Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2023-1087
The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: WC Sales Notification
References: [{'url': 'https://wpscan.com/vulnerability/356c89a1-81b6-4600-9291-1a74788af7f9', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1088
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: WP Plugin Manager
References: [{'url': 'https://wpscan.com/vulnerability/a956f1cd-fce4-4235-b1af-4b7675a60ca2', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1089
The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: Coupon Zen
References: [{'url': 'https://wpscan.com/vulnerability/9787e26f-33fe-4c65-abb3-7f5c76ae8d6f', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1090
The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected Products: SMTP Mailing Queue
References: [{'url': 'https://wpscan.com/vulnerability/d470dd6c-dcac-4a3e-b42a-2489a31aca45', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'https://github.com/youki992/youki992.github.io/blob/master/others/apply.md'}]
CVE State: PUBLISHED
Explain CVE-2023-1091
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpata Licensed Warehousing Automation System allows Command Line Execution through SQL Injection.This issue affects Licensed Warehousing Automation System: through 2023.1.01.


Affected Products: Licensed Warehousing Automation System
References: [{'tags': ['government-resource'], 'url': 'https://www.usom.gov.tr/bildirim/tr-23-0139'}]
CVE State: PUBLISHED
Explain CVE-2023-1092
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
Affected Products: OAuth Single Sign On Free
References: [{'url': 'https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fb', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09c', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1093
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
Affected Products: OAuth Single Sign On
References: [{'url': 'https://wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1094
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food parameter.
Affected Products: MonicaHQ
References: [{'url': 'https://fluidattacks.com/advisories/napoli'}, {'url': 'https://www.monicahq.com/'}]
CVE State: PUBLISHED
Explain CVE-2023-1095
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.
Affected Products: Linux kernel netfilter subsystem.
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2173973'}, {'url': 'https://github.com/torvalds/linux/commit/580077855a40741cf511766129702d97ff02f4d9'}]
CVE State: PUBLISHED
Explain CVE-2023-1096
SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to gain access as an admin user.
Affected Products: SnapCenter
References: [{'url': 'https://security.netapp.com/advisory/ntap-20230511-0011/'}]
CVE State: PUBLISHED
Explain CVE-2023-1097
Baicells EG7035-M11 devices with firmware through  BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party analyst and have been confirmed exploitable special thanks to Lionel Musonza for the discovery.






Affected Products: EG7035-M11
References: [{'tags': ['patch', 'release-notes'], 'url': 'https://community.na.baicells.com/t/baice-bm-2-5-26-new-cpe-software-has-been-released/1756'}, {'tags': ['patch'], 'url': 'https://img.baicells.com//Upload/20220524/FILE/BaiCE_BM_2.5.26_NA.bin.bin'}]
CVE State: PUBLISHED
Explain CVE-2023-1098
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.
Affected Products: GitLab
References: [{'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/383745'}, {'url': 'https://hackerone.com/reports/1784294'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1098.json'}]
CVE State: PUBLISHED
Explain CVE-2023-1099
A vulnerability was found in SourceCodester Online Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file eduauth/edit-class-detail.php. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-222002 is the identifier assigned to this vulnerability.
