DuyTa/cve-kgrag-db huggingface dataset:
CVE-2023-54297
In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: fix memory leak after finding block group with super blocks

At exclude_super_stripes(), if we happen to find a block group that has
super blocks mapped to it and we are on a zoned filesystem, we error out
as this is not supposed to happen, indicating either a bug or maybe some
memory corruption for example. However we are exiting the function without
freeing the memory allocated for the logical address of the super blocks.
Fix this by freeing the logical address.
References: https://git.kernel.org/stable/c/ab80a901f8daca07c4a54af0ab0de745c9918294, https://git.kernel.org/stable/c/c35ea606196243063e63785918c7c8fe27c45798, https://git.kernel.org/stable/c/cca627afb463a4b47721eac017516ba200de85c3
CVE-2023-36767
Microsoft Office Security Feature Bypass Vulnerability
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected Products: 365_apps, office, office_long_term_servicing_channel
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36767, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36767
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-36382
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 2.0.0 versions.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected Products: media_library_categories
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/wp-media-library-categories/wordpress-media-library-categories-plugin-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/wp-media-library-categories/wordpress-media-library-categories-plugin-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-23846
Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling protocol (GPTv1-U) messages, a protocol payload with any extension header length set to zero causes an infinite loop. The affected process becomes immediately unresponsive, resulting in denial of service and excessive resource consumption. CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: open5gs
Related CWEs: CWE-770
Related CAPECs: CAPEC-493, CAPEC-488, CAPEC-489
MITRE ATT&CK Techniques: T1498.002, T1499, T1498.001
MITRE ATT&CK Tactics: T1498, T1499
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs-gtp-library/, https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs-gtp-library/
CWE: CWE-770
MITRE ATT&CK techniques: T1498.002, T1499, T1498.001, T1499.001, T1499.002, T1499.003
MITRE ATT&CK tactics: T1498, T1499
CVE-2023-4706

A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrect default privileges.


CVSS v3.1 Score: 7.3 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products: preload_directory
Related CWEs: CWE-276
Related CAPECs: CAPEC-127, CAPEC-1, CAPEC-81
MITRE ATT&CK Techniques: T1083, T1574.010
MITRE ATT&CK Tactics: T1574
References: https://support.lenovo.com/us/en/product_security/LEN-127385, https://support.lenovo.com/us/en/product_security/LEN-127385
CWE: CWE-276
MITRE ATT&CK techniques: T1083, T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-20035
A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability is due to insufficient input validation by the system CLI. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges. An attacker with limited user privileges could use this vulnerability to gain complete control over the system. Note: For additional information about specific impacts, see the Details section of this advisory.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: asr_1002-hx, 1100-8p_integrated_services_router, catalyst_8510csr, 4331_integrated_services_router, 1109-4p_integrated_services_router
Related CWEs: CWE-146
Related CAPECs: CAPEC-6, CAPEC-15
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw
CWE: CWE-146
CVE-2023-28981
An Improper Input Validation vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). If the receipt of router advertisements is enabled on an interface and a specifically malformed RA packet is received, memory corruption will happen which leads to an rpd crash. This issue affects: Juniper Networks Junos OS 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S3; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2. Juniper Networks Junos OS Evolved 20.3-EVO version 20.3R1-EVO and later versions; 20.4-EVO versions prior to 20.4R3-S6-EVO; 21.3-EVO versions prior to 21.3R3-EVO; 21.4-EVO versions prior to 21.4R2-EVO; 22.1-EVO versions prior to 22.1R2-EVO.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: junos_os_evolved, junos
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://supportportal.juniper.net/JSA70607, https://supportportal.juniper.net/JSA70607
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-5659
The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 Score: 6.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected Products: interact\
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://plugins.trac.wordpress.org/browser/interact-quiz-embed/tags/3.0.7/interact-quiz-embed.php#L53, https://plugins.trac.wordpress.org/changeset/2990262/interact-quiz-embed, https://www.wordfence.com/threat-intel/vulnerabilities/id/69ba1a39-ddb0-4661-8104-d8bb71710e0c?source=cve
CWE: CWE-79
CVE-2023-29161
Uncontrolled search path in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1 Score: 6.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products: one_boot_flash_update
Related CWEs: CWE-427
Related CAPECs: CAPEC-38, CAPEC-471
MITRE ATT&CK Techniques: T1574.007, T1574.008, T1574.004
MITRE ATT&CK Tactics: T1574
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00900.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00900.html
CWE: CWE-427
MITRE ATT&CK techniques: T1574.007, T1574.008, T1574.004, T1574.009, T1574.001
MITRE ATT&CK tactics: T1574
CVE-2023-35037
Missing Authorization vulnerability in Surfer Surfer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.3.2.357.
CVSS v3.1 Score: 7.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/wordpress/plugin/surferseo/vulnerability/wordpress-surfer-plugin-1-1-2-298-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-42277
hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: hutool
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://github.com/dromara/hutool/issues/3285, https://github.com/dromara/hutool/issues/3285
CWE: CWE-120
CVE-2023-53522
In the Linux kernel, the following vulnerability has been resolved:

cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex

syzbot is reporting circular locking dependency between cpu_hotplug_lock
and freezer_mutex, for commit f5d39b020809 ("freezer,sched: Rewrite core
freezer logic") replaced atomic_inc() in freezer_apply_state() with
static_branch_inc() which holds cpu_hotplug_lock.

cpu_hotplug_lock => cgroup_threadgroup_rwsem => freezer_mutex

  cgroup_file_write() {
    cgroup_procs_write() {
      __cgroup_procs_write() {
        cgroup_procs_write_start() {
          cgroup_attach_lock() {
            cpus_read_lock() {
              percpu_down_read(&cpu_hotplug_lock);
            }
            percpu_down_write(&cgroup_threadgroup_rwsem);
          }
        }
        cgroup_attach_task() {
          cgroup_migrate() {
            cgroup_migrate_execute() {
              freezer_attach() {
                mutex_lock(&freezer_mutex);
                (...snipped...)
              }
            }
          }
        }
        (...snipped...)
      }
    }
  }

freezer_mutex => cpu_hotplug_lock

  cgroup_file_write() {
    freezer_write() {
      freezer_change_state() {
        mutex_lock(&freezer_mutex);
        freezer_apply_state() {
          static_branch_inc(&freezer_active) {
            static_key_slow_inc() {
              cpus_read_lock();
              static_key_slow_inc_cpuslocked();
              cpus_read_unlock();
            }
          }
        }
        mutex_unlock(&freezer_mutex);
      }
    }
  }

