DuyTa/cve-kgrag-db huggingface dataset:
CVE-2023-36810
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1 Score: 6.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: pypdf
Related CWEs: CWE-407
References: https://github.com/py-pdf/pypdf/issues/582, https://github.com/py-pdf/pypdf/pull/808, https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw
CWE: CWE-407
CVE-2023-26510
Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this behavior has no security impact.
CVSS v3.1 Score: 5.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected Products: ghost
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://ghost.org/docs/security/, https://gist.github.com/yurahod/2e11eabbe4b92ef1d44b08e37023ecfb, https://gist.github.com/yurahod/828d5e6a077c12f3f74c6485d1c7f0e7
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-35171
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available.
CVSS v3.1 Score: 4.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Affected Products: nextcloud_server
Related CWEs: CWE-601
Related CAPECs: CAPEC-178
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h353-vvwv-j2r4, https://github.com/nextcloud/server/pull/38194, https://hackerone.com/reports/1977222
CWE: CWE-601
CVE-2023-2957
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisa Software Florist Site allows SQL Injection.This issue affects Florist Site: before 3.0.


CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: florist_site
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://www.usom.gov.tr/bildirim/tr-23-0403, https://www.usom.gov.tr/bildirim/tr-23-0403
CWE: CWE-89
CVE-2023-1848
A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/attendance_row.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224988.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: online_payroll_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Payroll%20System%20in%20PHP%20and%20MySQL%20Free%20Download%20A%20Comprehensive%20Guide/Online%20Payroll%20System%20in%20PHP%20and%20MySQL%20Free%20Download%20A%20Comprehensive%20Guide%20-%20vlun%203.pdf, https://vuldb.com/?ctiid.224988, https://vuldb.com/?id.224988
CWE: CWE-89
CVE-2023-1767
The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: advisor
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://support.snyk.io/hc/en-us/articles/10146704933405, https://weizman.github.io/2023/04/10/snyk-xss/, https://support.snyk.io/hc/en-us/articles/10146704933405
CWE: CWE-79
CVE-2023-27160
forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /articles/{id}. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: forem
Related CWEs: CWE-918
Related CAPECs: CAPEC-664
References: http://forem.com, https://gist.github.com/b33t1e/6172286862a4486b5888f3cbbdc6316d, https://github.com/forem/forem
CWE: CWE-918
CVE-2023-45906
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: dreamer_cms
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20in%20the%20user%20added%20function.md, https://github.com/moonsabc123/dreamer_cms/blob/main/There%20is%20a%20csrf%20in%20the%20user%20added%20function.md
CWE: CWE-352
CVE-2023-49543
Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenticating.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: book_store_management_system
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://github.com/geraldoalcantara/CVE-2023-49543, https://owasp.org/Top10/A01_2021-Broken_Access_Control/, https://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-27852
NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a buffer overflow vulnerability in various CGI mechanisms that could allow an attacker to execute arbitrary code on the device.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: rax30_firmware, rax30
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://tenable.com/security/research/tra-2023-9, https://tenable.com/security/research/tra-2023-9
CWE: CWE-120
CVE-2023-40671
Cross-Site Request Forgery (CSRF) vulnerability in 大侠wp DX-auto-save-images plugin <= 1.4.0 versions.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: dx-auto-save-images
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/dx-auto-save-images/wordpress-dx-auto-save-images-plugin-1-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/dx-auto-save-images/wordpress-dx-auto-save-images-plugin-1-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-38054
A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation.
CVSS v3.1 Score: 9.9 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products: easyappointments
Related CWEs: CWE-639
References: https://github.com/alextselegidis/easyappointments, https://github.com/alextselegidis/easyappointments
CWE: CWE-639
CVE-2023-22043
Vulnerability in Oracle Java SE (component: JavaFX).   The supported version that is affected is Oracle Java SE: 8u371. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products: jre, jdk
References: https://security.netapp.com/advisory/ntap-20230725-0006/, https://www.oracle.com/security-alerts/cpujul2023.html, https://security.netapp.com/advisory/ntap-20230725-0006/
CVE-2023-0346
Akuvox E11 cloud login is performed through an unencrypted HTTP connection. An attacker could gain access to the Akuvox cloud and device if the MAC address of a device if known.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: e11_firmware, e11
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01, https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE-2023-37897
Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.


CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: grav
Related CWEs: CWE-393, CWE-74
Related CAPECs: CAPEC-53, CAPEC-51, CAPEC-9
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b, https://github.com/getgrav/grav/commit/b4c62101a43051fc7f5349c7d0a5b6085375c1d7, https://github.com/getgrav/grav/security/advisories/GHSA-9436-3gmp-4f53
CWE: CWE-393, CWE-74
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2023-33798
A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: netbox
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/anhdq201/netbox/issues/13, https://github.com/anhdq201/netbox/issues/13
CWE: CWE-79
CVE-2023-32039
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_21h2, windows_10_1507
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32039, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32039
CWE: CWE-125
CVE-2023-45883
A privilege escalation vulnerability exists within the Qumu Multicast Extension v2 before 2.0.63 for Windows. When a standard user triggers a repair of the software, a pop-up window opens with SYSTEM privileges. Standard users may use this to gain arbitrary code execution as SYSTEM.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows, qumu
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: https://hackandpwn.com/disclosures/CVE-2023-45883.pdf, https://www.vidyo.com/enterprise-video-management/qumu, https://hackandpwn.com/disclosures/CVE-2023-45883.pdf
CWE: CWE-269
MITRE ATT&CK techniques: T1548
CVE-2023-35314
Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_21h2, windows_10_1507
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35314, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35314
CWE: CWE-125
CVE-2023-36210
MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keyword parameter.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: motocms
Related CWEs: CWE-74
Related CAPECs: CAPEC-53, CAPEC-51, CAPEC-9
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: https://vulners.com/zdt/1337DAY-ID-38750, https://www.exploit-db.com/exploits/51499, https://vulners.com/zdt/1337DAY-ID-38750
CWE: CWE-74
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2023-42697
In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: t612, sc9863a, t820, sc7731e, t760
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049, https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-52481
In the Linux kernel, the following vulnerability has been resolved:

arm64: errata: Add Cortex-A520 speculative unprivileged load workaround

Implement the workaround for ARM Cortex-A520 erratum 2966298. On an
affected Cortex-A520 core, a speculatively executed unprivileged load
might leak data from a privileged load via a cache side channel. The
issue only exists for loads within a translation regime with the same
translation (e.g. same ASID and VMID). Therefore, the issue only affects
the return to EL0.

The workaround is to execute a TLBI before returning to EL0 after all
loads of privileged data. A non-shareable TLBI to any address is
sufficient.