Affected Products: Online Student Management System
References: [{'url': 'https://vuldb.com/?id.222002', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222002', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/E1CHO/cve_hub/blob/main/Online%20student%20management%20system%20pdf/Online%20student%20management%20system%20sql%20vlun%201.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1100
A vulnerability classified as critical has been found in SourceCodester Online Catering Reservation System 1.0. This affects an unknown part of the file /reservation/add_message.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222003.
Affected Products: Online Catering Reservation System
References: [{'url': 'https://vuldb.com/?id.222003', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222003', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/jackswordsz/bug_report/blob/main/vendors/emoblazz/Online%20Catering%20Reservation%20System/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1104
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
Affected Products: flatpressblog/flatpress
References: [{'url': 'https://huntr.dev/bounties/a4909b4e-ab3c-41d6-b0d8-1c6e933bf758'}, {'url': 'https://github.com/flatpressblog/flatpress/commit/f6394eac7a0e001d2b1ac638d3313e531d19ea93'}]
CVE State: PUBLISHED
Explain CVE-2023-1105
External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
Affected Products: flatpressblog/flatpress
References: [{'url': 'https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170'}, {'url': 'https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f'}]
CVE State: PUBLISHED
Explain CVE-2023-1106
Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.
Affected Products: flatpressblog/flatpress
References: [{'url': 'https://github.com/flatpressblog/flatpress/commit/5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1'}, {'url': 'https://huntr.dev/bounties/1288ec00-f69d-4b84-abce-efc9a97941a0'}]
CVE State: PUBLISHED
Explain CVE-2023-1107
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
Affected Products: flatpressblog/flatpress
References: [{'url': 'https://github.com/flatpressblog/flatpress/commit/d3f329496536dc99f9707f2f295d571d65a496f5'}, {'url': 'https://huntr.dev/bounties/4b880868-bd28-4fd0-af56-7686e55d3762'}]
CVE State: PUBLISHED
Explain CVE-2023-1109
In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.
Affected Products: ENERGY AXC PU (1264327)
References: [{'url': 'https://cert.vde.com/en/advisories/VDE-2023-003/'}]
CVE State: PUBLISHED
Explain CVE-2023-1112
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.
Affected Products: Drag and Drop Multiple File Upload Contact Form 7
References: [{'url': 'https://vuldb.com/?id.222072', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222072', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/Nickguitar/Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1113
A vulnerability was found in SourceCodester Simple Payroll System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file admin/?page=admin of the component POST Parameter Handler. The manipulation of the argument fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222073 was assigned to this vulnerability.
Affected Products: Simple Payroll System
References: [{'url': 'https://vuldb.com/?id.222073', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222073', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/lcg-22266/bug_report/blob/main/vendors/oretnom23/Simple%20Payroll%20System/XSS-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1114
Improper Input Validation, Missing Authorization vulnerability in Eskom Bilgisayar e-Belediye allows Information Elicitation.This issue affects e-Belediye: from 1.0.0.95 before 1.0.0.100.