Swap locking order by moving cpus_read_lock() in freezer_apply_state()
to before mutex_lock(&freezer_mutex) in freezer_change_state().
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/34fbb7b45bae20b551dda24337c7761ca13ce69d, https://git.kernel.org/stable/c/3756171b97c307d9df8b8ded1d883eec30172085, https://git.kernel.org/stable/c/57dcd64c7e036299ef526b400a8d12b8a2352f26
CVE-2023-25719
ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executable can be used to execute malicious queries or as a denial-of-service vector. NOTE: this CVE Record is only about the parameters, such as the h parameter (this CVE Record is not about the separate issue of signed executable files that are supposed to have unique configurations across customers' installations).
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: control
Related CWEs: CWE-74
Related CAPECs: CAPEC-53, CAPEC-51, CAPEC-9
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: https://cybir.com/2022/cve/hijacking-connectwise-control-and-ddos/, https://m.youtube.com/watch?v=fbNVUgmstSc&pp=0gcJCf0Ao7VqN5tD, https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures
CWE: CWE-74
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2023-27510
JB Inquiry form contains an exposure of private personal information to an unauthorized actor vulnerability, which may allow a remote unauthenticated attacker to obtain information entered from forms created using the affected product. The affected products and versions are as follows: JB Inquiry form versions 0.6.1 and 0.6.0, JB Inquiry form versions 0.5.2, 0.5.1 and 0.5.0, and JB Inquiry form version 0.40.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: jb_inquiry_form
References: https://jubei.co.jp/formmail/info20230414.html, https://jvn.jp/en/jp/JVN36340790/, https://jubei.co.jp/formmail/info20230414.html
CVE-2023-50931
An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Bitbucket, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
CVSS v3.1 Score: 8.3 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Affected Products: s-notify
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://help.savignano.net/snotify-email-encryption/sa-2023-11-28, https://help.savignano.net/snotify-email-encryption/sa-2023-11-28
CWE: CWE-352
CVE-2023-46087
Cross-Site Request Forgery (CSRF) vulnerability in Mahlamusa Who Hit The Page – Hit Counter plugin <= 1.4.14.3 versions.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: who_hit_the_page_hit_counter
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/who-hit-the-page-hit-counter/wordpress-who-hit-the-page-hit-counter-plugin-1-4-14-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/who-hit-the-page-hit-counter/wordpress-who-hit-the-page-hit-counter-plugin-1-4-14-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-21841
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: weblogic_server
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: https://www.oracle.com/security-alerts/cpujan2023.html, https://www.oracle.com/security-alerts/cpujan2023.html
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2023-40731
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to upload arbitrary file types. This could allow an attacker to upload malicious files, that could potentially lead to code tampering.
CVSS v3.1 Score: 5.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Affected Products: qms_automotive
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf, https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-39777
A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: vbulletin
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://gist.github.com/GiongfNef/8fe658dce4c7fcf3a7b4e6387e50141c, https://gist.github.com/GiongfNef/8fe658dce4c7fcf3a7b4e6387e50141c
CWE: CWE-79
CVE-2023-53880
Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters. Attackers can craft specific payloads targeting admin pages like server.cfm and web.cfm to execute arbitrary JavaScript in victim's browser sessions.
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://www.exploit-db.com/exploits/51668, https://www.lucee.org/, https://www.vulncheck.com/advisories/lucee-authenticated-reflected-cross-site-scripting-via-admin-interfaces
CWE: CWE-79
CVE-2023-22482
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3  are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an `aud` (audience) claim in signed tokens. The value of that claim specifies the intended audience(s) of the token (i.e. the service or services which are meant to accept the token). Argo CD _does_ validate that the token was signed by Argo CD's configured OIDC provider. But Argo CD _does not_ validate the audience claim, so it will accept tokens that are not intended for Argo CD. If Argo CD's configured OIDC provider also serves other audiences (for example, a file storage service), then Argo CD will accept a token intended for one of those other audiences. Argo CD will grant the user privileges based on the token's `groups` claim, even though those groups were not intended to be used by Argo CD. This bug also increases the impact of a stolen token. If an attacker steals a valid token for a different audience, they can use it to access Argo CD. A patch for this vulnerability has been released in versions 2.6.0-rc3, 2.5.6, 2.4.19, and 2.3.13. There are no workarounds.
CVSS v3.1 Score: 9.0 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products: argo_cd
Related CWEs: CWE-863
References: https://github.com/argoproj/argo-cd/security/advisories/GHSA-q9hr-j4rf-8fjc, https://github.com/argoproj/argo-cd/security/advisories/GHSA-q9hr-j4rf-8fjc
CWE: CWE-863
CVE-2023-47823
Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.7.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/wordpress/plugin/formcraft-form-builder/vulnerability/wordpress-formcraft-contact-form-builder-for-wordpress-plugin-1-2-7-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-1756
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


CVSS v3.1 Score: 4.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected Products: phpmyfaq
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/thorsten/phpmyfaq/commit/ca75f4688a8b0f14d5d0697b9f4b6ea66088f726, https://huntr.dev/bounties/e495b443-b328-42f5-aed5-d68b929b4cb9, https://github.com/thorsten/phpmyfaq/commit/ca75f4688a8b0f14d5d0697b9f4b6ea66088f726
CWE: CWE-79
CVE-2023-32252
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: h410c_firmware, h700s, h700s_firmware, h500s, h410s_firmware
Related CWEs: CWE-476
References: https://access.redhat.com/security/cve/CVE-2023-32252, https://bugzilla.redhat.com/show_bug.cgi?id=2219815, https://security.netapp.com/advisory/ntap-20231124-0001/
CWE: CWE-476
CVE-2023-37242
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerability to rewrite the non-volatile random-access memory (NVRAM), or facilitate the exploitation of other vulnerabilities.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: harmonyos, emui
Related CWEs: CWE-639
References: https://consumer.huawei.com/en/support/bulletin/2023/7/, https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858, https://consumer.huawei.com/en/support/bulletin/2023/7/
CWE: CWE-639
CVE-2023-48808
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: x6000r_firmware, x6000r
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://www.notion.so/X6000R-sub_4119A0-9-075ccc78275a4381a65e114eb1fddd6e?pvs=4, https://www.notion.so/X6000R-sub_4119A0-9-075ccc78275a4381a65e114eb1fddd6e?pvs=4
CWE: CWE-78
CVE-2023-42641
In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: t612, sc9863a, t820, sc7731e, t760
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857, https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-4996
Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceController did not validate the permissions associated with the user before executing the user control code. This user control code had permissions to terminate the NSClient service. 

