DuyTa/cve-kgrag-db huggingface dataset:
CVE-2023-52212
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://vdp.patchstack.com/database/wordpress/plugin/wp-job-manager/vulnerability/wordpress-wp-job-manager-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-52387
Resource reuse vulnerability in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: harmonyos, emui
Related CWEs: CWE-664
Related CAPECs: CAPEC-21, CAPEC-61, CAPEC-60
MITRE ATT&CK Techniques: T1134, T1539, T1550.004
MITRE ATT&CK Tactics: T1134, T1550
References: https://consumer.huawei.com/en/support/bulletin/2024/2/, https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-0000001834855405, https://consumer.huawei.com/en/support/bulletin/2024/2/
CWE: CWE-664
MITRE ATT&CK techniques: T1134, T1539, T1550.004, T1134.003, T1134.001, T1134.002, T1606, T1528
MITRE ATT&CK tactics: T1134, T1550
CVE-2023-49515
Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtain sensitive information via a connection to the UART pin components.
CVSS v3.1 Score: 4.6 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: tapo_tc70_firmware, tapo_tc70, tapo_c200_firmware, tapo_c200
Related CWEs: CWE-922
References: https://github.com/VineethKumarM/TAPO-TC70-Unauthorized-root-access-using-UART, https://github.com/VineethKumarM/TAPO-TC70-Unauthorized-root-access-using-UART/tree/master, https://github.com/VineethKumarM/TAPO-TC70-Unauthorized-root-access-using-UART
CWE: CWE-922
CVE-2023-24578
McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. This could enable a user with lower privileges to execute unauthorized tasks.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products: total_protection
Related CWEs: CWE-427
Related CAPECs: CAPEC-38, CAPEC-471
MITRE ATT&CK Techniques: T1574.007, T1574.008, T1574.004
MITRE ATT&CK Tactics: T1574
References: https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html, https://www.mcafee.com/support/?articleId=TS103397&page=shell&shell=article-view, https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html
CWE: CWE-427
MITRE ATT&CK techniques: T1574.007, T1574.008, T1574.004, T1574.009, T1574.001
MITRE ATT&CK tactics: T1574
CVE-2023-33169
Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_21h2, windows_10_1507
Related CWEs: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33169, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33169
CWE: CWE-126
CVE-2023-53508
In the Linux kernel, the following vulnerability has been resolved:

ublk: fail to start device if queue setup is interrupted

In ublk_ctrl_start_dev(), if wait_for_completion_interruptible() is
interrupted by signal, queues aren't setup successfully yet, so we
have to fail UBLK_CMD_START_DEV, otherwise kernel oops can be triggered.

