DuyTa/cve-kgrag-db huggingface dataset:
CVE-2023-46167
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is used.  IBM X-Force ID:  269367.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel, windows, unix, db2
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/269367, https://security.netapp.com/advisory/ntap-20240112-0003/, https://www.ibm.com/support/pages/node/7087203
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-2417
A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic. Affected by this issue is some unknown functionality of the file C:\Program Files (x86)\HostMonitor\RMA-Win\rma_active.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. Upgrading to version 12.60 is able to address this issue. It is recommended to upgrade the affected component. VDB-227714 is the identifier assigned to this vulnerability.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:P/I:P/A:P
Affected Products: advanced_host_monitor
Related CWEs: CWE-428
References: http://packetstormsecurity.com/files/172105/Advanced-Host-Monitor-12.56-Unquoted-Service-Path.html, https://vuldb.com/?ctiid.227714, https://vuldb.com/?id.227714
CWE: CWE-428
CVE-2023-25485
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 versions.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected Products: json_content_importer
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/json-content-importer/wordpress-json-content-importer-plugin-1-3-15-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/json-content-importer/wordpress-json-content-importer-plugin-1-3-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-42845
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. Photos in the Hidden Photos Album may be viewed without authentication.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products: iphone_os, ipados, macos
Related CWEs: CWE-306
Related CAPECs: CAPEC-216, CAPEC-12, CAPEC-36
References: http://seclists.org/fulldisclosure/2023/Oct/19, http://seclists.org/fulldisclosure/2023/Oct/24, https://support.apple.com/en-us/HT213982
CWE: CWE-306
CVE-2023-39307
Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.


CVSS v3.1 Score: 8.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products: avada
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://patchstack.com/database/vulnerability/avada/wordpress-avada-theme-7-11-1-authenticated-arbitrary-file-upload-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/avada/wordpress-avada-theme-7-11-1-authenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-47110
blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in module blockreassurance allows modifying any value in the configuration table. This vulnerability has been patched in version 5.1.4.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Affected Products: customer_reassurance_block
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-xfm3-hjcc-gv78, https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-xfm3-hjcc-gv78
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-28644
Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.

CVSS v3.1 Score: 5.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected Products: nextcloud_server
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9wmj-gp8v-477j, https://github.com/nextcloud/server/pull/36016, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9wmj-gp8v-477j
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2023-34024
Cross-Site Request Forgery (CSRF) vulnerability in Guillemant David WP Full Auto Tags Manager plugin <= 2.2 versions.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: full_auto_tags_manager
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/wp-full-auto-tags-manager/wordpress-wp-full-auto-tags-manager-plugin-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/wp-full-auto-tags-manager/wordpress-wp-full-auto-tags-manager-plugin-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-45952
An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: lylme_spage
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://github.com/LyLme/lylme_spage/issues/33, https://github.com/LyLme/lylme_spage/issues/33
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-45705
An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.

CVSS v3.1 Score: 3.5 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected Products: bigfix_platform
Related CWEs: CWE-918
Related CAPECs: CAPEC-664
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972, https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972
CWE: CWE-918
CVE-2023-53848
In the Linux kernel, the following vulnerability has been resolved:

md/raid5-cache: fix a deadlock in r5l_exit_log()

Commit b13015af94cf ("md/raid5-cache: Clear conf->log after finishing
work") introduce a new problem:

// caller hold reconfig_mutex
r5l_exit_log
 flush_work(&log->disable_writeback_work)
			r5c_disable_writeback_async
			 wait_event
			  /*
			   * conf->log is not NULL, and mddev_trylock()
			   * will fail, wait_event() can never pass.
			   */
 conf->log = NULL