CVSS v3.1 Score: 6.6 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Affected Products: windows, netskope
Related CWEs: CWE-281
References: https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2023-003, https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2023-003
CWE: CWE-281
CVE-2023-28243
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_21h2, windows_10_20h2
Related CWEs: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28243, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28243
CWE: CWE-843
CVE-2023-20081
A vulnerability in the IPv6 DHCP (DHCPv6) client module of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, Cisco IOS Software, and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of DHCPv6 messages. An attacker could exploit this vulnerability by sending crafted DHCPv6 messages to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: To successfully exploit this vulnerability, the attacker would need to either control the DHCPv6 server or be in a man-in-the-middle position.
CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Affected Products: 8800_18-slot, catalyst_3650-12x48ur, catalyst_3650-24pd, 8101-32fh, catalyst_9300l-24p-4g-e
Related CWEs: CWE-787, CWE-122
Related CAPECs: CAPEC-92
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftdios-dhcpv6-cli-Zf3zTv, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftdios-dhcpv6-cli-Zf3zTv
CWE: CWE-787, CWE-122
CVE-2023-43129
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of REMOTE_PORT parameters.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: dir-806_firmware, dir-806
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-806, https://github.com/mmmmmx1/dlink/blob/main/DIR-806/2/readme.md, http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-806
CWE: CWE-78
CVE-2023-1967
Keysight N8844A Data Analytics Web Service deserializes untrusted data without sufficiently verifying the resulting data will be valid. 
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: n8844a
Related CWEs: CWE-502
Related CAPECs: CAPEC-586
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-115-01, https://www.cisa.gov/news-events/ics-advisories/icsa-23-115-01
CWE: CWE-502
CVE-2023-21893
Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server.  Supported versions that are affected are 19c and  21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: database_server
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://www.oracle.com/security-alerts/cpujan2023.html, https://www.oracle.com/security-alerts/cpujan2023.html
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-53666
In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: wcd938x: fix missing mbhc init error handling

MBHC initialisation can fail so add the missing error handling to avoid
dereferencing an error pointer when later configuring the jack:

    Unable to handle kernel paging request at virtual address fffffffffffffff8

    pc : wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc]
    lr : wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x]