Reported by German when working on qemu-storage-deamon which requires
single thread ublk daemon.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/0d5916c439574b18a0734872daa0022b3d6105ad, https://git.kernel.org/stable/c/53e7d08f6d6e214c40db1f51291bb2975c789dc2, https://git.kernel.org/stable/c/6ab3e7d424cd413d7a5e976c8a30b4ffa84a65dd
CVE-2023-4936
It is possible to sideload a compromised DLL during the installation at elevated privilege.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
Affected Products: displaylink
Related CWEs: CWE-269, CWE-427
Related CAPECs: CAPEC-233, CAPEC-471, CAPEC-38
MITRE ATT&CK Techniques: T1574.007, T1574.008, T1574.004
MITRE ATT&CK Tactics: T1574
References: https://www.synaptics.com/, https://www.synaptics.com/products/displaylink-graphics/downloads/windows, https://www.synaptics.com/sites/default/files/nr-154525-tc-synaptics_displaylink_windows_driver_security_brief_-_oct2023.pdf
CWE: CWE-269, CWE-427
MITRE ATT&CK techniques: T1574.007, T1574.008, T1574.004, T1574.009, T1548, T1574.001
MITRE ATT&CK tactics: T1574
CVE-2023-41982
This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1. An attacker with physical access may be able to use Siri to access sensitive user data.
CVSS v3.1 Score: 4.6 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: iphone_os, ipados, macos, watchos
References: http://seclists.org/fulldisclosure/2023/Oct/19, http://seclists.org/fulldisclosure/2023/Oct/23, http://seclists.org/fulldisclosure/2023/Oct/24
CVE-2023-50979
Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: crypto\+\+
Related CWEs: CWE-203
Related CAPECs: CAPEC-189
References: https://github.com/weidai11/cryptopp/issues/1247, https://github.com/weidai11/cryptopp/issues/1247
CWE: CWE-203
CVE-2023-34997
Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1 Score: 6.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products: server_configuration_utility
Related CWEs: CWE-277, CWE-732
Related CAPECs: CAPEC-17, CAPEC-206, CAPEC-234
MITRE ATT&CK Techniques: T1553.002, T1083, T1505.005
MITRE ATT&CK Tactics: T1134, T1505, T1553
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00925.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00925.html
CWE: CWE-277, CWE-732
MITRE ATT&CK techniques: T1553.002, T1083, T1505.005, T1550.004, T1134.001, T1574.010, T1548, T1554, T1574.005
MITRE ATT&CK tactics: T1134, T1505, T1553, T1550, T1574
CVE-2023-43137
TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule name parameter has injection points.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: tl-er5120g_firmware, tl-er5120g
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://github.com/7R4C4R/CVE/blob/main/TPLINK-TL-ER5120G/command%20injection/01/command%20injection01.md, https://github.com/7R4C4R/CVE/blob/main/TPLINK-TL-ER5120G/command%20injection/01/command%20injection01.md
CWE: CWE-77
CVE-2023-30054
TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: a7100ru_firmware, a7100ru
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://github.com/Am1ngl/ttt/tree/main/161, https://github.com/Am1ngl/ttt/tree/main/161
CWE: CWE-78
CVE-2023-0629
Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket).

The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges.
This issue has been fixed in Docker Desktop 4.17.0. 

Affected Docker Desktop versions: from 4.13.0 before 4.17.0.


CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products: docker_desktop
Related CWEs: CWE-424, CWE-501
Related CAPECs: CAPEC-127, CAPEC-554
MITRE ATT&CK Techniques: T1083
References: https://docs.docker.com/desktop/release-notes/#4170, https://docs.docker.com/desktop/release-notes/#4170
CWE: CWE-424, CWE-501
MITRE ATT&CK techniques: T1083
CVE-2023-4001
An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package.
CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: enterprise_linux, fedora, grub2
Related CWEs: CWE-290
Related CAPECs: CAPEC-21, CAPEC-459, CAPEC-94
MITRE ATT&CK Techniques: T1134, T1553.002, T1539
MITRE ATT&CK Tactics: T1134, T1550, T1553
References: https://access.redhat.com/errata/RHSA-2024:0437, https://access.redhat.com/errata/RHSA-2024:0456, https://access.redhat.com/errata/RHSA-2024:0468
CWE: CWE-290
MITRE ATT&CK techniques: T1134, T1553.002, T1539, T1550.004, T1557, T1134.001, T1036.001, T1528
MITRE ATT&CK tactics: T1134, T1550, T1553, T1036
CVE-2023-50094
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: rengine
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://github.com/yogeshojha/rengine/blob/53d9f505f04861a5040195ea71f20907ff90577a/web/api/views.py#L268-L275, https://github.com/yogeshojha/rengine/blob/5e120bd5f9dfbd1da82a193e8c9702e483d38d22/web/api/views.py#L195, https://github.com/yogeshojha/rengine/commit/3d5f1724dd12cf9861443742e7d7c02ff8c75a6f
CWE: CWE-78
CVE-2023-21142
In multiple files, there is a possible way to access traces in the dev mode due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-262243665
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: android
Related CWEs: CWE-732
Related CAPECs: CAPEC-17, CAPEC-206, CAPEC-234
MITRE ATT&CK Techniques: T1553.002, T1083, T1505.005
MITRE ATT&CK Tactics: T1134, T1505, T1553
References: https://source.android.com/security/bulletin/2023-06-01, https://source.android.com/security/bulletin/2023-06-01
CWE: CWE-732
MITRE ATT&CK techniques: T1553.002, T1083, T1505.005, T1550.004, T1134.001, T1574.010, T1548, T1554, T1574.005
MITRE ATT&CK tactics: T1134, T1505, T1553, T1550, T1574
CVE-2023-28273
Windows Clip Service Elevation of Privilege Vulnerability
CVSS v3.1 Score: 7.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows_10_1809, windows_11_22h2, windows_11_21h2, windows_10_20h2, windows_10_1607
Related CWEs: CWE-362, CWE-591
Related CAPECs: CAPEC-29, CAPEC-26
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28273, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28273
CWE: CWE-362, CWE-591
CVE-2023-5901
Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.


