DuyTa/cve-kgrag-db huggingface dataset:
CVE-2023-40877
DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_edit.php via the title parameter.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: dedecms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/DiliLearngent/BugReport/blob/main/php/DedeCMS/xss4.md, https://github.com/DiliLearngent/BugReport/blob/main/php/DedeCMS/xss4.md
CWE: CWE-79
CVE-2023-21293
In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: android
Related CWEs: CWE-203
Related CAPECs: CAPEC-189
References: https://source.android.com/docs/security/bulletin/android-14, https://source.android.com/docs/security/bulletin/android-14
CWE: CWE-203
CVE-2023-51028
TOTOLINK EX1800T 9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the apcliChannel parameter of the setWiFiExtenderConfig interface of the cstecgi.cgi.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: ex1800t_firmware, ex1800t
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://815yang.github.io/2023/12/11/EX1800T/2/3/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setWiFiExtenderConfig-apcliChannel/, https://815yang.github.io/2023/12/11/EX1800T/2/3/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setWiFiExtenderConfig-apcliChannel/
CWE: CWE-78
CVE-2023-50775
A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: deployment_dashboard
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://www.openwall.com/lists/oss-security/2023/12/13/4, https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3092, http://www.openwall.com/lists/oss-security/2023/12/13/4
CWE: CWE-352
CVE-2023-44411
D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the InstallApplication class. The class contains a hard-coded password for the remotely reachable database. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19553.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: d-view_8
Related CWEs: CWE-798
Related CAPECs: CAPEC-191, CAPEC-70
MITRE ATT&CK Techniques: T1078.001, T1552.001
MITRE ATT&CK Tactics: T1078, T1552
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1509/, https://www.zerodayinitiative.com/advisories/ZDI-23-1509/
CWE: CWE-798
MITRE ATT&CK techniques: T1078.001, T1552.001
MITRE ATT&CK tactics: T1078, T1552
CVE-2023-21457
Improper access control vulnerability in Bluetooth prior to SMR Mar-2023 Release 1 allows attackers to send file via Bluetooth without related permission.
CVSS v3.1 Score: 4.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L
Affected Products: android
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=03, https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=03
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-2830
Cross-Site Request Forgery (CSRF) vulnerability in Trustindex.Io WP Testimonials plugin <= 1.4.2 versions.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected Products: wp_testimonials
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/testimonial-widgets/wordpress-wp-testimonials-plugin-1-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/testimonial-widgets/wordpress-wp-testimonials-plugin-1-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-54120
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix race condition in hidp_session_thread

There is a potential race condition in hidp_session_thread that may
lead to use-after-free. For instance, the timer is active while
hidp_del_timer is called in hidp_session_thread(). After hidp_session_put,
then 'session' will be freed, causing kernel panic when hidp_idle_timeout
is running.

The solution is to use del_timer_sync instead of del_timer.

Here is the call trace:

? hidp_session_probe+0x780/0x780
call_timer_fn+0x2d/0x1e0
__run_timers.part.0+0x569/0x940
hidp_session_probe+0x780/0x780
call_timer_fn+0x1e0/0x1e0
ktime_get+0x5c/0xf0
lapic_next_deadline+0x2c/0x40
clockevents_program_event+0x205/0x320
run_timer_softirq+0xa9/0x1b0
__do_softirq+0x1b9/0x641
__irq_exit_rcu+0xdc/0x190
irq_exit_rcu+0xe/0x20
sysvec_apic_timer_interrupt+0xa1/0xc0
References: https://git.kernel.org/stable/c/0efb276d5848a3accc37c6f41b85e442c4768169, https://git.kernel.org/stable/c/152f47bd6b995e0e98c85672f6d19894bc287ef2, https://git.kernel.org/stable/c/248af9feca062a4ca9c3f2ccf67056c8a5eb817f
CVE-2023-50851
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin.This issue affects Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: from n/a before 1.6.6.1.


