domain)</script> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225329 was assigned to this vulnerability.
Affected Products: Survey Application System
References: [{'url': 'https://vuldb.com/?id.225329', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225329', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1947
A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225330 is the identifier assigned to this vulnerability.
Affected Products: taoCMS
References: [{'url': 'https://vuldb.com/?id.225330', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.225330', 'tags': ['signature', 'permissions-required']}, {'url': 'https://gitee.com/misak7in/cve/blob/master/taocms.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1948
A vulnerability, which was classified as problematic, has been found in PHPGurukul BP Monitoring Management System 1.0. This issue affects some unknown processing of the file add-family-member.php of the component Add New Family Member Handler. The manipulation of the argument Member Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225335.
Affected Products: BP Monitoring Management System
References: [{'url': 'https://vuldb.com/?id.225335', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225335', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/vsdwef/BP-Monitoring-Management-System/blob/main/XSS_English.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1949
A vulnerability, which was classified as critical, was found in PHPGurukul BP Monitoring Management System 1.0. Affected is an unknown function of the file change-password.php of the component Change Password Handler. The manipulation of the argument password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225336.
Affected Products: BP Monitoring Management System
References: [{'url': 'https://vuldb.com/?id.225336', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225336', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/vsdwef/BP-Monitoring-Management-System/blob/main/ChangePassword.php_SQL_English.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1950
A vulnerability has been found in PHPGurukul BP Monitoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file password-recovery.php of the component Password Recovery. The manipulation of the argument emailid/contactno leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225337 was assigned to this vulnerability.
Affected Products: BP Monitoring Management System
References: [{'url': 'https://vuldb.com/?id.225337', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225337', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/vsdwef/BP-Monitoring-Management-System/blob/main/password-recovery.php_SQL_English.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1951
A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this issue is the function delete_brand of the file /admin/maintenance/brand.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-225338 is the identifier assigned to this vulnerability.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225338', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225338', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/Delete%20category%20list%20with%20SQL%20injection.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1952
A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been classified as critical. This affects an unknown part of the file /?p=products of the component Product Search. The manipulation of the argument search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225339.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225339', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225339', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/SQL%20injection%20exists%20in%20the%20search%20bar%20on%20the%20homepage.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1953
A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/sales/index.php. The manipulation of the argument date_start/date_end leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225340.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225340', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225340', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/SQL%20injection%20in%20sales%20report%20query.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1954
A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been rated as critical. This issue affects the function save_inventory of the file /admin/product/manage.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225341 was assigned to this vulnerability.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225341', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225341', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/SQL%20injection%20present%20at%20product%20update.pdf', 'tags': ['exploit', 'patch']}]
CVE State: PUBLISHED
Explain CVE-2023-1955
A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is an unknown function of the file login.php of the component User Registration. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225342 is the identifier assigned to this vulnerability.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225342', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225342', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/User%20registration%20SQL%20injection.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1956
A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=delete_img of the component Image Handler. The manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225343.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225343', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225343', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/Any%20file%20deletion%20exists%20in%20the%20system%20management%20department.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1957
A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=save_sub_category of the component Subcategory Handler. The manipulation of the argument sub_category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225344.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225344', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225344', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/SQL%20injection%20exists%20at%20the%20newly%20added%20subcategory%20list.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1958
A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file /classes/Master.php?f=delete_sub_category. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225345 was assigned to this vulnerability.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225345', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225345', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/SQL%20injection%20present%20at%20subcategory%20deletion.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1959
A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. This vulnerability affects unknown code of the file /classes/Master.php?f=save_category. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-225346 is the identifier assigned to this vulnerability.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225346', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225346', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/SQL%20injection%20exists%20at%20the%20newly%20added%20category%20list.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1960
A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225347.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225347', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225347', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/SQL%20injection%20exists%20at%20the%20deletion%20point%20of%20the%20category%20list.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1961
A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/?page=system_info. The manipulation of the argument System Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225348.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225348', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225348', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/Cross%20site%20scripting%20attack%20at%20system%20name%20setting.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1962
A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/forgot-password.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225361 was assigned to this vulnerability.
Affected Products: Best Online News Portal
References: [{'url': 'https://vuldb.com/?id.225361', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225361', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/PEOIzEve/bug_report/blob/main/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1963
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file index.php of the component Search. The manipulation of the argument searchinput leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225359.
Affected Products: Bank Locker Management System
References: [{'url': 'https://vuldb.com/?id.225359', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225359', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/vsdwef/Bank-locker-Managament-System/blob/main/search-locker-details.php_SQL_English.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1964
A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file recovery.php of the component Password Reset. The manipulation of the argument uname/mobile leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225360.
Affected Products: Bank Locker Management System
References: [{'url': 'https://vuldb.com/?id.225360', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225360', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/vsdwef/Bank-locker-Managament-System/blob/main/password-recovery.php_SQL_English.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1965
An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for 3rd party Group SAML SSO logins. This feature isn't enabled by default.
Affected Products: GitLab
References: [{'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/406235'}, {'url': 'https://hackerone.com/reports/1923672'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1965.json'}]
CVE State: PUBLISHED
Explain CVE-2023-1966
Instruments with Illumina Universal Copy Service v1.x and
v2.x contain an unnecessary privileges vulnerability. An unauthenticated
malicious actor could upload and execute code remotely at the operating system
level, which could allow an attacker to change settings, configurations,
software, or access sensitive data on the affected product.