Fix this problem by setting 'config->log' to NULL before wake_up() as it
used to be, so that wait_event() from r5c_disable_writeback_async() can
exist. In the meantime, move forward md_unregister_thread() so that
null-ptr-deref this commit fixed can still be fixed.
References: https://git.kernel.org/stable/c/71cf23271f015a57038bdc4669952096f9fe5500, https://git.kernel.org/stable/c/a705b11b358dee677aad80630e7608b2d5f56691, https://git.kernel.org/stable/c/ac9e103f282a7854f3274ef5ff0742fbbe8d7d6b
CVE-2023-33047
Transient DOS in WLAN Firmware while parsing no-inherit IES.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: wsa8832, ipq8070a, qcn6102_firmware, immersive_home_3210_platform, qcm8550_firmware
Related CWEs: CWE-125, CWE-126
Related CAPECs: CAPEC-540
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin, https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CWE: CWE-125, CWE-126
CVE-2023-0019
In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.


CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: grc_process_control
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://launchpad.support.sap.com/#/notes/3281724, https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html, https://launchpad.support.sap.com/#/notes/3281724
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-41052
Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
CVSS v3.1 Score: 3.7 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products: vyper
Related CWEs: CWE-670
References: https://github.com/vyperlang/vyper/pull/3583, https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxq, https://github.com/vyperlang/vyper/pull/3583
CWE: CWE-670
CVE-2023-28207
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A plug-in may be able to inherit app permissions and access user data.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: macos
Related CWEs: CWE-277
References: https://support.apple.com/en-us/102784, https://support.apple.com/en-us/102833, https://support.apple.com/en-us/120945
CWE: CWE-277
CVE-2023-38062
In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products: teamcity
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: https://www.jetbrains.com/privacy-security/issues-fixed/, https://www.jetbrains.com/privacy-security/issues-fixed/
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2023-40033
Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the `intervention/image` package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack. This has been patched in Flarum version 1.8.0. Users are advised to upgrade. Users unable to upgrade may disable PHP's `allow_url_fopen` which will prevent the fetching of external files via URLs as a temporary workaround for the SSRF aspect of the vulnerability.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected Products: flarum
Related CWEs: CWE-918
Related CAPECs: CAPEC-664
References: https://github.com/flarum/framework/commit/d1059c1cc79fe61f9538f3da55e8f42abbede570, https://github.com/flarum/framework/security/advisories/GHSA-67c6-q4j4-hccg, https://github.com/flarum/framework/commit/d1059c1cc79fe61f9538f3da55e8f42abbede570
CWE: CWE-918
CVE-2023-45723
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability.  Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.

CVSS v3.1 Score: 7.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Affected Products: dryice_myxalytics
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608, https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CWE: CWE-22
CVE-2023-1256
The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: aveva_plant_scada, telemetry_server
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-04, https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-04
CVE-2023-24408
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.4 versions.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected Products: ecwid_ecommerce_shopping_cart
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/ecwid-shopping-cart/wordpress-ecwid-ecommerce-shopping-cart-plugin-6-11-5-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/ecwid-shopping-cart/wordpress-ecwid-ecommerce-shopping-cart-plugin-6-11-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-25010
A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code execution.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: maya_usd
Related CWEs: CWE-665
Related CAPECs: CAPEC-29, CAPEC-26
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0003, https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0003
CWE: CWE-665
CVE-2023-26514
Cross-Site Request Forgery (CSRF) vulnerability in WPGrim Dynamic XML Sitemaps Generator for Google plugin <= 1.3.3 versions.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected Products: dynamic_xml_sitemaps_generator_for_google
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/xml-sitemap-generator-for-google/wordpress-xml-sitemap-generator-for-google-plugin-1-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/xml-sitemap-generator-for-google/wordpress-xml-sitemap-generator-for-google-plugin-1-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-3978
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: networking
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://go.dev/cl/514896, https://go.dev/issue/61615, https://pkg.go.dev/vuln/GO-2023-1988
CWE: CWE-79
CVE-2023-5957
The Ni Purchase Order(PO) For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: ni_purchase_order\(po\)_for_woocommerce
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://wpscan.com/vulnerability/70f823ff-64ad-4f05-9eb3-b69b3b79dc12, https://wpscan.com/vulnerability/70f823ff-64ad-4f05-9eb3-b69b3b79dc12
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-3434
Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami (version 20222284) on Windows. 