The workaround isn't necessary if page table isolation (KPTI) is
enabled, but for simplicity it will be. Page table isolation should
normally be disabled for Cortex-A520 as it supports the CSV3 feature
and the E0PD feature (used when KASLR is enabled).
CVSS v3.1 Score: 4.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/32b0a4ffcaea44a00a61e40c0d1bcc50362aee25, https://git.kernel.org/stable/c/471470bc7052d28ce125901877dd10e4c048e513, https://git.kernel.org/stable/c/6e3ae2927b432a3b7c8374f14dbc1bd9ebe4372c
CVE-2023-25496
A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to execute code with elevated privileges.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: drivers_management
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://iknow.lenovo.com.cn/detail/dc_415202.html, https://iknow.lenovo.com.cn/detail/dc_415202.html
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-26941
Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products: yale_conexis_l1_firmware, yale_conexis_l1
Related CWEs: CWE-326
Related CAPECs: CAPEC-112, CAPEC-192, CAPEC-20
MITRE ATT&CK Techniques: T1110
References: https://arxiv.org/abs/2312.00021, https://www.researchgate.net/publication/375759408_Technical_Report_-_CVE-2022-46480_CVE-2023-26941_CVE-2023-26942_and_CVE-2023-26943#fullTextFileContent, https://arxiv.org/abs/2312.00021
CWE: CWE-326
MITRE ATT&CK techniques: T1110
CVE-2023-32421
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to observe unprotected user data.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products: macos
References: http://seclists.org/fulldisclosure/2023/Oct/3, https://support.apple.com/en-us/HT213940, http://seclists.org/fulldisclosure/2023/Oct/3
CVE-2023-44476
Cross-Site Request Forgery (CSRF) vulnerability in Andres Felipe Perea V. CopyRightPro plugin <= 2.1 versions.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: wp-copyrightpro
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/copyrightpro/wordpress-copyrightpro-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/copyrightpro/wordpress-copyrightpro-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-37625
A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Link templates.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: netbox
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/benjaminpsinclair/Netbox-CVE, https://github.com/benjaminpsinclair/Netbox-CVE-2023-37625, https://github.com/netbox-community/netbox/issues/12205
CWE: CWE-79
CVE-2023-4865
A vulnerability has been found in SourceCodester Take-Note App 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239350 is the identifier assigned to this vulnerability.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: take-note_app
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://skypoc.wordpress.com/2023/09/05/sourcecodester-take-note-app-v1-0-has-multiple-vulnerabilities/, https://vuldb.com/?ctiid.239350, https://vuldb.com/?id.239350
CWE: CWE-352
CVE-2023-32265

A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server.
An attacker would need to be authenticated into ESCWA to attempt to exploit this vulnerability. As described in the hardening guide in the product documentation, other mitigations including restricting network access to ESCWA and restricting usersâ€™ permissions in the Micro Focus Directory Server also reduce the exposure to this issue.

Given the right conditions this vulnerability could be exploited to expose a service account password. The account corresponding to the exposed credentials usually has limited privileges and, in many cases would only be useful for extracting details of other user accounts and similar information.


CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected Products: enterprise_test_server, enterprise_server, cobol_server, enterprise_developer, visual_cobol
References: https://portal.microfocus.com/s/article/KM000019323?language=en_US, https://portal.microfocus.com/s/article/KM000019323?language=en_US
CVE-2023-28319
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: clustered_data_ontap, h700s_firmware, macos, h500s, h700s