Affected Products: e-Belediye
References: [{'tags': ['government-resource'], 'url': 'https://www.usom.gov.tr/bildirim/tr-23-0113-2'}]
CVE State: PUBLISHED
Explain CVE-2023-1115
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Affected Products: pimcore/pimcore
References: [{'url': 'https://huntr.dev/bounties/cfa80332-e4cf-4d64-b3e5-e10298628d17'}, {'url': 'https://github.com/pimcore/pimcore/commit/c6368b7cc69a3ebf2c83de7586f492ca1f404dd3'}]
CVE State: PUBLISHED
Explain CVE-2023-1116
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Affected Products: pimcore/pimcore
References: [{'url': 'https://huntr.dev/bounties/3245ff99-9adf-4db9-af94-f995747e09d1'}, {'url': 'https://github.com/pimcore/pimcore/commit/f6d322efa207a737eedd8726b7c92e957a83341e'}]
CVE State: PUBLISHED
Explain CVE-2023-1117
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Affected Products: pimcore/pimcore
References: [{'url': 'https://huntr.dev/bounties/e8c0044d-a31b-4347-b2d5-59fbf492da39'}, {'url': 'https://github.com/pimcore/pimcore/commit/b9ba69f66d6a9986fb36f239661b98cd33a89853'}]
CVE State: PUBLISHED
Explain CVE-2023-1118
A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
Affected Products: Kernel
References: [{'url': 'https://github.com/torvalds/linux/commit/29b0589a865b6f66d141d79b2dd1373e4e50fe17'}, {'url': 'https://security.netapp.com/advisory/ntap-20230413-0003/'}, {'name': '[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html'}, {'name': '[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1119
The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.
Affected Products: WP-Optimize
References: [{'url': 'https://wpscan.com/vulnerability/2e78735a-a7fc-41fe-8284-45bf451eff06', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1120
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected Products: Simple Giveaways
References: [{'url': 'https://wpscan.com/vulnerability/c2defd30-7e4c-4a28-8a68-282429061f3f', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1121
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected Products: Simple Giveaways
References: [{'url': 'https://wpscan.com/vulnerability/7ead9fb9-d81f-47c6-a1b4-21f29183cc15', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1122
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected Products: Simple Giveaways
References: [{'url': 'https://wpscan.com/vulnerability/71f5d630-2726-48c7-b9e5-7bebc786b561', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1124
The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.
Affected Products: Shopping Cart & eCommerce Store
References: [{'url': 'https://wpscan.com/vulnerability/229b93cd-544b-4877-8d9f-e6debda9511c', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1125
The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.
Affected Products: Ruby Help Desk
References: [{'url': 'https://wpscan.com/vulnerability/e8a4b6ab-47f8-495d-a22c-dcf914dfb58c', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1126
The WP FEvents Book WordPress plugin through 0.46 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Cross-Site Scripting attacks
Affected Products: WP FEvents Book
References: [{'url': 'https://wpscan.com/vulnerability/87ce3c59-b234-47bf-abca-e690b53bbe82', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1127
Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/2d4d309e-4c96-415f-9070-36d0815f1beb'}, {'url': 'https://github.com/vim/vim/commit/e0f869196930ef5f25a0ac41c9215b09c9ce2d3c'}, {'name': 'FEDORA-2023-27958e9307', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDVN5HSWPNVP4QXBPCEGZDLZKURLJWTE/'}, {'name': 'FEDORA-2023-ccf283d7e1', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ6TMKKBXHGVUHWFGM4X46VIJO7ZAG2W/'}, {'name': 'FEDORA-2023-030318ca00', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6/'}]
CVE State: PUBLISHED
Explain CVE-2023-1129
The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.
Affected Products: WP FEvents Book
References: [{'url': 'https://wpscan.com/vulnerability/d40479de-fb04-41b8-9fb0-41b9eefbd8af', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1130
A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file processlogin. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222105 was assigned to this vulnerability.
Affected Products: Computer Parts Sales and Inventory System
References: [{'url': 'https://vuldb.com/?id.222105', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222105', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/WhiteA1so/Cvetest/blob/main/Sql1.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1131
A vulnerability has been found in SourceCodester Computer Parts Sales and Inventory System 1.0 and classified as problematic. This vulnerability affects unknown code of the file customer.php. The manipulation of the argument FIRST_NAME/LAST_NAME/PHONE_NUMBER leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222106 is the identifier assigned to this vulnerability.
Affected Products: Computer Parts Sales and Inventory System
References: [{'url': 'https://vuldb.com/?id.222106', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222106', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/WhiteA1so/Cvetest/blob/main/1.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1132