This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger.


CVSS v3.1 Score: 4.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Affected Products: jami, windows
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://blog.blacklanternsecurity.com/p/Jami-Local-Denial-Of-Service-and-QRC-Handler-Vulnerabilities, https://git.jami.net/savoirfairelinux/jami-client-qt/-/wikis/Changelog#nightly-january-10, https://review.jami.net/c/jami-client-qt/+/23569
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-5724
Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: thunderbird, firefox_esr, debian_linux, firefox
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1836705, https://lists.debian.org/debian-lts-announce/2023/10/msg00037.html, https://lists.debian.org/debian-lts-announce/2023/10/msg00042.html
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2023-35183
The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: access_rights_manager
Related CWEs: CWE-276
Related CAPECs: CAPEC-127, CAPEC-1, CAPEC-81
MITRE ATT&CK Techniques: T1083, T1574.010
MITRE ATT&CK Tactics: T1574
References: https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm, https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35183, https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
CWE: CWE-276
MITRE ATT&CK techniques: T1083, T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-7332
PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player's hotbar, triggering a server crash and resulting in denial of service.
Related CWEs: CWE-1284
References: https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md, https://github.com/pmmp/PocketMine-MP/commit/5897476, https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h87r-f4vc-mchv
CWE: CWE-1284
CVE-2023-25521





NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging a weakness whereby proper input parameter validation is not performed.  A successful exploit of this vulnerability may lead to denial of service, information disclosure, and data tampering.






CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected Products: dgx_a100_firmware, dgx_a800, dgx_a100, dgx_a800_firmware
Related CWEs: CWE-269, CWE-250
Related CAPECs: CAPEC-233, CAPEC-104, CAPEC-470
MITRE ATT&CK Techniques: T1548
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5461, https://nvidia.custhelp.com/app/answers/detail/a_id/5461
CWE: CWE-269, CWE-250
MITRE ATT&CK techniques: T1548
CVE-2023-35796
A vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could perform a stored cross-site scripting (XSS) attack that may lead to arbitrary code execution with `SYSTEM` privileges on the application server. (ZDI-CAN-19823)
CVSS v3.1 Score: 8.3 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products: sinema_server
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://cert-portal.siemens.com/productcert/pdf/ssa-594373.pdf, https://cert-portal.siemens.com/productcert/pdf/ssa-594373.pdf
CWE: CWE-79
CVE-2023-37919
Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products: cal.com
Related CWEs: CWE-613
References: https://github.com/calcom/cal.com/security/advisories/GHSA-cpf2-q635-xrwx, https://github.com/calcom/cal.com/security/advisories/GHSA-cpf2-q635-xrwx
CWE: CWE-613
CVE-2023-52483
In the Linux kernel, the following vulnerability has been resolved:

mctp: perform route lookups under a RCU read-side lock

Our current route lookups (mctp_route_lookup and mctp_route_lookup_null)
traverse the net's route list without the RCU read lock held. This means
the route lookup is subject to preemption, resulting in an potential
grace period expiry, and so an eventual kfree() while we still have the
route pointer.

Add the proper read-side critical section locks around the route
lookups, preventing premption and a possible parallel kfree.

The remaining net->mctp.routes accesses are already under a
rcu_read_lock, or protected by the RTNL for updates.