CVSS v3.1 Score: 7.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Affected Products: simply_schedule_appointments
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://patchstack.com/database/vulnerability/simply-schedule-appointments/wordpress-simply-schedule-appointments-booking-plugin-1-6-6-1-sql-injection-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/simply-schedule-appointments/wordpress-simply-schedule-appointments-booking-plugin-1-6-6-1-sql-injection-vulnerability?_s_id=cve
CWE: CWE-89
CVE-2023-28654
Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration. The user is not visible in Usernames and Passwords menu list of the application and the password cannot be changed through any normal operation of the device.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: osprey_pump_controller_firmware, osprey_pump_controller
Related CWEs: CWE-798
Related CAPECs: CAPEC-191, CAPEC-70
MITRE ATT&CK Techniques: T1078.001, T1552.001
MITRE ATT&CK Tactics: T1078, T1552
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06, https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06
CWE: CWE-798
MITRE ATT&CK techniques: T1078.001, T1552.001
MITRE ATT&CK tactics: T1078, T1552
CVE-2023-0351
The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: e11_firmware, e11
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01, https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CWE: CWE-77
CVE-2023-26454
Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.


CVSS v3.1 Score: 7.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products: open-xchange_appsuite
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json, https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf, https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CWE: CWE-89
CVE-2023-54075
In the Linux kernel, the following vulnerability has been resolved:

