DuyTa/cve-kgrag-db huggingface dataset:
CVE-2023-0386
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: debian_linux, h410c_firmware, h700s_firmware, h700s, h500s
Related CWEs: CWE-282
Related CAPECs: CAPEC-17, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1574.010
MITRE ATT&CK Tactics: T1574, T1564, T1027
WARNING: This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog
References: http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a, https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html
CWE: CWE-282
MITRE ATT&CK techniques: T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1564, T1027
CVE-2023-4198
Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: dolibarr_erp//crm
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://github.com/Dolibarr/dolibarr/commit/3065b9ca6ade988e8d7a8a8550415c0abb56b9cb#diff-7d68365a708c954051853ade884c7e97c6ff13150ee92657d6ffc8603e0f947b, https://starlabs.sg/advisories/23/23-4198, https://github.com/Dolibarr/dolibarr/commit/3065b9ca6ade988e8d7a8a8550415c0abb56b9cb#diff-7d68365a708c954051853ade884c7e97c6ff13150ee92657d6ffc8603e0f947b
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-54225
In the Linux kernel, the following vulnerability has been resolved:

net: ipa: only reset hashed tables when supported

Last year, the code that manages GSI channel transactions switched
from using spinlock-protected linked lists to using indexes into the
ring buffer used for a channel.  Recently, Google reported seeing
transaction reference count underflows occasionally during shutdown.

Doug Anderson found a way to reproduce the issue reliably, and
bisected the issue to the commit that eliminated the linked lists
and the lock.  The root cause was ultimately determined to be
related to unused transactions being committed as part of the modem
shutdown cleanup activity.  Unused transactions are not normally
expected (except in error cases).

The modem uses some ranges of IPA-resident memory, and whenever it
shuts down we zero those ranges.  In ipa_filter_reset_table() a
transaction is allocated to zero modem filter table entries.  If
hashing is not supported, hashed table memory should not be zeroed.
But currently nothing prevents that, and the result is an unused
transaction.  Something similar occurs when we zero routing table
entries for the modem.

By preventing any attempt to clear hashed tables when hashing is not
supported, the reference count underflow is avoided in this case.

Note that there likely remains an issue with properly freeing unused
transactions (if they occur due to errors).  This patch addresses
only the underflows that Google originally reported.
References: https://git.kernel.org/stable/c/50c24f0c940728792c8bdf65c1eaf6b91b3b0dcd, https://git.kernel.org/stable/c/c00af3a818cc573e10100cc6770f0e47befa1fa4, https://git.kernel.org/stable/c/e11ec2b868af2b351c6c1e2e50eb711cc5423a10
CVE-2023-51810
SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain sensitive information via a crafted request to the search parameter in the Users module.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: easydiscuss
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://easydiscuss.com, http://stackideas.com, https://github.com/Pastea/CVE-2023-51810
CWE: CWE-89
CVE-2023-45481
Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the firewallEn parameter in the function SetFirewallCfg.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: ac10, ac10_firmware
Related CWEs: CWE-121, CWE-787
References: https://github.com/l3m0nade/IOTvul/blob/master/SetFirewallCfg.md, https://github.com/l3m0nade/IOTvul/blob/master/assets/setFirewallCfg_code.png, https://github.com/l3m0nade/IOTvul/blob/master/SetFirewallCfg.md
CWE: CWE-121, CWE-787
CVE-2023-1945
Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products: thunderbird, firefox_esr
Related CWEs: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1777588, https://www.mozilla.org/security/advisories/mfsa2023-14/, https://www.mozilla.org/security/advisories/mfsa2023-15/
CWE: CWE-787
CVE-2023-48323
Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin allows Cross Site Request Forgery.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.4.


CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: awesome_support
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-wordpress-helpdesk-support-plugin-plugin-6-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-wordpress-helpdesk-support-plugin-plugin-6-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-40301
NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: ngeniuspulse
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://www.netscout.com/securityadvisories, https://www.netscout.com/securityadvisories
CWE: CWE-77
CVE-2023-42049
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20920.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products: pdf-tools, pdf-xchange_editor
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://www.tracker-software.com/support/security-bulletins.html, https://www.zerodayinitiative.com/advisories/ZDI-23-1350/, https://www.tracker-software.com/support/security-bulletins.html
CWE: CWE-125
CVE-2023-41000
GPAC through 2.2.1 has a use-after-free vulnerability in the function gf_bifs_flush_command_list in bifs/memory_decoder.c.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products: gpac
Related CWEs: CWE-416
References: https://github.com/gpac/gpac/issues/2550, https://github.com/gpac/gpac/issues/2550
CWE: CWE-416
CVE-2023-46681
Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. 2.37 and earlier allows an authenticated attacker who can access to the product's command line interface to execute an arbitrary command.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: vr-s1000_firmware, vr-s1000
Related CWEs: CWE-88
Related CAPECs: CAPEC-137, CAPEC-88, CAPEC-174
References: https://jvn.jp/en/jp/JVN23771490/, https://www.buffalo.jp/news/detail/20231225-01.html, https://jvn.jp/en/jp/JVN23771490/
CWE: CWE-88
CVE-2023-28507
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a memory-exhaustion issue, where a decompression routine will allocate increasing amounts of memory until all system memory is exhausted and the forked process crashes.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: unidata, universe, linux_kernel
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed/, https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed/
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2023-53412
In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-401
References: https://git.kernel.org/stable/c/31de0b70ae5661a407e9d578bbc41de2d83ac25d, https://git.kernel.org/stable/c/a91c99b1fe5c6f7e52fb932ad9e57ec7cfe913ec, https://git.kernel.org/stable/c/b0a2663ecbe8f65cd3bab2b34dd90156ceb0dbb8
CWE: CWE-401
CVE-2023-0815
Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization's private networks and should not be directly accessible
from the Internet.







CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products: horizon, meridian
Related CWEs: CWE-532
Related CAPECs: CAPEC-215
References: https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13, https://github.com/OpenNMS/opennms/pull/5741/files, https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13
CWE: CWE-532
CVE-2023-33031
Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: sm4350, qcm8550_firmware, sdm845, sd865_5g_firmware, snapdragon_x12_lte_modem
Related CWEs: CWE-787, CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin, https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CWE: CWE-787, CWE-120
CVE-2023-40019
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.10, FreeSWITCH allows authorized users to cause a denial of service attack by sending re-INVITE with SDP containing duplicate codec names. When a call in FreeSWITCH completes codec negotiation, the `codec_string` channel variable is set with the result of the negotiation. On a subsequent re-negotiation, if an SDP is offered that contains codecs with the same names but with different formats, there may be too many codec matches detected by FreeSWITCH leading to overflows of its internal arrays. By abusing this vulnerability, an attacker is able to corrupt stack of FreeSWITCH leading to an undefined behavior of the system or simply crash it. Version 1.10.10 contains a patch for this issue.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: freeswitch
Related CWEs: CWE-770
Related CAPECs: CAPEC-493, CAPEC-488, CAPEC-489
MITRE ATT&CK Techniques: T1498.002, T1499, T1498.001
MITRE ATT&CK Tactics: T1498, T1499
References: https://github.com/signalwire/freeswitch/releases/tag/v1.10.10, https://github.com/signalwire/freeswitch/security/advisories/GHSA-gjj5-79p2-9g3q, https://github.com/signalwire/freeswitch/releases/tag/v1.10.10
CWE: CWE-770
MITRE ATT&CK techniques: T1498.002, T1499, T1498.001, T1499.001, T1499.002, T1499.003
MITRE ATT&CK tactics: T1498, T1499
CVE-2023-3945
A vulnerability was found in phpscriptpoint Lawyer 1.6. It has been classified as problematic. This affects an unknown part of the file search.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235401 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 Score: 3.5 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: lawyer
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://vuldb.com/?ctiid.235401, https://vuldb.com/?id.235401, https://vuldb.com/?ctiid.235401
CWE: CWE-79
CVE-2023-2034
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: froxlor
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://github.com/froxlor/froxlor/commit/f36bc61fc74c85a21c8d31448198b11f96eb3bc6, https://huntr.dev/bounties/aba6beaa-570e-4523-8128-da4d8e374ef6, https://github.com/froxlor/froxlor/commit/f36bc61fc74c85a21c8d31448198b11f96eb3bc6
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-27489
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code could execute. This vulnerability has been fixed by configuring Kiwi TCMS to serve with the Content-Security-Policy HTTP header which blocks inline JavaScript in all modern browsers. This configuration change is provided in version 12.1 and users are advised to upgrade. Users unable to upgrade may set their Content-Security-Policy HTTP header manually.
CVSS v3.1 Score: 7.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Affected Products: kiwi_tcms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/kiwitcms/Kiwi/commit/6617cee0fb70cc394b7be6bbc86ef84e6e9de077, https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j, https://github.com/kiwitcms/Kiwi/commit/6617cee0fb70cc394b7be6bbc86ef84e6e9de077
CWE: CWE-79
CVE-2023-24555
A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: solid_edge_se2022, solid_edge_se2023
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf, https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CWE: CWE-125
CVE-2023-6362
A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. This vulnerability consists of a buffer overflow controlling the Structured Exception Handler (SEH) registers. This could allow attackers to execute arbitrary code via a long filename argument.
CVSS v3.1 Score: 7.3 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-winhex
CWE: CWE-119
CVE-2023-44360
Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products: macos, acrobat_reader, acrobat_reader_dc, acrobat, acrobat_dc
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm, https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CWE: CWE-125
CVE-2023-44764
A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: concrete_cms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes, https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Site_Installation, https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes
CWE: CWE-79
CVE-2023-35730
D-Link DAP-2622 DDP Reset Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20057.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: dap-2622, dap-2622_firmware
Related CWEs: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349, https://www.zerodayinitiative.com/advisories/ZDI-23-1236/, https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CWE: CWE-121, CWE-787
CVE-2023-37913
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versions 14.10.8 and 15.3-rc-1, triggering the office converter with a specially crafted file name allows writing the attachment's content to an attacker-controlled location on the server as long as the Java process has write access to that location. In particular in the combination with attachment moving, a feature introduced in XWiki 14.0, this is easy to reproduce but it also possible to reproduce in versions as old as XWiki 3.5 by uploading the attachment through the REST API which doesn't remove `/` or `\` from the filename. As the mime type of the attachment doesn't matter for the exploitation, this could e.g., be used to replace the `jar`-file of an extension which would allow executing arbitrary Java code and thus impact the confidentiality, integrity and availability of the XWiki installation. This vulnerability has been patched in XWiki 14.10.8 and 15.3RC1. There are no known workarounds apart from disabling the office converter.
CVSS v3.1 Score: 9.9 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products: xwiki
Related CWEs: CWE-22, CWE-23
Related CAPECs: CAPEC-78, CAPEC-139, CAPEC-126
References: https://github.com/xwiki/xwiki-platform/commit/45d182a4141ff22f3ff289cf71e4669bdc714544, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vcvr-v426-3m3m, https://jira.xwiki.org/browse/XWIKI-20715
CWE: CWE-22, CWE-23
CVE-2023-24461

An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v3.1 Score: 7.4 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products: windows, big-ip_access_policy_manager, macos
Related CWEs: CWE-295
Related CAPECs: CAPEC-475, CAPEC-459
References: https://my.f5.com/manage/s/article/K000132539, https://my.f5.com/manage/s/article/K000132539
CWE: CWE-295
CVE-2023-6931
A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.

A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().

We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel, debian_linux
Related CWEs: CWE-787
References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=382c27f4ed28f803b1f1473ac2d8db0afc795a1b, https://kernel.dance/382c27f4ed28f803b1f1473ac2d8db0afc795a1b, https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CWE: CWE-787
CVE-2023-41292
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later
QuTScloud c5.1.5.2651 and later

CVSS v3.1 Score: 3.8 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Affected Products: qutscloud, qts, quts_hero
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://www.qnap.com/en/security-advisory/qsa-23-46, https://www.qnap.com/en/security-advisory/qsa-23-46
CWE: CWE-120
CVE-2023-44233
Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected Products: foogallery
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/foogallery/wordpress-foogallery-plugin-2-2-44-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/foogallery/wordpress-foogallery-plugin-2-2-44-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-35670
In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private directories due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: android
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db3c69afcb0a45c8aa2f333fcde36217889899fe, https://source.android.com/security/bulletin/2023-09-01, https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db3c69afcb0a45c8aa2f333fcde36217889899fe
CWE: CWE-22
CVE-2023-54158
In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't free qgroup space unless specified

Boris noticed in his simple quotas testing that he was getting a leak
with Sweet Tea's change to subvol create that stopped doing a
transaction commit.  This was just a side effect of that change.