Based on an analysis from Sili Luo <rootlab@huawei.com>, where
introducing a delay in the route lookup could cause a UAF on
simultaneous sendmsg() and route deletion.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel
Related CWEs: CWE-416
References: https://git.kernel.org/stable/c/1db0724a01b558feb1ecae551782add1951a114a, https://git.kernel.org/stable/c/2405f64a95a7a094eb24cba9bcfaffd1ea264de4, https://git.kernel.org/stable/c/5093bbfc10ab6636b32728e35813cbd79feb063c
CWE: CWE-416
CVE-2023-27533
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: clustered_data_ontap, h700s_firmware, h700s, h500s, fedora
Related CWEs: CWE-75, CWE-74
Related CAPECs: CAPEC-53, CAPEC-51, CAPEC-9
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: https://hackerone.com/reports/1891474, https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
CWE: CWE-75, CWE-74
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2023-38034
A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE).

 
Affected Products:
All UniFi Access Points (Version 6.5.53 and earlier)
All UniFi Switches (Version 6.5.32 and earlier) 
-USW Flex Mini excluded.
 

Mitigation:
Update UniFi Access Points to Version 6.5.62 or later.
Update UniFi Switches to Version 6.5.59 or later.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: usw-16-poe, ubb-xg, u6\+, us-16-150w, u6-lr
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-9884-44df-b1c6-63c6499f6e56, https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-9884-44df-b1c6-63c6499f6e56
CWE: CWE-77
CVE-2023-39611
An issue in Software FX Chart FX 7 version 7.0.4962.20829 allows attackers to enumerate and read files from the local filesystem by sending crafted web requests.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: chart_fx
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://medium.com/%40arielbreisacher/my-chart-fx-7-software-investigation-journey-leading-to-a-directory-traversal-vulnerability-067cdcd3f2e9, https://medium.com/%40arielbreisacher/my-chart-fx-7-software-investigation-journey-leading-to-a-directory-traversal-vulnerability-067cdcd3f2e9
CWE: CWE-22
CVE-2023-35163
Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vega’s Ethereum bridge. For example, a deposit to the collateral bridge for 100USDT that credits a party’s general account on Vega, can be re-processed 50 times resulting in 5000USDT in that party’s general account. This is without depositing any more than the original 100USDT on the bridge. Despite this exploit requiring access to a validator's Vega key, a validator key can be obtained at the small cost of 3000VEGA, the amount needed to announce a new node onto the network.