Compiler removal of buffer clearing in 

sli_se_driver_key_agreement

 in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


Affected Products: Gecko Platform
References: [{'tags': ['patch'], 'url': 'https://github.com/SiliconLabs/gecko_sdk'}, {'tags': ['vendor-advisory'], 'url': 'https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1'}]
CVE State: PUBLISHED
Explain CVE-2023-1133
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow an unauthenticated attacker to remotely execute arbitrary code.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}, {'url': 'http://packetstormsecurity.com/files/172799/Delta-Electronics-InfraSuite-Device-Master-Deserialization.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1134
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a path traversal vulnerability, which could allow an attacker to read local files, disclose plaintext credentials, and escalate privileges.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1135

























In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which could result in local privilege escalation.
























Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1136
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authentication bypass.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1137
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1138
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain an improper access control vulnerability, which could allow an attacker to retrieve Gateway configuration files to obtain plaintext credentials.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1139
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1140
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauthenticated remote code execution in the context of an administrator.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1141
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a command injection vulnerability that could allow an attacker to inject arbitrary commands, which could result in remote code execution.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1142
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1143
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1144
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1145







Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.






Affected Products: InfraSuite Device Master
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1146
Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.
Affected Products: flatpressblog/flatpress
References: [{'url': 'https://huntr.dev/bounties/d6d1e1e2-2f67-4d28-aa84-b30fb1d2e737'}, {'url': 'https://github.com/flatpressblog/flatpress/commit/0ee4f2e8a7b9276880b56858e408cc9c6643cc3b'}]
CVE State: PUBLISHED
Explain CVE-2023-1147
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
Affected Products: flatpressblog/flatpress
References: [{'url': 'https://huntr.dev/bounties/187f5353-f866-4d26-a5ba-fca378520020'}, {'url': 'https://github.com/flatpressblog/flatpress/commit/264217f318a8852c4f3e34350d4a0e1363cdd727'}]
CVE State: PUBLISHED
Explain CVE-2023-1148
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
Affected Products: flatpressblog/flatpress
References: [{'url': 'https://huntr.dev/bounties/f0cc2c4b-fdf9-483b-9a83-4e0dfeb4dac7'}, {'url': 'https://github.com/flatpressblog/flatpress/commit/3a32aad0dec5df24c6576d7567d4f2eadbfc75de'}]
CVE State: PUBLISHED
Explain CVE-2023-1149
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.
Affected Products: btcpayserver/btcpayserver
References: [{'url': 'https://huntr.dev/bounties/2e734209-d7b0-4f57-a8be-c65c82208f2f'}, {'url': 'https://github.com/btcpayserver/btcpayserver/commit/ddb125f45892b4dafdbd5c072af1ce623758bb92'}]
CVE State: PUBLISHED
Explain CVE-2023-1150
Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.
Affected Products: 750-332
References: [{'url': 'https://cert.vde.com/en/advisories/VDE-2023-005/'}]
CVE State: PUBLISHED
Explain CVE-2023-1151
A vulnerability was found in SourceCodester Electronic Medical Records System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file administrator.php of the component Cookie Handler. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222163.
Affected Products: Electronic Medical Records System
References: [{'url': 'https://vuldb.com/?id.222163', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222163', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/lcg-22266/bug_report/blob/main/vendors/Patrick%20Mvuma/Electronic%20Medical%20Records%20System/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1152
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies Persolus allows SQL Injection. This issue affects Persolus: before 2.03.93.
Affected Products: Persolus
References: [{'tags': ['government-resource'], 'url': 'https://www.usom.gov.tr/bildirim/tr-23-0154-2'}]
CVE State: PUBLISHED
Explain CVE-2023-1153
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pacsrapor allows SQL Injection, Command Line Execution through SQL Injection.This issue affects Pacsrapor: before 1.22.


Affected Products: Pacsrapor
References: [{'tags': ['government-resource'], 'url': 'https://www.usom.gov.tr/bildirim/tr-23-0163'}]
CVE State: PUBLISHED
Explain CVE-2023-1154
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pacsrapor allows Reflected XSS.This issue affects Pacsrapor: before 1.22.


Affected Products: Pacsrapor
References: [{'tags': ['government-resource'], 'url': 'https://www.usom.gov.tr/bildirim/tr-23-0163'}]
CVE State: PUBLISHED
Explain CVE-2023-1155
The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Products: Cost Calculator
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/750be90d-dc12-4974-8921-75259d56c7b3'}, {'url': 'https://wordpress.org/plugins/nd-projects/#developers'}]
CVE State: PUBLISHED
Explain CVE-2023-1156
A vulnerability classified as problematic was found in SourceCodester Health Center Patient Record Management System 1.0. This vulnerability affects unknown code of the file admin/fecalysis_form.php. The manipulation of the argument itr_no leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222220.
Affected Products: Health Center Patient Record Management System
References: [{'url': 'https://vuldb.com/?id.222220', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222220', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/Lacer23/bug_report/blob/main/bug_report/razormist/Health%20Center%20Patient%20Record%20Management/XSS-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1157
A vulnerability, which was classified as problematic, was found in finixbit elf-parser. Affected is the function elf_parser::Elf_parser::get_segments of the file elf_parser.cpp. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-222222 is the identifier assigned to this vulnerability.
Affected Products: elf-parser
References: [{'url': 'https://vuldb.com/?id.222222', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222222', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/10cksYiqiyinHangzhouTechnology/elf-parser_segments_poc', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1158

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list. 