Affected Products: iScan Control Software
References: [{'url': 'https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01'}, {'tags': ['vendor-advisory'], 'url': 'https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1967
Keysight N8844A Data Analytics Web Service deserializes untrusted data without sufficiently verifying the resulting data will be valid. 
Affected Products: N8844A Data Analytics Web Service
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-115-01'}]
CVE State: PUBLISHED
Explain CVE-2023-1968

Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. 








Affected Products: iScan Control Software
References: [{'url': 'https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01'}, {'tags': ['vendor-advisory'], 'url': 'https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1969
A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects unknown code of the file /admin/inventory/manage_stock.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-225406 is the identifier assigned to this vulnerability.
Affected Products: Online Eyewear Shop
References: [{'url': 'https://vuldb.com/?id.225406', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225406', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/Gear-D/bug_report/blob/main/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1970
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in yuan1994 tpAdmin 1.3.12. This issue affects the function Upload of the file application\admin\controller\Upload.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225407. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected Products: tpAdmin
References: [{'url': 'https://vuldb.com/?id.225407', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225407', 'tags': ['signature', 'permissions-required']}, {'url': 'https://tib36.github.io/2023/04/09/tpAdmin-RCE/', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1971
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225408. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected Products: tpAdmin
References: [{'url': 'https://vuldb.com/?id.225408', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225408', 'tags': ['signature', 'permissions-required']}, {'url': 'https://tib36.github.io/2023/04/09/tpAdmin-SSRF/', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1972
A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.
Affected Products: binutils
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2185646'}, {'url': 'https://sourceware.org/bugzilla/show_bug.cgi?id=30285'}]
CVE State: PUBLISHED
Explain CVE-2023-1974
Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.
Affected Products: answerdev/answer
References: [{'url': 'https://github.com/answerdev/answer/commit/ac3f2f047ee00b4edaea7530e570ab67ff87cd6a'}, {'url': 'https://huntr.dev/bounties/852781c6-9cc8-4d25-9336-bf3cb8ee3439'}]
CVE State: PUBLISHED
Explain CVE-2023-1975
Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.
Affected Products: answerdev/answer
References: [{'url': 'https://huntr.dev/bounties/829cab7a-4ed7-465c-aa96-29f4f73dbfff'}, {'url': 'https://github.com/answerdev/answer/commit/ac3f2f047ee00b4edaea7530e570ab67ff87cd6a'}]
CVE State: PUBLISHED
Explain CVE-2023-1976
Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6.
Affected Products: answerdev/answer
References: [{'url': 'https://github.com/answerdev/answer/commit/813ad0b9894673b1bdd489a2e9ab60a44fe990af'}, {'url': 'https://huntr.dev/bounties/469bcabf-b315-4750-b63c-82ac86d153de'}]
CVE State: PUBLISHED
Explain CVE-2023-1978
The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in versions up to, and including, 4.9.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Products: ShiftController Employee Shift Scheduling
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/b5c61212-e68e-4198-b078-18121576b767?source=cve'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2898274/shiftcontroller'}]
CVE State: PUBLISHED
Explain CVE-2023-1979
The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly protected content. We recommend upgrading to version 1.32 or beyond commit  ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 

Affected Products: Web Stories for WordPress
References: [{'url': 'https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68'}, {'url': 'https://github.com/GoogleForCreators/web-stories-wp/releases/tag/v1.32.0'}]
CVE State: PUBLISHED
Explain CVE-2023-1980
Two factor 