CVSS v3.1 Score: 3.5 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected Products: pkp_web_application_library
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/pkp/pkp-lib/commit/44d8bde60eb2575fd4087b76540aec9b49389e23, https://huntr.com/bounties/8fb9b06b-cadd-469e-862d-5ce026019597, https://github.com/pkp/pkp-lib/commit/44d8bde60eb2575fd4087b76540aec9b49389e23
CWE: CWE-79
CVE-2023-4697
Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: memos
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: https://github.com/usememos/memos/commit/c9aa2eeb9852047e4f41915eb30726bd25f07ecd, https://huntr.dev/bounties/3ff3325a-1dcb-4da7-894d-81a9cf726d81, https://github.com/usememos/memos/commit/c9aa2eeb9852047e4f41915eb30726bd25f07ecd
CWE: CWE-269
MITRE ATT&CK techniques: T1548
CVE-2023-21918
Vulnerability in the Oracle Database Recovery Manager component of Oracle Database Server.  Supported versions that are affected are 19c and  21c. Easily exploitable vulnerability allows high privileged attacker having Local SYSDBA privilege with network access via Oracle Net to compromise Oracle Database Recovery Manager.  While the vulnerability is in Oracle Database Recovery Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Database Recovery Manager. CVSS 3.1 Base Score 6.8 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Affected Products: database_recovery_manager
References: https://www.oracle.com/security-alerts/cpuapr2023.html, https://www.oracle.com/security-alerts/cpuapr2023.html
CVE-2023-4089
On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.
CVSS v3.1 Score: 2.7 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Affected Products: compact_controller_100_firmware, compact_controller_100, pfc100, pfc200_firmware, edge_controller
Related CWEs: CWE-610
Related CAPECs: CAPEC-219
References: https://cert.vde.com/en/advisories/VDE-2023-046/, https://cert.vde.com/en/advisories/VDE-2023-046/
CWE: CWE-610
CVE-2023-41726
Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: avalanche
Related CWEs: CWE-276
Related CAPECs: CAPEC-127, CAPEC-1, CAPEC-81
MITRE ATT&CK Techniques: T1083, T1574.010
MITRE ATT&CK Tactics: T1574
References: https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt, https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt
CWE: CWE-276
MITRE ATT&CK techniques: T1083, T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-24369
A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter under the Add New Articles function.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: ujcms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/ujcms/ujcms/issues/3, https://github.com/ujcms/ujcms/issues/3
CWE: CWE-79
CVE-2023-35619
Microsoft Outlook for Mac Spoofing Vulnerability
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products: office_long_term_servicing_channel
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35619, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35619
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-36725
Windows Kernel Elevation of Privilege Vulnerability
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows_10_1809, windows_11_22h2, windows_11_21h2, windows_10_21h2, windows_server_2019
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36725, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36725
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-26509
AnyDesk 7.0.8 allows remote Denial of Service.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: anydesk
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://anydesk.com/cve/2023-26509/, https://anydesk.com/en/downloads/windows, https://gist.github.com/Fastor01/161211a8aef1278d942c551fd2065ca5
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2023-32874
In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161803; Issue ID: MOLY01161803 (MSV-893).
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: mt6895, mt6785, mt6853, lr13, mt6990
Related CWEs: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2024, https://corp.mediatek.com/product-security-bulletin/January-2024
CWE: CWE-787
CVE-2023-5585
A vulnerability was found in SourceCodester Online Motorcycle Rental System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/?page=bike of the component Bike List. The manipulation of the argument Model with the input "><script>confirm (document.cookie)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-242170 is the identifier assigned to this vulnerability.
CVSS v3.1 Score: 2.4 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 3.3 (LOW)
CVSS v2.0 Vector: AV:N/AC:L/Au:M/C:N/I:P/A:N
Affected Products: online_motorcycle_\(bike\)_rental_system
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://vuldb.com/?ctiid.242170, https://vuldb.com/?id.242170, https://vuldb.com/?ctiid.242170
CWE: CWE-79
CVE-2023-35740
D-Link DAP-2622 DDP Configuration Backup Server Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20067.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: dap-2622, dap-2622_firmware
Related CWEs: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349, https://www.zerodayinitiative.com/advisories/ZDI-23-1245/, https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CWE: CWE-121, CWE-787
CVE-2023-38403
iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: debian_linux, clustered_data_ontap, macos, fedora, linux_kernel
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: http://seclists.org/fulldisclosure/2023/Oct/24, http://seclists.org/fulldisclosure/2023/Oct/26, https://bugs.debian.org/1040830
CWE: CWE-190
CVE-2023-20032
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:
  A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.
  This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.
 For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"].
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: clamav, secure_endpoint_private_cloud, stormshield_network_security, web_security_appliance, secure_endpoint
Related CWEs: CWE-787, CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy
CWE: CWE-787, CWE-120
CVE-2023-21891
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer).  Supported versions that are affected are 5.9.0.0.0 and  6.4.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: business_intelligence
References: https://www.oracle.com/security-alerts/cpujan2023.html, https://www.oracle.com/security-alerts/cpujan2023.html
CVE-2023-20685
In vdec, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07608575; Issue ID: ALPS07608575.
CVSS v3.1 Score: 6.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: mt6895, mt6855, mt6983, mt8673, mt8798
Related CWEs: CWE-362
Related CAPECs: CAPEC-29, CAPEC-26
References: https://corp.mediatek.com/product-security-bulletin/April-2023, https://corp.mediatek.com/product-security-bulletin/April-2023
CWE: CWE-362
CVE-2023-0001
An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent.
CVSS v3.1 Score: 6.0 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Affected Products: windows, cortex_xdr_agent
Related CWEs: CWE-319
Related CAPECs: CAPEC-383, CAPEC-102, CAPEC-477
MITRE ATT&CK Techniques: T1056.004, T1040
MITRE ATT&CK Tactics: T1056
References: https://security.paloaltonetworks.com/CVE-2023-0001, https://security.paloaltonetworks.com/CVE-2023-0001
CWE: CWE-319
MITRE ATT&CK techniques: T1056.004, T1040
MITRE ATT&CK tactics: T1056
CVE-2023-3465
A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file user.php of the component HTTP POST Request Handler. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-232711.
CVSS v3.1 Score: 3.5 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: classified_ads_script_php
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://simplephpscripts.com/guestbook-script-php/guestbook/preview.php, https://vuldb.com/?ctiid.232711, https://vuldb.com/?id.232711
CWE: CWE-79
CVE-2023-30710
Improper input validation vulnerability in Knox AI prior to SMR Sep-2023 Release 1 allows local attackers to launch privileged activities.
CVSS v3.1 Score: 8.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Affected Products: android
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09, https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09
CVE-2023-28438
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.
CVSS v3.1 Score: 6.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Affected Products: pimcore
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch, https://github.com/pimcore/pimcore/pull/14526, https://github.com/pimcore/pimcore/security/advisories/GHSA-vf7q-g2pv-jxvx
CWE: CWE-89
CVE-2023-40582
find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This issue has been addressed in version 1.0.3. users are advised to upgrade. Users unable to upgrade should ensure that all input passed to find-exec comes from a trusted source.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: find-exec
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c, https://github.com/shime/find-exec/security/advisories/GHSA-95rp-6gqp-6622, https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c
CWE: CWE-78
CVE-2023-3462
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products: vault
Related CWEs: CWE-203
Related CAPECs: CAPEC-189
References: https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714, https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714
CWE: CWE-203
CVE-2023-0889
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products: themeflection_numbers
References: https://wpscan.com/vulnerability/c39473a7-47fc-4bce-99ad-28d03f41e74e, https://wpscan.com/vulnerability/c39473a7-47fc-4bce-99ad-28d03f41e74e
CVE-2023-49922
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Beats or Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.
CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products: elastic_beats
Related CWEs: CWE-532
Related CAPECs: CAPEC-215
References: https://discuss.elastic.co/t/beats-and-elastic-agent-8-11-3-7-17-16-security-update-esa-2023-30/349180, https://discuss.elastic.co/t/beats-and-elastic-agent-8-11-3-7-17-16-security-update-esa-2023-30/349180
CWE: CWE-532
CVE-2023-48491
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: experience_manager_cloud_service, experience_manager
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html, https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CWE: CWE-79
CVE-2023-31006
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to a denial of service attacks on the DSC server.  IBM X-Force ID:  254776.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: security_verify_access, security_verify_access_docker
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254776, https://www.ibm.com/support/pages/node/7106586, http://seclists.org/fulldisclosure/2024/Nov/0
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2023-3059
A vulnerability, which was classified as critical, was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /admin/update_s6.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230565 was assigned to this vulnerability.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: online_exam_form_submission
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/Aiiimer/requestCVE/blob/main/SQL.md, https://vuldb.com/?ctiid.230565, https://vuldb.com/?id.230565
CWE: CWE-89
CVE-2023-42956
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2. Processing web content may lead to a denial-of-service.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products: ipados, iphone_os, safari, macos
References: http://www.openwall.com/lists/oss-security/2024/03/26/1, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXLXIOAH5S7J22LJTCIAVFVVJ4TESAX4/, https://support.apple.com/en-us/HT214035
CVE-2023-28673
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products: octoperf_load_testing
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(3), https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(3)
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-39508
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0