Affected Products: Pentaho Business Analytics Server
References: [{'url': 'https://support.pentaho.com/hc/en-us/articles/14456024873741-IMPORTANT-Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2023-1158-'}]
CVE State: PUBLISHED
Explain CVE-2023-1159
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected Products: WordPress Online Booking and Scheduling Plugin – Bookly
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/d4cdf774-c93b-4b94-85ba-aa56bf401873?source=cve'}, {'url': 'https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2913570%40bookly-responsive-appointment-booking-tool&new=2913570%40bookly-responsive-appointment-booking-tool&sfp_email=&sfph_mail='}]
CVE State: PUBLISHED
Explain CVE-2023-1160
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.
Affected Products: cockpit-hq/cockpit
References: [{'url': 'https://huntr.dev/bounties/3ce480dc-1b1c-4230-9287-0dc3b31c2f87'}, {'url': 'https://github.com/cockpit-hq/cockpit/commit/690016208850f2d788ebc3c67884d4c692587eb8'}]
CVE State: PUBLISHED
Explain CVE-2023-1161
ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file
Affected Products: Wireshark
References: [{'url': 'https://www.wireshark.org/security/wnpa-sec-2023-08.html'}, {'url': 'https://gitlab.com/wireshark/wireshark/-/issues/18839'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1161.json'}, {'name': '[debian-lts-announce] 20230429 [SECURITY] [DLA 3402-1] wireshark security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/04/msg00029.html'}, {'name': 'DSA-5429', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2023/dsa-5429'}]
CVE State: PUBLISHED
Explain CVE-2023-1162
A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4. Affected is the function sub_1225C of the file mainfunction.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222258 is the identifier assigned to this vulnerability.
Affected Products: Vigor 2960
References: [{'url': 'https://vuldb.com/?id.222258', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222258', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/xxy1126/Vuln/blob/main/Draytek/2.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1163
A vulnerability has been found in DrayTek Vigor 2960 1.5.1.4 and classified as problematic. Affected by this vulnerability is the function sub_1DA58 of the file mainfunction.cgi. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222259.
Affected Products: Vigor 2960
References: [{'url': 'https://vuldb.com/?id.222259', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222259', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/xxy1126/Vuln/blob/main/Draytek/3.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1164
A vulnerability was found in KylinSoft kylin-activation and classified as critical. Affected by this issue is some unknown functionality of the component File Import. The manipulation leads to improper authorization. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.11-23 and 1.30.10-5.p23 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222260.
Affected Products: kylin-activation
References: [{'url': 'https://vuldb.com/?id.222260', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.222260', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/i900008/vulndb/blob/main/kylin-activation_vuln.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1165
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-222261 was assigned to this vulnerability.
Affected Products: CRMEB Java
References: [{'url': 'https://vuldb.com/?id.222261', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222261', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/ha1yuYiqiyinHangzhouTechn0logy/crmeb_java/blob/main/README.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1166
The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Affected Products: Ultimate-Premium-Plugin
References: [{'url': 'https://wpscan.com/vulnerability/825eccf9-f351-4a5b-b238-9969141b94fa', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1167
Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.
Affected Products: GitLab
References: [{'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/392715'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1167.json'}]
CVE State: PUBLISHED
Explain CVE-2023-1168
An authenticated remote code execution vulnerability
    exists in the AOS-CX Network Analytics Engine. Successful
    exploitation of this vulnerability results in the ability to
    execute arbitrary code as a privileged user on the underlying
    operating system, leading to a complete compromise of the
    switch running AOS-CX.