ASoC: mediatek: common: Fix refcount leak in parse_dai_link_info

Add missing of_node_put()s before the returns to balance
of_node_get()s and of_node_put()s, which may get unbalanced
in case the for loop 'for_each_available_child_of_node' returns
early.
References: https://git.kernel.org/stable/c/3e40722d55805584dc04d8594d912820cafb2432, https://git.kernel.org/stable/c/beed115c2ce78f990222a29abed042582df4e87c
CVE-2023-0966
A vulnerability classified as problematic was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=orders/view_order. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221635.
CVSS v3.1 Score: 2.4 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 3.3 (LOW)
CVSS v2.0 Vector: AV:N/AC:L/Au:M/C:N/I:P/A:N
Affected Products: online_eyewear_shop
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/1MurasaKi/Eyewear_Shop_XSS/blob/main/README.md, https://vuldb.com/?ctiid.221635, https://vuldb.com/?id.221635
CWE: CWE-79
CVE-2023-28683
Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS v3.1 Score: 8.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected Products: phabricator_differential
Related CWEs: CWE-611
Related CAPECs: CAPEC-221
References: https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2942, https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2942
CWE: CWE-611
CVE-2023-6557
The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data including post titles and IDs of pending, private and draft posts.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products: the_events_calendar
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010104%40the-events-calendar%2Ftags%2F6.2.9&old=3010096%40the-events-calendar%2Ftags%2F6.2.9, https://www.wordfence.com/threat-intel/vulnerabilities/id/fc40196e-c0f3-4bc6-ac4b-b866902def61?source=cve, https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010104%40the-events-calendar%2Ftags%2F6.2.9&old=3010096%40the-events-calendar%2Ftags%2F6.2.9
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-37336
Kofax Power PDF TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20392.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: power_pdf
Related CWEs: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-931/, https://www.zerodayinitiative.com/advisories/ZDI-23-931/
CWE: CWE-787
CVE-2023-47262
The startup process and device configurations of the Abbott ID NOW device, before v7.1, can be interrupted and/or modified via physical access to an internal serial port. Direct physical access is required to exploit.
CVSS v3.1 Score: 5.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Affected Products: id_now, id_now_firmware
References: https://www.cybersecurity.abbott/home/product-advisories.html, https://www.cybersecurity.abbott/home/product-advisories/id-now.html, https://www.cybersecurity.abbott/home/product-advisories.html
CVE-2023-50235
Hancom Office Show PPT File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hancom Office Show. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PPT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20387.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: office_show
Related CWEs: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1857/, https://www.zerodayinitiative.com/advisories/ZDI-23-1857/
CWE: CWE-121, CWE-787
CVE-2023-35178
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow when performing a GET request to scan jobs.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: laserjet_pro_m453-m454_w1y43a_firmware, laserjet_pro_m404-m405_93m22a_firmware, laserjet_pro_mfp_m428-m429_f_w1a30a_firmware, laserjet_pro_mfp_m478-m479_w1a80a_firmware, laserjet_pro_mfp_m478-m479_w1a75a_firmware
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://support.hp.com/us-en/document/ish_8651729-8651769-16/hpsbpi03854, https://support.hp.com/us-en/document/ish_8651729-8651769-16/hpsbpi03854
CWE: CWE-120
CVE-2023-32754
Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: efence
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html, https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html
CWE: CWE-89
CVE-2023-6966
The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.6.3. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products: the_moneytizer
Related CWEs: CWE-862, CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php, https://plugins.trac.wordpress.org/changeset/3099347/the-moneytizer/trunk/core/core_ajax.php?old=3038641&old_path=the-moneytizer%2Ftrunk%2Fcore%2Fcore_ajax.php, https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve
CWE: CWE-862, CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1542.002, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1556, T1546.004, T1547.006, T1546.001, T1211, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-49233
Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning account to utilize functions normally reserved for administrators. The affected functions allow attackers to obtain different types of configured credentials and potentially elevate their privileges to administrator level.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-522
Related CAPECs: CAPEC-560, CAPEC-644, CAPEC-653
MITRE ATT&CK Techniques: T1550.003, T1021.002, T1133