In the delayed inode code we have an optimization that will free extra
reservations if we think we can pack a dir item into an already modified
leaf.  Previously this wouldn't be triggered in the subvolume create
case because we'd commit the transaction, it was still possible but
much harder to trigger.  It could actually be triggered if we did a
mkdir && subvol create with qgroups enabled.

This occurs because in btrfs_insert_delayed_dir_index(), which gets
called when we're adding the dir item, we do the following:

  btrfs_block_rsv_release(fs_info, trans->block_rsv, bytes, NULL);

if we're able to skip reserving space.

The problem here is that trans->block_rsv points at the temporary block
rsv for the subvolume create, which has qgroup reservations in the block
rsv.

This is a problem because btrfs_block_rsv_release() will do the
following:

  if (block_rsv->qgroup_rsv_reserved >= block_rsv->qgroup_rsv_size) {
	  qgroup_to_release = block_rsv->qgroup_rsv_reserved -
		  block_rsv->qgroup_rsv_size;
	  block_rsv->qgroup_rsv_reserved = block_rsv->qgroup_rsv_size;
  }

The temporary block rsv just has ->qgroup_rsv_reserved set,
->qgroup_rsv_size == 0.  The optimization in
btrfs_insert_delayed_dir_index() sets ->qgroup_rsv_reserved = 0.  Then
later on when we call btrfs_subvolume_release_metadata() which has

  btrfs_block_rsv_release(fs_info, rsv, (u64)-1, &qgroup_to_release);
  btrfs_qgroup_convert_reserved_meta(root, qgroup_to_release);

qgroup_to_release is set to 0, and we do not convert the reserved
metadata space.

The problem here is that the block rsv code has been unconditionally
messing with ->qgroup_rsv_reserved, because the main place this is used
is delalloc, and any time we call btrfs_block_rsv_release() we do it
with qgroup_to_release set, and thus do the proper accounting.

The subvolume code is the only other code that uses the qgroup
reservation stuff, but it's intermingled with the above optimization,
and thus was getting its reservation freed out from underneath it and
thus leaking the reserved space.

The solution is to simply not mess with the qgroup reservations if we
don't have qgroup_to_release set.  This works with the existing code as
anything that messes with the delalloc reservations always have
qgroup_to_release set.  This fixes the leak that Boris was observing.
References: https://git.kernel.org/stable/c/04ff6bd0317735791ef3e443c7c89f3c0dda548d, https://git.kernel.org/stable/c/148b16cd30b202999ec5b534e3e5d8ab4b766f21, https://git.kernel.org/stable/c/15e877e5923ec6d6caa5e447dcc4b79a8ff7cc53
CVE-2023-32428
This issue was addressed with improved file handling. This issue is fixed in macOS Ventura 13.4, tvOS 16.5, iOS 16.5 and iPadOS 16.5, watchOS 9.5. An app may be able to gain root privileges.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: tvos, iphone_os, macos, ipados, watchos
References: https://support.apple.com/en-us/HT213757, https://support.apple.com/en-us/HT213758, https://support.apple.com/en-us/HT213761
CVE-2023-40050
Upload profile either
through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec
check command with maliciously crafted profile allows remote code execution. 