authentication

bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor authentication via the application user interface and open entries.
Affected Products: Remote Desktop Manager
References: [{'url': 'https://devolutions.net/security/advisories/DEVO-2023-0009'}]
CVE State: PUBLISHED
Explain CVE-2023-1981
A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash.
Affected Products: avahi
References: [{'url': 'https://access.redhat.com/security/cve/CVE-2023-1981'}, {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2185911'}, {'url': 'https://github.com/lathiat/avahi/issues/375'}]
CVE State: PUBLISHED
Explain CVE-2023-1983
A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/products/manage_product.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-225530 is the identifier assigned to this vulnerability.
Affected Products: Sales Tracker Management System
References: [{'url': 'https://vuldb.com/?id.225530', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225530', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/graywar1/bug_report/blob/main/SQLi.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1984
A vulnerability classified as critical was found in SourceCodester Complaint Management System 1.0. This vulnerability affects unknown code of the file /users/check_availability.php of the component POST Parameter Handler. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225532.
Affected Products: Complaint Management System
References: [{'url': 'https://vuldb.com/?id.225532', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225532', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/qinyiqun/bug_report/blob/main/SQLi.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1985
A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. This issue affects the function save_brand of the file /classes/Master.php?f=save_brand. The manipulation of the argument name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225533 was assigned to this vulnerability.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225533', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225533', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/1-SQL%20injection%20exists%20at%20the%20location%20where%20the%20brand%20list%20is%20added.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1986
A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. Affected is the function delete_order of the file /classes/master.php?f=delete_order. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225534 is the identifier assigned to this vulnerability.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225534', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225534', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/3-SQL%20injection%20exists%20at%20order%20deletion%20point.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1987
A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is the function update_order_status of the file /classes/Master.php?f=update_order_status. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225535.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225535', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225535', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/4-SQL%20injection%20present%20at%20order%20status%20update.pdf', 'tags': ['exploit', 'patch']}]
CVE State: PUBLISHED
Explain CVE-2023-1988
A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/?page=maintenance/brand. The manipulation of the argument Brand Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225536.
Affected Products: Online Computer and Laptop Store
References: [{'url': 'https://vuldb.com/?id.225536', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.225536', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/5-%20There%20is%20a%20storage%20type%20cross%20site%20scripting%20attack%20at%20the%20brand%20name.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1989
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices.
Affected Products: Kernel
References: [{'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=f132c2d13088'}, {'name': '[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html'}, {'name': '[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html'}, {'url': 'https://security.netapp.com/advisory/ntap-20230601-0004/'}]
CVE State: PUBLISHED
Explain CVE-2023-1990
A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem.
Affected Products: Linux
References: [{'url': 'https://lore.kernel.org/all/20230312160837.2040857-1-zyytlz.wz%40163.com/'}, {'name': '[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html'}, {'name': '[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1992
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
Affected Products: Wireshark
References: [{'url': 'https://www.wireshark.org/security/wnpa-sec-2023-09.html'}, {'url': 'https://gitlab.com/wireshark/wireshark/-/issues/18852'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1992.json'}, {'name': 'FEDORA-2023-f70fbf64cb', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EHLTD25WNQSPQNELX52UH6YLP4TBLKTT/'}, {'name': 'FEDORA-2023-203eff67e0', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFJERBHVWYLYWXO2B3V47QH66IEB6EZ3/'}, {'name': 'FEDORA-2023-7af3ad9ffe', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZA7IMATNNQPLIM6WMRPM3T5ZY24NRR2/'}, {'name': '[debian-lts-announce] 20230429 [SECURITY] [DLA 3402-1] wireshark security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/04/msg00029.html'}, {'name': 'DSA-5429', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2023/dsa-5429'}]
CVE State: PUBLISHED
Explain CVE-2023-1993
LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
Affected Products: Wireshark
References: [{'url': 'https://www.wireshark.org/security/wnpa-sec-2023-10.html'}, {'url': 'https://gitlab.com/wireshark/wireshark/-/issues/18900'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1993.json'}, {'name': 'FEDORA-2023-f70fbf64cb', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EHLTD25WNQSPQNELX52UH6YLP4TBLKTT/'}, {'name': 'FEDORA-2023-203eff67e0', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFJERBHVWYLYWXO2B3V47QH66IEB6EZ3/'}, {'name': 'FEDORA-2023-7af3ad9ffe', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZA7IMATNNQPLIM6WMRPM3T5ZY24NRR2/'}, {'name': '[debian-lts-announce] 20230429 [SECURITY] [DLA 3402-1] wireshark security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/04/msg00029.html'}, {'name': 'DSA-5429', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2023/dsa-5429'}]
CVE State: PUBLISHED
Explain CVE-2023-1994
GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
Affected Products: Wireshark
References: [{'url': 'https://www.wireshark.org/security/wnpa-sec-2023-11.html'}, {'url': 'https://gitlab.com/wireshark/wireshark/-/issues/18947'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1994.json'}, {'name': 'FEDORA-2023-f70fbf64cb', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EHLTD25WNQSPQNELX52UH6YLP4TBLKTT/'}, {'name': 'FEDORA-2023-203eff67e0', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFJERBHVWYLYWXO2B3V47QH66IEB6EZ3/'}, {'name': 'FEDORA-2023-7af3ad9ffe', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZA7IMATNNQPLIM6WMRPM3T5ZY24NRR2/'}, {'name': '[debian-lts-announce] 20230429 [SECURITY] [DLA 3402-1] wireshark security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/04/msg00029.html'}, {'name': 'DSA-5429', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2023/dsa-5429'}]
CVE State: PUBLISHED
Explain CVE-2023-1996
A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.
Affected Products: 3DEXPERIENCE
References: [{'url': 'https://www.3ds.com/vulnerability/advisories'}]
CVE State: PUBLISHED
Explain CVE-2023-1998
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line.

This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects.



Affected Products: Linux Kernel
References: [{'url': 'https://github.com/google/security-research/security/advisories/GHSA-mj4w-6495-6crx'}, {'url': 'https://github.com/torvalds/linux/commit/6921ed9049bc7457f66c1596c5b78aec0dae4a9d'}, {'url': 'https://kernel.dance/#6921ed9049bc7457f66c1596c5b78aec0dae4a9d'}, {'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html'}, {'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1999
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. 

Affected Products: libwebp
References: [{'url': 'https://chromium.googlesource.com/webm/libwebp'}]
CVE State: PUBLISHED