MITRE ATT&CK Tactics: T1110, T1114, T1558
References: https://www.schutzwerk.com/blog/schutzwerk-sa-2023-005/, https://www.visual-planning.com/en/support-portal/updates
CWE: CWE-522
MITRE ATT&CK techniques: T1550.003, T1021.002, T1133, T1114.002, T1110.004, T1543, T1552.004, T1558.003, T1558, T1021, T1550.002, T1078
MITRE ATT&CK tactics: T1110, T1114, T1558, T1550, T1552, T1021
CVE-2023-36398
Windows NTFS Information Disclosure Vulnerability
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_23h2, windows_11_21h2
Related CWEs: CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36398, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36398
CWE: CWE-908
CVE-2023-1814
Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass download checking via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products: debian_linux, chrome, fedora
References: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html, https://crbug.com/1417325, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE-2023-23163
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: art_gallery_management_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.com/files/171643/Art-Gallery-Management-System-Project-1.0-SQL-Injection.html, https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-23163/CVE-2023-23163.txt, https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/
CWE: CWE-89
CVE-2023-25645
There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and applications on the user's device, affecting device operation.
CVSS v3.1 Score: 7.7 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected Products: zxv10_b866v2-h_firmware, zxv10_b866v2, up_t2_4k, zxv10_b860h_v5d0_firmware, zxv10_b866v2f_firmware
Related CWEs: CWE-276
Related CAPECs: CAPEC-127, CAPEC-1, CAPEC-81
MITRE ATT&CK Techniques: T1083, T1574.010
MITRE ATT&CK Tactics: T1574
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464, https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464
CWE: CWE-276
MITRE ATT&CK techniques: T1083, T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-21172
In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin user due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262243015
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: android
References: https://source.android.com/security/bulletin/pixel/2023-06-01, https://source.android.com/security/bulletin/pixel/2023-06-01
CVE-2023-23415
Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_21h2, windows_10_20h2
Related CWEs: CWE-122
Related CAPECs: CAPEC-92
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23415, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23415
CWE: CWE-122
CVE-2023-22329
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via adjacent access.
CVSS v3.1 Score: 2.6 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected Products: core_i5-8250u_firmware, celeron_2970m, pentium_gold_g6405t, core_i7-1355u, core_i5-1235ul
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://security.netapp.com/advisory/ntap-20231221-0008/, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00924.html, https://security.netapp.com/advisory/ntap-20231221-0008/
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-38708
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `AssetController::importServerFilesAction`, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite.
The impact of this vulnerability allows attackers to: overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information. This could also cause a denial of service (DoS) if critical system files are overwritten or deleted.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected Products: pimcore
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://github.com/pimcore/pimcore/commit/58012d0e3b8b926fb54eccbd64ec5c993b30c22c, https://github.com/pimcore/pimcore/security/advisories/GHSA-34hj-v8fm-x887, https://github.com/pimcore/pimcore/commit/58012d0e3b8b926fb54eccbd64ec5c993b30c22c
CWE: CWE-22
CVE-2023-25098
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_qos function with the source variable.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: ur32l, ur32l_firmware
Related CWEs: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716, https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716, https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1716
CWE: CWE-121, CWE-787
CVE-2023-28772
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
CVSS v3.1 Score: 6.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3, https://github.com/torvalds/linux/commit/d3b16034a24a112bb83aeb669ac5b9b01f744bb7, https://lkml.kernel.org/r/20210626032156.47889-1-yun.zhou%40windriver.com
CWE: CWE-120
CVE-2023-46326
ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: zstack
Related CWEs: CWE-613
References: https://github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q, https://github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q
CWE: CWE-613
CVE-2023-26295
Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: hp_device_manager
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://support.hp.com/us-en/document/ish_7974907-7974931-16/hpsbhf03842, https://support.hp.com/us-en/document/ish_7974907-7974931-16/hpsbhf03842
CWE: CWE-77
CVE-2023-39276

SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to a firewall crash.



CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: nsv100, nsa_2600, nsv470, nsa6700, tz570p
Related CWEs: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012, https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012
CWE: CWE-121, CWE-787
CVE-2023-42698
In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: t612, sc9863a, t820, sc7731e, t760
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049, https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-42869
Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Ventura 13.4, iOS 16.5 and iPadOS 16.5. Multiple issues in libxml2.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: iphone_os, ipados, macos
Related CWEs: CWE-787
References: https://support.apple.com/en-us/HT213757, https://support.apple.com/en-us/HT213758, https://support.apple.com/en-us/HT213757
CWE: CWE-787
CVE-2023-39967
WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via “TestRequester” functionality, webhooks and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with the default level of credentials for the WireMock instance. The vendor has discontinued the affected Wiremock studio product and there will be no fix. Users are advised to find alternatives.
CVSS v3.1 Score: 10.0 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products: studio
Related CWEs: CWE-918
Related CAPECs: CAPEC-664
References: https://github.com/wiremock/wiremock/security/advisories/GHSA-676j-xrv3-73vc, https://github.com/wiremock/wiremock/security/advisories/GHSA-676j-xrv3-73vc
CWE: CWE-918
CVE-2023-36388
Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.


CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products: superset
Related CWEs: CWE-918
Related CAPECs: CAPEC-664
References: https://lists.apache.org/thread/ccmjjz4jp17yc2kcd18qshmdtf7qorfs, https://lists.apache.org/thread/ccmjjz4jp17yc2kcd18qshmdtf7qorfs
CWE: CWE-918
CVE-2023-24626
socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Affected Products: screen
Related CWEs: CWE-732
Related CAPECs: CAPEC-17, CAPEC-206, CAPEC-234
MITRE ATT&CK Techniques: T1553.002, T1083, T1505.005
MITRE ATT&CK Tactics: T1134, T1505, T1553
References: https://git.savannah.gnu.org/cgit/screen.git/patch/?id=e9ad41bfedb4537a6f0de20f00b27c7739f168f7, https://savannah.gnu.org/bugs/?63195, https://www.exploit-db.com/exploits/51252
CWE: CWE-732
MITRE ATT&CK techniques: T1553.002, T1083, T1505.005, T1550.004, T1134.001, T1574.010, T1548, T1554, T1574.005
MITRE ATT&CK tactics: T1134, T1505, T1553, T1550, T1574
CVE-2023-35318
Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_21h2, windows_10_1507
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35318, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35318
CWE: CWE-125
CVE-2023-30722
Protection Mechanism Failure in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.13.5 allows local attacker to execute arbitrary code.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products: blockchain_keystore
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09, https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09
CVE-2023-41932
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: job_configuration_history
Related CWEs: CWE-611
Related CAPECs: CAPEC-221
References: http://www.openwall.com/lists/oss-security/2023/09/06/9, https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235, http://www.openwall.com/lists/oss-security/2023/09/06/9
CWE: CWE-611
CVE-2023-40665
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as Image plugin by Pdfcrowd plugin <= 2.16.0 versions.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected Products: save_as_image
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/save-as-image-by-pdfcrowd/wordpress-save-as-image-plugin-by-pdfcrowd-plugin-2-16-0-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/save-as-image-by-pdfcrowd/wordpress-save-as-image-plugin-by-pdfcrowd-plugin-2-16-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-21659
Transient DOS in WLAN Firmware while processing frames with missing header fields.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: sm7325p, wsa8832, ipq8070a, qcn6102_firmware, sm4350
Related CWEs: CWE-125, CWE-126
Related CAPECs: CAPEC-540
References: https://www.qualcomm.com/company/product-security/bulletins/june-2023-bulletin, https://www.qualcomm.com/company/product-security/bulletins/june-2023-bulletin
CWE: CWE-125, CWE-126
CVE-2023-47626
iTop is an IT service management platform.  When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: itop
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/Combodo/iTop/security/advisories/GHSA-vv3v-9vrv-h95h, https://github.com/Combodo/iTop/security/advisories/GHSA-vv3v-9vrv-h95h
CWE: CWE-79
CVE-2023-28645
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app (richdocuments) is upgraded to 8.0.0-beta.1, 7.0.2 or 6.3.2. Users unable to upgrade may mitigate the issue by taking steps to restrict the ability to download documents. This includes ensuring that the `WOPI configuration` is configured to only serve documents between Nextcloud and Collabora. It is highly recommended to define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud.
CVSS v3.1 Score: 5.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected Products: richdocuments
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://docs.nextcloud.com/server/latest/admin_manual/office/configuration.html#wopi-settings, https://github.com/nextcloud/richdocuments/pull/2604, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-95j6-p5cj-5hh5
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-45766
Missing Authorization vulnerability in Poll Maker Team Poll Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through 4.7.1.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products: poll_maker
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/wordpress/plugin/poll-maker/vulnerability/wordpress-poll-maker-plugin-4-7-1-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-2050
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/positions_add.php. The manipulation of the argument description leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225935.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: advanced_online_voting_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%204.pdf, https://vuldb.com/?ctiid.225935, https://vuldb.com/?id.225935
CWE: CWE-89
CVE-2023-50848
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.34.0.


CVSS v3.1 Score: 7.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Affected Products: 404_solution
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://patchstack.com/database/vulnerability/404-solution/wordpress-404-solution-plugin-2-34-0-sql-injection-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/404-solution/wordpress-404-solution-plugin-2-34-0-sql-injection-vulnerability?_s_id=cve
CWE: CWE-89
CVE-2023-29283
Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: substance_3d_painter
Related CWEs: CWE-787, CWE-122
Related CAPECs: CAPEC-92
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html, https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html
CWE: CWE-787, CWE-122
CVE-2023-31920
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products: jerryscript
Related CWEs: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/5070, https://github.com/jerryscript-project/jerryscript/issues/5070
CWE: CWE-617
CVE-2023-22288
HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails
CVSS v3.1 Score: 4.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Affected Products: checkmk
Related CWEs: CWE-138, CWE-79
Related CAPECs: CAPEC-588, CAPEC-209, CAPEC-591
References: https://checkmk.com/werk/15069, https://checkmk.com/werk/15069
CWE: CWE-138, CWE-79
CVE-2023-20676
In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07588569; Issue ID: ALPS07628518.
CVSS v3.1 Score: 4.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected Products: mt7921, mt6895, mt8169, mt6781, yocto
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://corp.mediatek.com/product-security-bulletin/April-2023, https://corp.mediatek.com/product-security-bulletin/April-2023
CWE: CWE-125
CVE-2023-32247
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: h700s, h500s, h410s, linux_kernel, h300s
Related CWEs: CWE-401
References: https://access.redhat.com/security/cve/CVE-2023-32247, https://bugzilla.redhat.com/show_bug.cgi?id=2219803, https://security.netapp.com/advisory/ntap-20230915-0011/
CWE: CWE-401
CVE-2023-32219
A Mazda model (2015-2016) can be unlocked via an unspecified method.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products: mazda_firmware, mazda
Related CWEs: CWE-863
References: https://www.gov.il/en/Departments/faq/cve_advisories, https://www.gov.il/en/Departments/faq/cve_advisories
CWE: CWE-863
CVE-2023-35169
PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, which results in a remote code execution vulnerability. Every application that stores attachments with `Attachment::save()` without providing a `$filename` or passing unsanitized user input is affected by this attack.