CVSS v3.1 Score: 9.9 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products: automate
Related CWEs: CWE-94, CWE-434
Related CAPECs: CAPEC-242, CAPEC-1, CAPEC-77
MITRE ATT&CK Techniques: T1574.010, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1564, T1027
References: https://community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Automate-CVE-2023-40050, https://docs.chef.io/automate/profiles/, https://docs.chef.io/release_notes_automate/
CWE: CWE-94, CWE-434
MITRE ATT&CK techniques: T1574.010, T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1574, T1564, T1027
CVE-2023-40483
Maxon Cinema 4D SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21431.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: cinema_4d
Related CWEs: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1185/, https://www.zerodayinitiative.com/advisories/ZDI-23-1185/
CWE: CWE-787
CVE-2023-39479
Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability. This vulnerability allows remote attackers to create directories on affected installations of Softing Secure Integration Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the handling of FileDirectory OPC UA Objects. The issue results from allowing unauthorized access to the filesystem. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20548.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: secure_integration_server
Related CWEs: CWE-552
Related CAPECs: CAPEC-150, CAPEC-639
MITRE ATT&CK Techniques: T1552.006, T1602, T1555
MITRE ATT&CK Tactics: T1552
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1061/, https://www.zerodayinitiative.com/advisories/ZDI-23-1061/
CWE: CWE-552
MITRE ATT&CK techniques: T1552.006, T1602, T1555, T1213, T1039, T1119, T1552.001, T1003, T1530, T1552.004, T1552.003
MITRE ATT&CK tactics: T1552
CVE-2023-38560
An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products: ghostscript
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: https://access.redhat.com/security/cve/CVE-2023-38560, https://bugs.ghostscript.com/show_bug.cgi?id=706898, https://bugzilla.redhat.com/show_bug.cgi?id=2224368
CWE: CWE-190
CVE-2023-30756
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-7 LTE (All versions < V3.5.20), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.5.20), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMATIC WinCC Runtime Advanced (All versions), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). The web server of the affected devices do not properly handle certain errors when using the Expect HTTP request header, resulting in NULL dereference.

This could allow a remote attacker with no privileges to cause a denial of service condition in the system.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Related CWEs: CWE-476
References: https://cert-portal.siemens.com/productcert/html/ssa-423808.html
CWE: CWE-476
CVE-2023-32051
Raw Image Extension Remote Code Execution Vulnerability
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: windows_11_22h2, windows_11_21h2, raw_image_extension, windows_10_21h2, windows_10_22h2
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32051, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32051
CWE: CWE-190
CVE-2023-49473
Shenzhen JF6000 Cloud Media Collaboration Processing Platform firmware version V1.2.0 and software version V2.0.0 build 6245 is vulnerable to Incorrect Access Control.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://github.com/Hack404-007/cves-info/blob/main/JF6000-exp, https://github.com/Hack404-007/cves-info/blob/main/JF6000-exp
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-38118
Foxit PDF Reader AcroForm Doc Object Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21325.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: windows, pdf_editor, pdf_reader
Related CWEs: CWE-787
References: https://www.foxit.com/support/security-bulletins.html, https://www.zerodayinitiative.com/advisories/ZDI-23-996/, https://www.foxit.com/support/security-bulletins.html
CWE: CWE-787
CVE-2023-38516
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <= 1.2.2 versions.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected Products: audio_player_with_playlist_ultimate
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/audio-player-with-playlist-ultimate/wordpress-audio-player-with-playlist-ultimate-plugin-1-2-2-cross-site-scripting-xss?_s_id=cve, https://patchstack.com/database/vulnerability/audio-player-with-playlist-ultimate/wordpress-audio-player-with-playlist-ultimate-plugin-1-2-2-cross-site-scripting-xss?_s_id=cve
CWE: CWE-79
CVE-2023-4447
A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. This vulnerability affects unknown code of the file admin/article-chat.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237568.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: rapidcms
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/OpenRapid/rapidcms/issues/4, https://vuldb.com/?ctiid.237568, https://vuldb.com/?id.237568
CWE: CWE-89
CVE-2023-0561
A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-219702 is the identifier assigned to this vulnerability.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: online_tours_\&_travels_management_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/_user_s_id.md, https://vuldb.com/?ctiid.219702, https://vuldb.com/?id.219702
CWE: CWE-89
CVE-2023-20056
A vulnerability in the management CLI of Cisco access point (AP) software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command. A successful exploit could allow the attacker to cause an affected device to reload spontaneously, resulting in a DoS condition.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Affected Products: catalyst_9117_ap, ios_xe, aironet_1540, catalyst_9117ax, aironet_1815w
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-cli-dos-tc2EKEpu, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-cli-dos-tc2EKEpu
CWE: CWE-78
CVE-2023-3356
The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: subscribers_text_counter
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://wpscan.com/vulnerability/93faad5b-e1e8-4e49-b19e-b91343d68b51, https://wpscan.com/vulnerability/93faad5b-e1e8-4e49-b19e-b91343d68b51
CWE: CWE-352
CVE-2023-36918
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads to Cross-Site Scripting, which could result in disclosure or modification of information.


CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: enable_now
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://launchpad.support.sap.com/#/notes/3326769, https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html, https://launchpad.support.sap.com/#/notes/3326769
CWE: CWE-79
CVE-2023-20659
In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07588413; Issue ID: ALPS07588413.
CVSS v3.1 Score: 6.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: mt7921, mt6895, mt8169, mt6781, yocto
Related CWEs: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/April-2023, https://corp.mediatek.com/product-security-bulletin/April-2023
CWE: CWE-787
CVE-2023-25146
A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete the original folder and replace with a junction to an arbitrary location, ultimately leading to an arbitrary file dropped to an arbitrary location.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: apex_one, windows
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: https://success.trendmicro.com/solution/000292209, https://www.zerodayinitiative.com/advisories/ZDI-23-172/, https://success.trendmicro.com/solution/000292209
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2023-28623
Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only ones enabled in `AUTHENTICATION_BACKENDS` in `/etc/zulip/settings.py` and 2: The organization permissions don't require invitations to join. An attacker can create a new account in the organization with an arbitrary email address in their control that's not in the organization's LDAP directory. The impact is limited to installations which have this specific combination of authentication backends as described above in addition to having `Invitations are required for joining this organization` organization permission disabled. This issue has been addressed in version 6.2. Users are advised to upgrade. Users unable to upgrade may enable the `Invitations are required for joining this organization` organization permission to prevent this issue.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected Products: zulip
Related CWEs: CWE-862, CWE-285
Related CAPECs: CAPEC-13, CAPEC-668, CAPEC-17
MITRE ATT&CK Techniques: T1574.006, T1565.002, T1556
MITRE ATT&CK Tactics: T1134, T1542, T1550
References: https://github.com/zulip/zulip/commit/3df1b4dd7c210c21deb6f829df19412b74573f8d, https://github.com/zulip/zulip/security/advisories/GHSA-7p62-pjwg-56rv, https://github.com/zulip/zulip/commit/3df1b4dd7c210c21deb6f829df19412b74573f8d
CWE: CWE-862, CWE-285
MITRE ATT&CK techniques: T1574.006, T1565.002, T1556, T1005, T1574.007, T1083, T1550.004, T1574.005, T1134.001, T1574.010, T1012, T1562.003, T1211, T1542.002, T1552.002
MITRE ATT&CK tactics: T1134, T1542, T1550, T1565, T1552, T1562, T1574
CVE-2023-36237
Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: bagisto
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://github.com/Ek-Saini/security/blob/main/CSRF-Bagisto, https://github.com/Ek-Saini/security/blob/main/CSRF-Bagisto
CWE: CWE-352
CVE-2023-29854
DirCMS 6.0.0 has a Cross Site Scripting (XSS) vulnerability in the foreground.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: dircms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/secflag/Vulnerabilitys/blob/main/DirCMS_V6.0.0_XSS_vulnerability.md, https://github.com/secflag/Vulnerabilitys/blob/main/DirCMS_V6.0.0_XSS_vulnerability.md
CWE: CWE-79
CVE-2023-21858
Vulnerability in the Oracle Collaborative Planning product of Oracle E-Business Suite (component: Installation).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Collaborative Planning.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Collaborative Planning accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products: collaborative_planning
References: https://www.oracle.com/security-alerts/cpujan2023.html, https://www.oracle.com/security-alerts/cpujan2023.html
CVE-2023-2967
The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products: tinymce_custom_styles
References: https://wpscan.com/vulnerability/9afec4aa-1210-4c40-b566-64e37acf2b64, https://wpscan.com/vulnerability/9afec4aa-1210-4c40-b566-64e37acf2b64
CVE-2023-36519
Missing Authorization vulnerability in wpthemego SW Product Bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SW Product Bundles: from n/a through 2.0.15.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/wordpress/plugin/sw-product-bundles/vulnerability/wordpress-sw-product-bundles-plugin-2-0-15-broken-access-control?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-50877
Missing Authorization vulnerability in woobewoo Product Filter by WBW allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Filter by WBW: from n/a through 2.5.0.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-2-5-0-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542