A patch is available in version 0.71.6. No known workarounds are available, however there are mitigations in place should this vulnerability be exploited. There are monitoring alerts for `mainnet1` in place to identify any issues of this nature including this vulnerability being exploited. The validators have the ability to stop the bridge thus stopping any withdrawals should this vulnerability be exploited.
CVSS v3.1 Score: 6.0 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L
Affected Products: vega
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://github.com/vegaprotocol/vega/commit/56b09bf57af8cd9eca5996252d86f469a3e34c68, https://github.com/vegaprotocol/vega/releases/tag/v0.71.6, https://github.com/vegaprotocol/vega/security/advisories/GHSA-8rc9-vxjh-qjf2
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-6610
An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Affected Products: linux_kernel, enterprise_linux
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://access.redhat.com/errata/RHSA-2024:0723, https://access.redhat.com/errata/RHSA-2024:0724, https://access.redhat.com/errata/RHSA-2024:0725
CWE: CWE-125
CVE-2023-39420
The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the daily password and connect to application customers. Given that this is an administrative account, anyone logging into a customer deployment has full, unrestricted access to the application.
CVSS v3.1 Score: 9.9 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products: internet_reservation_module_next_generation
Related CWEs: CWE-798
Related CAPECs: CAPEC-191, CAPEC-70
MITRE ATT&CK Techniques: T1078.001, T1552.001
MITRE ATT&CK Tactics: T1078, T1552
References: https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained/, https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained/
CWE: CWE-798
MITRE ATT&CK techniques: T1078.001, T1552.001
MITRE ATT&CK tactics: T1078, T1552
CVE-2023-4749
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238638 is the identifier assigned to this vulnerability.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: inventory_management_system
Related CWEs: CWE-73
Related CAPECs: CAPEC-13, CAPEC-267, CAPEC-78
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: https://skypoc.wordpress.com/2023/09/03/%e3%80%90code-audit%e3%80%91open-source-ample-inventory-management-system-v1-0-by-mayuri_k-has-a-file-inclusion-vulnerability/, https://vuldb.com/?ctiid.238638, https://vuldb.com/?id.238638
CWE: CWE-73
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2023-39272
Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `lsb` array.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: gtkwave
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html, https://talosintelligence.com/vulnerability_reports/TALOS-2023-1818, https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CWE: CWE-190
CVE-2023-32212
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: thunderbird, firefox_esr, firefox
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1826622, https://security.gentoo.org/glsa/202312-03, https://security.gentoo.org/glsa/202401-10
CVE-2023-37954
A cross-site request forgery (CSRF) vulnerability in Jenkins Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier allows attackers to rebuild a previous build.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: rebuilder
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://www.openwall.com/lists/oss-security/2023/07/12/2, https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3033, http://www.openwall.com/lists/oss-security/2023/07/12/2
CWE: CWE-352
CVE-2023-20877
VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: vrealize_operations, cloud_foundation
Related CWEs: CWE-863
References: https://www.vmware.com/security/advisories/VMSA-2023-0009.html, https://www.vmware.com/security/advisories/VMSA-2023-0009.html
CWE: CWE-863
CVE-2023-0850
A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic. This issue affects some unknown processing of the component Web Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221153 was assigned to this vulnerability.
CVSS v3.1 Score: 2.7 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CVSS v2.0 Score: 3.3 (LOW)
CVSS v2.0 Vector: AV:N/AC:L/Au:M/C:N/I:N/A:P
Affected Products: wndr3700, wndr3700_firmware
Related CWEs: CWE-404
Related CAPECs: CAPEC-496, CAPEC-125, CAPEC-666
MITRE ATT&CK Techniques: T1499.001, T1499.003, T1499
MITRE ATT&CK Tactics: T1498, T1499
References: https://vuldb.com/?ctiid.221153, https://vuldb.com/?id.221153, https://vuldb.com/?ctiid.221153
CWE: CWE-404
MITRE ATT&CK techniques: T1499.001, T1499.003, T1499, T1498.001
MITRE ATT&CK tactics: T1498, T1499
CVE-2023-5445

An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the purpose of redirecting URL request(s) to a malicious site. This impacts the dashboard area of the user interface. A user would need to be logged into ePO to trigger this vulnerability. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server.


CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected Products: epolicy_orchestrator
Related CWEs: CWE-601
Related CAPECs: CAPEC-178
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10410, https://kcm.trellix.com/corporate/index?page=content&id=SB10410
CWE: CWE-601
CVE-2023-23294
Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute commands as root.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: jetwave_2212g_firmware, jetwave_2212x, jetwave_2211c_firmware, jetwave_2114, jetwave_3420_v3
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/, https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/
CWE: CWE-77
CVE-2023-1432
A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /fos/admin/ajax.php?action=save_settings of the component POST Request Handler. The manipulation leads to improper access controls. The attack may be launched remotely. VDB-223214 is the identifier assigned to this vulnerability.
CVSS v3.1 Score: 7.3 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: online_food_ordering_system
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://vuldb.com/?ctiid.223214, https://vuldb.com/?id.223214, https://vuldb.com/?ctiid.223214
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-40837
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADD50' contains a command execution vulnerability. In the "formSetIptv" function, obtaining the "list" and "vlanId" fields, unfiltered passing these two fields as parameters to the "sub_ADD50" function to execute commands.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: ac6, ac6_firmware
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://github.com/XYIYM/Digging/blob/main/Tenda/AC6/cmd/2/2.md, https://github.com/XYIYM/Digging/blob/main/Tenda/AC6/cmd/2/2.md
CWE: CWE-78
CVE-2023-5985



A CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability
exists that could cause compromise of a user’s browser when an attacker with admin privileges
has modified system values.




CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products: ion8650, ion8800, ion8650_firmware, ion8800_firmware
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-318-01.pdf, https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-318-01.pdf
CWE: CWE-79
CVE-2023-44336
Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: macos, acrobat_reader, acrobat_reader_dc, acrobat, acrobat_dc
Related CWEs: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm, https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm, https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1794
CWE: CWE-416
CVE-2023-51093
Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: m3_firmware, m3
Related CWEs: CWE-787
References: https://github.com/GD008/TENDA/blob/main/M3/setVlanInfo/M3_setVlanInfo.md, https://github.com/GD008/TENDA/blob/main/M3/setVlanInfo/M3_setVlanInfo.md
CWE: CWE-787
CVE-2023-38582









Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAIL_RCV. When a legitimate user attempts to access to the vulnerable page of the web application, the XSS payload will be executed.










CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected Products: modulys_gp_firmware, modulys_gp
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03, https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CWE: CWE-79
CVE-2023-29286
Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products: substance_3d_painter
Related CWEs: CWE-824
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html, https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html
CWE: CWE-824
CVE-2023-28663
The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: formidable_pro2pdf
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://www.tenable.com/security/research/tra-2023-2, https://www.tenable.com/security/research/tra-2023-2
CWE: CWE-89
CVE-2023-38531
A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.0.254), Parasolid V35.1 (All versions < V35.1.184), Teamcenter Visualization V14.1 (All versions), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: parasolid, teamcenter_visualization
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://cert-portal.siemens.com/productcert/html/ssa-407785.html, https://cert-portal.siemens.com/productcert/pdf/ssa-407785.pdf, https://cert-portal.siemens.com/productcert/html/ssa-407785.html
CWE: CWE-125
CVE-2023-4023
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Products: all_users_messenger
References: https://wpscan.com/vulnerability/682c0226-28bd-4051-830d-8b679626213d, https://wpscan.com/vulnerability/682c0226-28bd-4051-830d-8b679626213d
CVE-2023-38027
SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system commands or disrupt service.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: sense_firmware, sense
Related CWEs: CWE-78, CWE-77
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://www.twcert.org.tw/tw/cp-132-7334-351fb-1.html, https://www.twcert.org.tw/tw/cp-132-7334-351fb-1.html
CWE: CWE-78, CWE-77
CVE-2023-30991
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query.  IBM X-Force ID:  254037.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel, windows, unix, db2
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254037, https://security.netapp.com/advisory/ntap-20231116-0005/, https://www.ibm.com/support/pages/node/7047499
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-24732
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the gender parameter in the user profile update function.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: simple_customer_relationship_management_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-24732/CVE-2023-24732.txt, https://www.sourcecodester.com/php/15895/simple-customer-relationship-management-crm-system-using-php-free-source-coude.html, https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip
CWE: CWE-89
CVE-2023-6112
Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: chrome, fedora, debian_linux
Related CWEs: CWE-416
References: http://packetstormsecurity.com/files/176721/Chrome-content-NavigationURLLoaderImpl-FallbackToNonInterceptedRequest-Heap-Use-After-Free.html, https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html, https://crbug.com/1499298
CWE: CWE-416
CVE-2023-46324
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its private key and the attacker's public key.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: udm, go
Related CWEs: CWE-347
Related CAPECs: CAPEC-475, CAPEC-463
References: https://github.com/free5gc/udm/compare/v1.1.1...v1.2.0, https://github.com/free5gc/udm/pull/20, https://www.gsma.com/security/wp-content/uploads/2023/10/0073-invalid_curve.pdf
CWE: CWE-347
CVE-2023-0205
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.
CVSS v3.1 Score: 5.0 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Affected Products: connectx-6, connectx_firmware, connectx-5, connectx-6-dx
Related CWEs: CWE-1220
Related CAPECs: CAPEC-180, CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5459, https://nvidia.custhelp.com/app/answers/detail/a_id/5459
CWE: CWE-1220
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574