An attacker can send an email with a malicious attachment to the inbox, which gets crawled with `webklex/php-imap` or `webklex/laravel-imap`. Prerequisite for the vulnerability is that the script stores the attachments without providing a `$filename`, or providing an unsanitized `$filename`, in `src/Attachment::save(string $path, string $filename = null)`. In this case, where no `$filename` gets passed into the `Attachment::save()` method, the package would use a series of unsanitized and insecure input values from the mail as fallback. Even if a developer passes a `$filename` into the `Attachment::save()` method, e.g. by passing the name or filename of the mail attachment itself (from email headers), the input values never get sanitized by the package. There is also no restriction about the file extension (e.g. ".php") or the contents of a file. This allows an attacker to upload malicious code of any type and content at any location where the underlying user has write permissions. The attacker can also overwrite existing files and inject malicious code into files that, e.g. get executed by the system via cron or requests.

Version 5.3.0 contains a patch for this issue.
CVSS v3.1 Score: 9.0 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products: php-imap
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://github.com/Webklex/php-imap/blob/5.2.0/src/Attachment.php#L251-L255, https://github.com/Webklex/php-imap/blob/5.2.0/src/Attachment.php#L252, https://github.com/Webklex/php-imap/pull/414
CWE: CWE-22
CVE-2023-39675
SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: product_catalog_\(csv\,_excel\)_import
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://blog.sorcery.ie/posts/simpleimportproduct_sqli/, https://sorcery.ie, https://blog.sorcery.ie/posts/simpleimportproduct_sqli/
CWE: CWE-89
CVE-2023-41694
Cross-Site Request Forgery (CSRF) vulnerability in Realbig Team Realbig For WordPress plugin <= 1.0.3 versions.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: realbig
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/realbig-media/wordpress-realbig-plugin-1-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/realbig-media/wordpress-realbig-plugin-1-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-45289
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References: http://www.openwall.com/lists/oss-security/2024/03/08/4, https://go.dev/cl/569340, https://go.dev/issue/65065
CVE-2023-32040
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_21h2, windows_10_1507
Related CWEs: CWE-822
Related CAPECs: CAPEC-129
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32040, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32040
CWE: CWE-822
CVE-2023-4725
The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products: simple_posts_ticker
References: https://wpscan.com/vulnerability/e9b9a594-c960-4692-823e-23fc60cca7e7, https://wpscan.com/vulnerability/e9b9a594-c960-4692-823e-23fc60cca7e7
CVE-2023-42476
SAP Business Objects Web Intelligence - version 420,  allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to. In the worst case, attacker could access data from reporting databases.


CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected Products: businessobjects_web_intelligence
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://me.sap.com/notes/3382353, https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html, https://me.sap.com/notes/3382353
CWE: CWE-79
CVE-2023-37255
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "get edits" type is vulnerable to HTML injection through the User-Agent HTTP request header.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: mediawiki
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://phabricator.wikimedia.org/T333569, https://phabricator.wikimedia.org/T333569
CWE: CWE-79