This issue affects Apache Airflow: before 2.6.0.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: airflow
Related CWEs: CWE-200, CWE-250
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://seclists.org/fulldisclosure/2023/Jul/43, https://github.com/apache/airflow/pull/29706, https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15
CWE: CWE-200, CWE-250
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2023-46928
GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl /afltest/gpac/src/media_tools/isom_tools.c:3293:42.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products: gpac
Related CWEs: CWE-787
References: https://github.com/gpac/gpac/commit/0753bf6d867343a80a044bf47a27d0b7accc8bf1, https://github.com/gpac/gpac/issues/2661, https://github.com/gpac/gpac/commit/0753bf6d867343a80a044bf47a27d0b7accc8bf1
CWE: CWE-787
CVE-2023-44830
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the EndTime parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: dir-823g, dir-823g_firmware
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_EndTime, https://www.dlink.com/en/security-bulletin/, https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_EndTime
CWE: CWE-120
CVE-2023-0204
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can cause improper handling of exceptional conditions, which may lead to denial of service.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Affected Products: connectx-6, connectx_firmware, connectx-5, connectx-6-dx
Related CWEs: CWE-755, CWE-703
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5459, https://nvidia.custhelp.com/app/answers/detail/a_id/5459
CWE: CWE-755, CWE-703
CVE-2023-25364
Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://docs.opswat.com/mdcore/release-notes/archived-release-notes#version-v521, https://docs.opswat.com/mdcore/release-notes/archived-release-notes#version-v521
CWE: CWE-79
CVE-2023-0337
Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: daloradius
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/lirantal/daloradius/commit/e77a769c7503e63a2e3c05262cb5f8f81a4a7bbe, https://huntr.dev/bounties/1c50a5a5-3f55-4b6f-b861-4d5cdb6eb81b, https://github.com/lirantal/daloradius/commit/e77a769c7503e63a2e3c05262cb5f8f81a4a7bbe
CWE: CWE-79
CVE-2023-46780
Cross-Site Request Forgery (CSRF) vulnerability in Alter plugin <= 1.0 versions.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: alter
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/alter/wordpress-alter-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/alter/wordpress-alter-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-30803
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a crafted Y-forwarded-for header.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: next-gen_application_firewall
Related CWEs: CWE-290
Related CAPECs: CAPEC-21, CAPEC-459, CAPEC-94
MITRE ATT&CK Techniques: T1134, T1553.002, T1539
MITRE ATT&CK Tactics: T1134, T1550, T1553
References: https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4, https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/, https://vulncheck.com/advisories/sangfor-ngaf-auth-bypass
CWE: CWE-290
MITRE ATT&CK techniques: T1134, T1553.002, T1539, T1550.004, T1557, T1134.001, T1036.001, T1528
MITRE ATT&CK tactics: T1134, T1550, T1553, T1036
CVE-2023-33764
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component #/de/casting/show/detail/<ID>.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: simpleredak
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33764, https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33764
CWE: CWE-79
CVE-2023-29501
Jiyu Kukan Toku-Toku coupon App for iOS versions 3.5.0 and earlier, and Jiyu Kukan Toku-Toku coupon App for Android versions 3.5.0 and earlier are vulnerable to improper server certificate verification. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication.
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products: jiyu_kukan_toku-toku_coupon
Related CWEs: CWE-295
Related CAPECs: CAPEC-475, CAPEC-459
References: https://apps.apple.com/jp/app/%E8%87%AA%E9%81%8A%E7%A9%BA%E9%96%93%E3%81%A8%E3%81%8F%E3%81%A8%E3%81%8F%E3%82%AF%E3%83%BC%E3%83%9D%E3%83%B3/id608149604, https://jvn.jp/en/jp/JVN33836375/, https://play.google.com/store/apps/details?id=jp.runsystem
CWE: CWE-295
CVE-2023-27377
Missing authentication in the StudentPopupDetails_EmergencyContactDetails        method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: idweb
Related CWEs: CWE-287, CWE-306
Related CAPECs: CAPEC-151, CAPEC-12, CAPEC-216
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: https://www.themissinglink.com.au/security-advisories/cve-2023-27377, https://www.themissinglink.com.au/security-advisories/cve-2023-27377
CWE: CWE-287, CWE-306
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2023-41721
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.