Related CWEs: CWE-416
References: http://seclists.org/fulldisclosure/2023/Jul/47, http://seclists.org/fulldisclosure/2023/Jul/48, http://seclists.org/fulldisclosure/2023/Jul/52
CWE: CWE-416
CVE-2023-6270
A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.
CVSS v3.1 Score: 7.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel, debian_linux, fedora
Related CWEs: CWE-416
References: https://access.redhat.com/security/cve/CVE-2023-6270, https://bugzilla.redhat.com/show_bug.cgi?id=2256786, https://access.redhat.com/security/cve/CVE-2023-6270
CWE: CWE-416
CVE-2023-5860
The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: icons_font_loader
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://plugins.trac.wordpress.org/changeset/2987296/icons-font-loader, https://www.wordfence.com/threat-intel/vulnerabilities/id/12a9fbe8-445a-478a-b6ce-cd669ccb6a2d?source=cve, https://plugins.trac.wordpress.org/changeset/2987296/icons-font-loader
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-6948
A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service through a crafted payload triggering a missing input size check in the sdk_printf function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, compromising it in a term of availability and producing a denial-of-service attack. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.
CVSS v3.1 Score: 3.0 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6948/, https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6948/
CWE: CWE-120
CVE-2023-6293
Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Affected Products: sequelize-typescript
Related CWEs: CWE-1321
Related CAPECs: CAPEC-180, CAPEC-1, CAPEC-77
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://github.com/robinbuschmann/sequelize-typescript/commit/5ce8afdd1671b08c774ce106b000605ba8fccf78, https://huntr.com/bounties/36a7ecbf-4d3d-462e-86a3-cda7b1ec64e2, https://github.com/robinbuschmann/sequelize-typescript/commit/5ce8afdd1671b08c774ce106b000605ba8fccf78
CWE: CWE-1321
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-44808
D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: dir-820l, dir-820l_firmware
Related CWEs: CWE-787
References: https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug3.md, https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug3.md
CWE: CWE-787
CVE-2023-21059
In EUTRAN_LCS_DecodeFacilityInformationElement of LPP_LcsManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-247564044References: N/A
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: android
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://source.android.com/security/bulletin/pixel/2023-03-01, https://source.android.com/security/bulletin/pixel/2023-03-01
CWE: CWE-125
CVE-2023-42766
Improper input validation in some Intel NUC 8 Compute Element BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected Products: nuc_8_compute_element_cm8v5cb_firmware, nuc_8_compute_element_cm8v7cb, nuc_8_compute_element_cm8v5cb, nuc_8_compute_element_cm8v7cb_firmware
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01028.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01028.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-30670
Out-of-bounds Write in BuildIpcFactoryDeviceTestEvent of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS v3.1 Score: 6.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: android
Related CWEs: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=07, https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=07
CWE: CWE-787
CVE-2023-7049
The Custom Field For WP Job Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2 via the the 'cm_fieldshow' shortcode due to missing validation on the 'job_id' user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Related CWEs: CWE-639
References: https://plugins.trac.wordpress.org/changeset/3134344/custom-field-for-wp-job-manager/trunk/includes/CFWJM_Shortcode.php, https://www.wordfence.com/threat-intel/vulnerabilities/id/9891587b-2a63-41be-b79d-afe407dd57fa?source=cve
CWE: CWE-639
CVE-2023-52766
In the Linux kernel, the following vulnerability has been resolved:

i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler

Do not loop over ring headers in hci_dma_irq_handler() that are not
allocated and enabled in hci_dma_init(). Otherwise out of bounds access
will occur from rings->headers[i] access when i >= number of allocated
ring headers.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://git.kernel.org/stable/c/45a832f989e520095429589d5b01b0c65da9b574, https://git.kernel.org/stable/c/4c86cb2321bd9c72d3b945ce7f747961beda8e65, https://git.kernel.org/stable/c/7c2b91b30d74d7c407118ad72502d4ca28af1af6
CWE: CWE-125
CVE-2023-40899
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFilterCfg.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: ac8v4, ac8_firmware
Related CWEs: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/ac8/formSetMacFilterCfg/1.md, https://github.com/peris-navince/founded-0-days/blob/main/ac8/formSetMacFilterCfg/1.md
CWE: CWE-787
CVE-2023-30699
Out-of-bounds write vulnerability in parser_hvcC function of libsimba library prior to SMR Aug-2023 Release 1 allows code execution by remote attackers.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: android
Related CWEs: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08, https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CWE: CWE-787
CVE-2023-0845
Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.
CVSS v3.1 Score: 4.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected Products: consul
Related CWEs: CWE-476
References: https://discuss.hashicorp.com/t/hcsec-2023-06-consul-server-panic-when-ingress-and-api-gateways-configured-with-peering-connections/51197, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
CWE: CWE-476
CVE-2023-41657
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. HollerBox plugin <= 2.3.2 versions.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected Products: hollerbox
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/holler-box/wordpress-hollerbox-plugin-2-3-2-cross-site-scripting-xss?_s_id=cve, https://patchstack.com/database/vulnerability/holler-box/wordpress-hollerbox-plugin-2-3-2-cross-site-scripting-xss?_s_id=cve
CWE: CWE-79
CVE-2023-0333
The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: templatesnext_toolkit
References: https://wpscan.com/vulnerability/e86ff4d5-d549-4c71-b80e-6a9b3bfddbfc, https://wpscan.com/vulnerability/e86ff4d5-d549-4c71-b80e-6a9b3bfddbfc
CVE-2023-46300
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: iterm2
Related CWEs: CWE-116
Related CAPECs: CAPEC-73, CAPEC-85, CAPEC-81
References: https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce, https://github.com/gnachman/iTerm2/commit/ae8192522661c34d1cbe57f6f9ef2ff0a337c2a5, https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009
CWE: CWE-116
CVE-2023-49133
A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.This vulnerability impacts `uclited` on the EAP225(V3) 5.1.0 Build 20220926 of the AC1350 Wireless MU-MIMO Gigabit Access Point.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: eap115_firmware, eap225, eap115, eap225_firmware
Related CWEs: CWE-77, CWE-829
Related CAPECs: CAPEC-253, CAPEC-660, CAPEC-183
MITRE ATT&CK Techniques: T1195.001, T1574.006, T1505.005
MITRE ATT&CK Tactics: T1574, T1195, T1505
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1862, https://talosintelligence.com/vulnerability_reports/TALOS-2023-1862, https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1862
CWE: CWE-77, CWE-829
MITRE ATT&CK techniques: T1195.001, T1574.006, T1505.005, T1176, T1574.013, T1620, T1055, T1505.004
MITRE ATT&CK tactics: T1574, T1195, T1505
CVE-2023-28118
kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: kaml
Related CWEs: CWE-776
Related CAPECs: CAPEC-197
References: https://github.com/charleskorn/kaml/commit/5f82a2d7e00bfc307afca05d1dc4d7c50593531a, https://github.com/charleskorn/kaml/releases/tag/0.53.0, https://github.com/charleskorn/kaml/security/advisories/GHSA-c24f-2j3g-rg48
CWE: CWE-776
CVE-2023-2731
A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products: enterprise_linux, fedora, libtiff
Related CWEs: CWE-476
References: https://access.redhat.com/security/cve/CVE-2023-2731, https://bugzilla.redhat.com/show_bug.cgi?id=2207635, https://github.com/libsdl-org/libtiff/commit/9be22b639ea69e102d3847dca4c53ef025e9527b
CWE: CWE-476
CVE-2023-43267
A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title field.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: emlog
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://gist.github.com/Fliggyaaa/b61c24e828cbcfac42406be408665280, https://github.com/Fliggyaaa/xss/, https://gist.github.com/Fliggyaaa/b61c24e828cbcfac42406be408665280
CWE: CWE-79
CVE-2023-0391
MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor this has been addressed in version 2.2.1.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: cloudpanel
Related CWEs: CWE-798, CWE-321
Related CAPECs: CAPEC-191, CAPEC-70
MITRE ATT&CK Techniques: T1078.001, T1552.001
MITRE ATT&CK Tactics: T1078, T1552
References: https://www.bleepingcomputer.com/news/security/cloudpanel-installations-use-the-same-ssl-certificate-private-key/, https://www.rapid7.com/blog/post/2023/03/21/cve-2023-0391-mgt-commerce-cloudpanel-shared-certificate-vulnerability-and-weak-installation-procedures/, https://www.bleepingcomputer.com/news/security/cloudpanel-installations-use-the-same-ssl-certificate-private-key/
CWE: CWE-798, CWE-321
MITRE ATT&CK techniques: T1078.001, T1552.001
MITRE ATT&CK tactics: T1078, T1552
CVE-2023-44330
Adobe Photoshop versions 24.7.1 (and earlier) and 25.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: photoshop, windows, macos
Related CWEs: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb23-56.html, https://helpx.adobe.com/security/products/photoshop/apsb23-56.html
CWE: CWE-787
CVE-2023-38214
Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: experience_manager
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html, https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html
CWE: CWE-79
CVE-2023-29168
The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.