Affected Products: Aruba CX 10000 Switch Series, Aruba CX 9300 Switch Series, Aruba CX 8400 Switch Series, Aruba CX 8360 Switch Series, Aruba CX 8325 Switch Series, Aruba CX 8320 Switch Series, Aruba CX 6400 Switch Series, Aruba CX 6300 Switch Series, Aruba CX 6200F Switch Series
References: [{'url': 'https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt'}]
CVE State: PUBLISHED
Explain CVE-2023-1169
The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'file_uploader_callback' function in versions up to, and including, 2.1.4. This makes it possible for subscriber-level attackers to upload image attachments to the site.
Affected Products: OoohBoi Steroids for Elementor
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/c56ed896-9267-49e6-a207-fe5362fe18cd?source=cve'}, {'url': 'https://plugins.trac.wordpress.org/browser/ooohboi-steroids-for-elementor/tags/2.1.3/inc/exopite-simple-options/upload-class.php'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2888622/ooohboi-steroids-for-elementor/tags/2.1.5/inc/exopite-simple-options/upload-class.php?old=2874981&old_path=ooohboi-steroids-for-elementor%2Ftags%2F2.1.4%2Finc%2Fexopite-simple-options%2Fupload-class.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1170
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/286e0090-e654-46d2-ac60-29f81799d0a4'}, {'url': 'https://github.com/vim/vim/commit/1c73b65229c25e3c1fd8824ba958f7cc4d604f9c'}, {'name': 'FEDORA-2023-43cb13aefb', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIAKPMKJ4OZ6NYRZJO7YWMNQL2BICLYV/'}, {'name': 'FEDORA-2023-d4ebe53978', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4KDAU76Z7QNSPKZX2JAJ6O7KIEOXWTL/'}, {'name': 'FEDORA-2023-030318ca00', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6/'}]
CVE State: PUBLISHED
Explain CVE-2023-1172
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Products: WordPress Online Booking and Scheduling Plugin – Bookly
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/c3efbd9d-e2b5-4915-a964-29a49c7fba86?source=cve'}, {'url': 'https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2876981%40bookly-responsive-appointment-booking-tool&new=2876981%40bookly-responsive-appointment-booking-tool&sfp_email=&sfph_mail='}]
CVE State: PUBLISHED
Explain CVE-2023-1175
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/7e93fc17-92eb-4ae7-b01a-93bb460b643e'}, {'url': 'https://github.com/vim/vim/commit/c99cbf8f289bdda5d4a77d7ec415850a520330ba'}, {'name': 'FEDORA-2023-43cb13aefb', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIAKPMKJ4OZ6NYRZJO7YWMNQL2BICLYV/'}, {'name': 'FEDORA-2023-d4ebe53978', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4KDAU76Z7QNSPKZX2JAJ6O7KIEOXWTL/'}, {'name': 'FEDORA-2023-030318ca00', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6/'}, {'name': '[debian-lts-announce] 20230612 [SECURITY] [DLA 3453-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1176
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.
Affected Products: mlflow/mlflow
References: [{'url': 'https://huntr.dev/bounties/ae92f814-6a08-435c-8445-eec0ef4f1085'}, {'url': 'https://github.com/mlflow/mlflow/commit/63ef72aa4334a6473ce7f889573c92fcae0b3c0d'}]
CVE State: PUBLISHED
Explain CVE-2023-1177
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
Affected Products: mlflow/mlflow
References: [{'url': 'https://huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28'}, {'url': 'https://github.com/mlflow/mlflow/commit/7162a50c654792c21f3e4a160eb1a0e6a34f6e6e'}]
CVE State: PUBLISHED
Explain CVE-2023-1178
An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit.
Affected Products: GitLab
References: [{'url': 'https://hackerone.com/reports/1778009'}, {'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/381815'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1178.json'}]
CVE State: PUBLISHED
Explain CVE-2023-1179
A vulnerability, which was classified as problematic, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. Affected is an unknown function of the component Add Supplier Handler. The manipulation of the argument company_name/province/city/phone_number leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222330 is the identifier assigned to this vulnerability.
Affected Products: Computer Parts Sales and Inventory System
References: [{'url': 'https://vuldb.com/?id.222330', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222330', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/Amat0eur/MyCve/blob/main/Computer-Parts-Sales-And-Inventory-System-Xss.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1180
A vulnerability has been found in SourceCodester Health Center Patient Record Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file hematology_print.php. The manipulation of the argument hem_id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222331.
Affected Products: Health Center Patient Record Management System
References: [{'url': 'https://vuldb.com/?id.222331', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222331', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/Yuuuhd/bug_report/blob/main/vendors/razormist/Health%20Center%20Patient%20Record%20Management/XSS-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1181
Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.
Affected Products: icret/easyimages2.0
References: [{'url': 'https://huntr.dev/bounties/f5cb8816-fc12-4282-9571-81f25670e04a'}, {'url': 'https://github.com/icret/easyimages2.0/commit/95a6caf1c660a7342a8f11d70c2dbf7ebcbe2966'}]
CVE State: PUBLISHED
Explain CVE-2023-1183
A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.
Affected Products: libreoffice
References: [{'url': 'https://access.redhat.com/security/cve/CVE-2023-1183', 'tags': ['vdb-entry', 'x_refsource_REDHAT']}, {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2208506', 'name': 'RHBZ#2208506', 'tags': ['issue-tracking', 'x_refsource_REDHAT']}, {'url': 'https://www.libreoffice.org/about-us/security/advisories/cve-2023-1183/'}]
CVE State: PUBLISHED
Explain CVE-2023-1184
A vulnerability, which was classified as problematic, has been found in ECshop up to 4.1.8. Affected by this issue is some unknown functionality of the file admin/database.php of the component Backup Database Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222356.
Affected Products: ECshop
References: [{'url': 'https://vuldb.com/?id.222356', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.222356', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/wjzdalao/ecshop4.1.8/issues/1', 'tags': ['exploit', 'issue-tracking']}]
CVE State: PUBLISHED