Affected Products:
UDM
UDM-PRO
UDM-SE
UDR
UDW
 
Mitigation:
Update UniFi Network to Version 7.5.187 or later.

CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products: unifi_dream_wall, unifi_network_application, unifi_dream_router, unifi_dream_machine_pro, unifi_dream_machine_special_edition
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615, https://community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-39139
An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: archive
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://blog.ostorlab.co/zip-packages-exploitation.html, https://github.com/brendan-duncan/archive/issues/265, https://ostorlab.co/vulndb/advisory/OVE-2023-5
CWE: CWE-22
CVE-2023-25963
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected Products: js_job_manager
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/js-jobs/wordpress-js-job-manager-plugin-2-0-0-cross-site-scripting-xss?_s_id=cve, https://patchstack.com/database/vulnerability/js-jobs/wordpress-js-job-manager-plugin-2-0-0-cross-site-scripting-xss?_s_id=cve
CWE: CWE-79
CVE-2023-44086
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: tecnomatix
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf, https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CWE: CWE-125
CVE-2023-5070
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: social_media_share_buttons_\&_social_sharing_icons
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: https://plugins.trac.wordpress.org/changeset/2975574/ultimate-social-media-icons/tags/2.8.6/libs/controllers/sfsi_buttons_controller.php?old=2956446&old_path=ultimate-social-media-icons%2Ftags%2F2.8.5%2Flibs%2Fcontrollers%2Fsfsi_buttons_controller.php, https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e43c5b-a094-44ab-a8a3-52d437f0e00d?source=cve, https://plugins.trac.wordpress.org/changeset/2975574/ultimate-social-media-icons/tags/2.8.6/libs/controllers/sfsi_buttons_controller.php?old=2956446&old_path=ultimate-social-media-icons%2Ftags%2F2.8.5%2Flibs%2Fcontrollers%2Fsfsi_buttons_controller.php
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2023-1741
A vulnerability was found in jeecg-boot 3.5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file SysDictMapper.java of the component Sleep Command Handler. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224629 was assigned to this vulnerability.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Affected Products: jeecg_boot
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/private-null/report/blob/main/README.md, https://vuldb.com/?ctiid.224629, https://vuldb.com/?id.224629
CWE: CWE-89