CVSS v3.1 Score: 3.7 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products: vuforia_studio
Related CWEs: CWE-522
Related CAPECs: CAPEC-560, CAPEC-644, CAPEC-653
MITRE ATT&CK Techniques: T1550.003, T1021.002, T1133
MITRE ATT&CK Tactics: T1110, T1114, T1558
References: https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13, https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13, https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
CWE: CWE-522
MITRE ATT&CK techniques: T1550.003, T1021.002, T1133, T1114.002, T1110.004, T1543, T1552.004, T1558.003, T1558, T1021, T1550.002, T1078
MITRE ATT&CK tactics: T1110, T1114, T1558, T1550, T1552, T1021
CVE-2023-33411
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: x13dei, x11sca-f_firmware, x11dgo-t_firmware, x11dpu-z\+_firmware, x11sch-f
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://supermicro.com, https://www.supermicro.com/en/support/security_BMC_Dec_2023, http://supermicro.com
CWE: CWE-22
CVE-2023-33839
IBM Security Verify Governance 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  IBM X-Force ID:  256036.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: security_verify_governance
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/256036, https://www.ibm.com/support/pages/node/7057377, https://exchange.xforce.ibmcloud.com/vulnerabilities/256036
CWE: CWE-78
CVE-2023-3823
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.
CVSS v3.1 Score: 8.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected Products: fedora, debian_linux, php
Related CWEs: CWE-611
Related CAPECs: CAPEC-221
References: https://github.com/php/php-src/security/advisories/GHSA-3qrf-m4j2-pcrr, https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/
CWE: CWE-611
CVE-2023-35833
An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not require the password to be (re)entered. This results in exposing cleartext credentials when connecting to a rogue LDAP server. NOTE: the vendor originally reported this as a security issue but then reconsidered because of the requirement for Admin access in order to change the configuration.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: safeq_server
Related CWEs: CWE-319
Related CAPECs: CAPEC-383, CAPEC-102, CAPEC-477
MITRE ATT&CK Techniques: T1056.004, T1040
MITRE ATT&CK Tactics: T1056
References: https://www.ysoft.com/en/legal/ldaps-encryption-downgrade-attack-vulnerability, https://ysoft.com, https://www.ysoft.com/en/legal/ldaps-encryption-downgrade-attack-vulnerability
CWE: CWE-319
MITRE ATT&CK techniques: T1056.004, T1040
MITRE ATT&CK tactics: T1056
CVE-2023-39988
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in 标准云(std.Cloud) WxSync plugin <= 2.7.23 versions.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected Products: wxsync
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/wxsync/wordpress-wxsync-plugin-2-7-23-cross-site-scripting-xss?_s_id=cve, https://patchstack.com/database/vulnerability/wxsync/wordpress-wxsync-plugin-2-7-23-cross-site-scripting-xss?_s_id=cve
CWE: CWE-79
CVE-2023-40020
PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3.1 Score: 9.9 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Affected Products: privateuploader
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: https://github.com/PrivateUploader/PrivateUploader/commit/869657d61e3c7a518177106fe63ea483082b0d3e, https://github.com/PrivateUploader/PrivateUploader/security/advisories/GHSA-vhrw-2472-rrjx, https://github.com/PrivateUploader/PrivateUploader/commit/869657d61e3c7a518177106fe63ea483082b0d3e
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2023-27211
A cross-site scripting (XSS) vulnerability in /admin/navbar.php of Online Pizza Ordering System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: online_pizza_ordering_system
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/xiumulty/CVE/blob/main/online%20pizza%20ordering%20system%20v1.0/xss%20in%20navbar.php%20.md, https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html, https://github.com/xiumulty/CVE/blob/main/online%20pizza%20ordering%20system%20v1.0/xss%20in%20navbar.php%20.md
CWE: CWE-79
CVE-2023-20029
A vulnerability in the Meraki onboarding feature of Cisco IOS XE Software could allow an authenticated, local attacker to gain root level privileges on an affected device. This vulnerability is due to insufficient memory protection in the Meraki onboarding feature of an affected device. An attacker could exploit this vulnerability by modifying the Meraki registration parameters. A successful exploit could allow the attacker to elevate privileges to root.
CVSS v3.1 Score: 4.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Affected Products: ios_xe, catalyst_9200l, catalyst_9300l-24p-4g-e, catalyst_9300-48s-a, catalyst_9300-24ux-a
Related CWEs: CWE-122
Related CAPECs: CAPEC-92
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-sABD8hcU, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-sABD8hcU
CWE: CWE-122