    Call trace:
     wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc]
     wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x]
     snd_soc_component_set_jack+0x28/0x8c [snd_soc_core]
     qcom_snd_wcd_jack_setup+0x7c/0x19c [snd_soc_qcom_common]
     sc8280xp_snd_init+0x20/0x2c [snd_soc_sc8280xp]
     snd_soc_link_init+0x28/0x90 [snd_soc_core]
     snd_soc_bind_card+0x628/0xbfc [snd_soc_core]
     snd_soc_register_card+0xec/0x104 [snd_soc_core]
     devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core]
     sc8280xp_platform_probe+0xf0/0x108 [snd_soc_sc8280xp]
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/31ee704c84c4bf4df8521ef1478c161f710d0f94, https://git.kernel.org/stable/c/5a34d252052b5da743ef82591c860fc947384d4e, https://git.kernel.org/stable/c/7dfae2631bfbdebecd35fe7b472ab3cc95c9ed66
CVE-2023-39982
A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications at risk on the affected device. This vulnerability is attributed to a hard-coded SSH host key, which might facilitate man-in-the-middle attacks and enable the decryption of SSH traffic.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: mxsecurity
Related CWEs: CWE-798, CWE-321
Related CAPECs: CAPEC-191, CAPEC-70
MITRE ATT&CK Techniques: T1078.001, T1552.001
MITRE ATT&CK Tactics: T1078, T1552
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities, https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities
CWE: CWE-798, CWE-321
MITRE ATT&CK techniques: T1078.001, T1552.001
MITRE ATT&CK tactics: T1078, T1552
CVE-2023-38347
An issue was discovered in LWsystems Benno MailArchiv 2.10.1. Attackers can cause XSS via JavaScript content to a mailbox.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: benno_mailarchiv
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://blog.sebastianschmitt.eu/security/xss-in-benno-mailarchiv-web-app-benno-rest-lib-cve-2023-38347/, https://wiki.benno-mailarchiv.de/doku.php, https://blog.sebastianschmitt.eu/security/xss-in-benno-mailarchiv-web-app-benno-rest-lib-cve-2023-38347/
CWE: CWE-79
CVE-2023-4066
A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: enterprise_linux, jboss_middleware, jboss_a-mq, openshift_container_platform
Related CWEs: CWE-313, CWE-312
Related CAPECs: CAPEC-37
MITRE ATT&CK Techniques: T1005, T1552.004
MITRE ATT&CK Tactics: T1552
References: https://access.redhat.com/errata/RHSA-2023:4720, https://access.redhat.com/security/cve/CVE-2023-4066, https://bugzilla.redhat.com/show_bug.cgi?id=2224677
CWE: CWE-313, CWE-312
MITRE ATT&CK techniques: T1005, T1552.004
MITRE ATT&CK tactics: T1552
CVE-2023-38428
An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected Products: h700s, h500s, solidfire_\&_hci_storage_node, h410s, linux_kernel
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/ksmbd?id=f0a96d1aafd8964e1f9955c830a3e5cb3c60a90f, https://security.netapp.com/advisory/ntap-20230831-0001/
CWE: CWE-125
CVE-2023-42464
A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the underlying protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a malicious actor may be able to fully control the value of the pointer and theoretically achieve Remote Code Execution on the host. This issue is similar to CVE-2023-34967.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: debian_linux, netatalk
Related CWEs: CWE-843
References: https://github.com/Netatalk/netatalk/issues/486, https://lists.debian.org/debian-lts-announce/2023/09/msg00031.html, https://netatalk.io/security/CVE-2023-42464
CWE: CWE-843
CVE-2023-45897
exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products: exfatprogs
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/, https://github.com/exfatprogs/exfatprogs/commit/22d0e43e8d24119cbfc6efafabb0dec6517a86c4, https://github.com/exfatprogs/exfatprogs/commit/4abc55e976573991e6a1117bb2b3711e59da07ae
CWE: CWE-125
CVE-2023-49117
PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: powercms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://jvn.jp/en/jp/JVN32646742/, https://www.powercms.jp/news/release-powercms-202312.html, https://jvn.jp/en/jp/JVN32646742/
CWE: CWE-79
CVE-2023-36657
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: metadefender_kiosk
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: https://docs.opswat.com/mdkiosk, https://docs.opswat.com/mdkiosk/release-notes/cve-2023-36657, https://docs.opswat.com/mdkiosk
CWE: CWE-269
MITRE ATT&CK techniques: T1548
CVE-2023-21899
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are Prior to 6.1.42 and  prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: Applies to VirtualBox VMs running Windows 7 and later. CVSS 3.1 Base Score 5.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: vm_virtualbox
References: https://security.gentoo.org/glsa/202310-07, https://www.oracle.com/security-alerts/cpujan2023.html, https://security.gentoo.org/glsa/202310-07
CVE-2023-43541
Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render.
CVSS v3.1 Score: 8.4 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: wsa8845_firmware, sc8280xp-abbb, qca6420_firmware, fastconnect_6200, sc8180xp-acaf
Related CWEs: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin, https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CWE: CWE-476
CVE-2023-0603
The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: sloth_logo_customizer
References: https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba, https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba
CVE-2023-21302
In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: android
Related CWEs: CWE-203
Related CAPECs: CAPEC-189
References: https://source.android.com/docs/security/bulletin/android-14, https://source.android.com/docs/security/bulletin/android-14
CWE: CWE-203
CVE-2023-34460
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.


CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected Products: tauri, macos, linux_kernel
Related CWEs: CWE-285
Related CAPECs: CAPEC-13, CAPEC-668, CAPEC-17
MITRE ATT&CK Techniques: T1574.006, T1565.002, T1005
MITRE ATT&CK Tactics: T1134, T1550, T1565
References: https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564, https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347, https://github.com/tauri-apps/tauri/pull/7227
CWE: CWE-285
MITRE ATT&CK techniques: T1574.006, T1565.002, T1005, T1083, T1574.007, T1550.004, T1134.001, T1574.010, T1562.003, T1574.005, T1012, T1552.002
MITRE ATT&CK tactics: T1134, T1550, T1565, T1552, T1562, T1574
CVE-2023-32084
HTTP.sys Denial of Service Vulnerability
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: windows_10_1809, windows_11_22h2, windows_11_21h2, windows_server_2019, windows_server_2022
Related CWEs: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32084, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32084
CWE: CWE-476
CVE-2023-3969
A vulnerability, which was classified as problematic, has been found in GZ Scripts Availability Booking Calendar PHP 1.0. Affected by this issue is some unknown functionality of the file index.php of the component HTTP POST Request Handler. The manipulation of the argument promo_code leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235568.
CVSS v3.1 Score: 3.5 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: availability_booking_calendar_php
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://seclists.org/fulldisclosure/2023/Jul/51, https://vuldb.com/?ctiid.235568, https://vuldb.com/?id.235568
CWE: CWE-79
CVE-2023-29335
Microsoft Word Security Feature Bypass Vulnerability
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: 365_apps, windows_10_1809, windows_server_2012, windows_11_22h2, word
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29335, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29335
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-54046
In the Linux kernel, the following vulnerability has been resolved:

crypto: essiv - Handle EBUSY correctly

As it is essiv only handles the special return value of EINPROGERSS,
which means that in all other cases it will free data related to the
request.

However, as the caller of essiv may specify MAY_BACKLOG, we also need
to expect EBUSY and treat it in the same way.  Otherwise backlogged
requests will trigger a use-after-free.
References: https://git.kernel.org/stable/c/69c67d451fc19d88e54f7d97e8e7c093e08357e1, https://git.kernel.org/stable/c/796e02cca30a67322161f0745e5ce994bbe75605, https://git.kernel.org/stable/c/840a1d3b77c1b062bd62b4733969a5b1efc274ce
CVE-2023-28517
IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  250421.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: linux_kernel, sterling_partner_engagement_manager
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/250421, https://www.ibm.com/support/pages/node/7138575, https://exchange.xforce.ibmcloud.com/vulnerabilities/250421
CWE: CWE-79
CVE-2023-37952
A cross-site request forgery (CSRF) vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products: mabl
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://www.openwall.com/lists/oss-security/2023/07/12/2, https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3127, http://www.openwall.com/lists/oss-security/2023/07/12/2
CWE: CWE-352
CVE-2023-27382
Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.0.0.156 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1 Score: 6.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products: nuc_p14e_laptop_element, windows_10
Related CWEs: CWE-276
Related CAPECs: CAPEC-127, CAPEC-1, CAPEC-81
MITRE ATT&CK Techniques: T1083, T1574.010
MITRE ATT&CK Tactics: T1574
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00802.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00802.html
CWE: CWE-276
MITRE ATT&CK techniques: T1083, T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-3068
A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/modal_add_product.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230580.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: retro_cellphone_online_store
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/wordpress405/cve/blob/main/Retro%20Cellphone%20Online%20Store.pdf, https://vuldb.com/?ctiid.230580, https://vuldb.com/?id.230580
CWE: CWE-89
CVE-2023-30739
Arbitrary File Descriptor Write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS v3.1 Score: 6.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: android
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11, https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=11
CVE-2023-36530
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smartypants SP Project & Document Manager plugin <= 4.67 versions.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected Products: sp_project_\&_document_manager
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-67-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-67-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-4407
A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument date1/date2 leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-237511.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: credit_lite
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.com/files/174244/Credit-Lite-1.5.4-SQL-Injection.html, https://vuldb.com/?ctiid.237511, https://vuldb.com/?id.237511
CWE: CWE-89