DuyTa/cve-kgrag-db huggingface dataset:
CVE-2023-31155

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.





See SEL Service Bulletin dated 2022-11-15 for more details.



CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Affected Products: sel-3530-4_firmware, sel-3505-3_firmware, sel-2241_rtac_module_firmware, sel-3560e_firmware, sel-3530
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://selinc.com/support/security-notifications/external-reports/, https://www.nozominetworks.com/blog/, https://selinc.com/support/security-notifications/external-reports/
CWE: CWE-79
CVE-2023-39665
D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the acStack_50 parameter.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: dir-868l_firmware, dir-868l
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://github.com/Davidteeri/Bug-Report/blob/main/D-Link/DIR-868L-bufferoverflow.md, https://support.dlink.com/, https://www.dlink.com/en/security-bulletin/
CWE: CWE-120
CVE-2023-42930
This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. An app may be able to modify protected parts of the file system.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products: macos
References: https://support.apple.com/en-us/HT214036, https://support.apple.com/en-us/HT214037, https://support.apple.com/en-us/HT214038
CVE-2023-29916
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.
CVSS v3.1 Score: 4.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected Products: magic_r200_firmware
Related CWEs: CWE-787
References: https://hackmd.io/%400dayResearch/rkpbC1Jgh, https://hackmd.io/%400dayResearch/rkpbC1Jgh
CWE: CWE-787
CVE-2023-30922
In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: t612, sc9863a, t820, sc7731e, t760
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073, https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-44308
Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: digital_experience_platform
Related CWEs: CWE-601
Related CAPECs: CAPEC-178
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44308, https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44308
CWE: CWE-601
CVE-2023-40786
HKcms v2.3.0.230709 is vulnerable to Cross Site Scripting (XSS) allowing administrator cookies to be stolen.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: hkcms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://gitee.com/Hk_Cms/HkCms/issues/I7S3VC, https://www.hkcms.cn/index/index/uplogs.html, https://gitee.com/Hk_Cms/HkCms/issues/I7S3VC
CWE: CWE-79
CVE-2023-53144
In the Linux kernel, the following vulnerability has been resolved:

erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms

As the call trace shown, the root cause is kunmap incorrect pages:

 BUG: kernel NULL pointer dereference, address: 00000000
 CPU: 1 PID: 40 Comm: kworker/u5:0 Not tainted 6.2.0-rc5 #4
 Workqueue: erofs_worker z_erofs_decompressqueue_work
 EIP: z_erofs_lzma_decompress+0x34b/0x8ac
  z_erofs_decompress+0x12/0x14
  z_erofs_decompress_queue+0x7e7/0xb1c
  z_erofs_decompressqueue_work+0x32/0x60
  process_one_work+0x24b/0x4d8
  ? process_one_work+0x1a4/0x4d8
  worker_thread+0x14c/0x3fc
  kthread+0xe6/0x10c
  ? rescuer_thread+0x358/0x358
  ? kthread_complete_and_exit+0x18/0x18
  ret_from_fork+0x1c/0x28
 ---[ end trace 0000000000000000 ]---

The bug is trivial and should be fixed now.  It has no impact on
!HIGHMEM platforms.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-476
References: https://git.kernel.org/stable/c/28aea8ae6cf212a5bf3ed962b27921e2029ad754, https://git.kernel.org/stable/c/8f121dfb15f7b4ab345992ce96003eb63fd608f4, https://git.kernel.org/stable/c/fa4056781ac067b5946c6811459e1a36842047fd
CWE: CWE-476
CVE-2023-49093
HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: htmlunit
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7, https://www.htmlunit.org/changes-report.html#a3.9.0, https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2023-50275
HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: oneview
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us, https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2023-23398
Microsoft Excel Spoofing Vulnerability
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products: 365_apps, office, excel
Related CWEs: CWE-290
Related CAPECs: CAPEC-21, CAPEC-459, CAPEC-94
MITRE ATT&CK Techniques: T1134, T1553.002, T1539
MITRE ATT&CK Tactics: T1134, T1550, T1553
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23398, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23398
CWE: CWE-290
MITRE ATT&CK techniques: T1134, T1553.002, T1539, T1550.004, T1557, T1134.001, T1036.001, T1528
MITRE ATT&CK tactics: T1134, T1550, T1553, T1036
CVE-2023-27650
An issue found in APUS Group Launcher v.3.10.73 and v.3.10.88 allows a remote attacker to execute arbitrary code via the FONT_FILE parameter.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: launcher
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27650/CVE%20detail.md, https://play.google.com/store/apps/details?id=com.apusapps.launcher, https://www.apusapps.com/en/launcher
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2023-31845
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_class.php?id=.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: faculty_evaluation_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/acmglz/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-4.md, https://github.com/acmglz/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-4.md
CWE: CWE-89
CVE-2023-38933
Tenda AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6 and AC9 V3.0 V15.03.06.42_multi, and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the deviceId parameter in the formSetClientState function.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: ac7_firmware, f1203, ac9_firmware, ac10, ac6
Related CWEs: CWE-787
References: https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetClientState/README.md, https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetClientState/README.md
CWE: CWE-787
CVE-2023-4540
Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service (DoS) attack to be executed by sending a properly crafted request to the server. 
Such a request causes the program to enter an infinite loop. 

This issue affects lua-http: all versions before commit ddab283.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: lua-http
Related CWEs: CWE-755
References: https://cert.pl/en/posts/2023/09/CVE-2023-4540/, https://cert.pl/posts/2023/09/CVE-2023-4540/, https://github.com/daurnimator/lua-http/commit/ddab2835c583d45dec62680ca8d3cbde55e0bae6
CWE: CWE-755
CVE-2023-28527

IBM Informix Dynamic Server 12.10 and 14.10 cdr is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault. IBM X-Force ID: 251206.


CVSS v3.1 Score: 6.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: informix_dynamic_server, informix_dynamic_server_on_cloud_pak_for_data
Related CWEs: CWE-787, CWE-122
Related CAPECs: CAPEC-92
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/251206, https://www.ibm.com/support/pages/node/7070188, https://exchange.xforce.ibmcloud.com/vulnerabilities/251206
CWE: CWE-787, CWE-122
CVE-2023-26597
Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. See Honeywell Security Notification for recommendations on upgrading and versioning. 


CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: c300_firmware, c300
Related CWEs: CWE-400, CWE-787
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://process.honeywell.com, https://process.honeywell.com
CWE: CWE-400, CWE-787
MITRE ATT&CK techniques: T1499
CVE-2023-21359
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 Score: 4.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected Products: android
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://source.android.com/docs/security/bulletin/android-14, https://source.android.com/docs/security/bulletin/android-14
CWE: CWE-125
CVE-2023-30151
A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the `key` GET parameter.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: envoimoinscher
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://addons.prestashop.com/en/shipping-carriers/1755-boxtal-connect-turnkey-shipping-solution.html, https://help.boxtal.com/hc/fr/articles/360001342977-J-ai-besoin-du-module-PrestaShop-ancienne-version-Boxtal-Envoimoinscher-pour-mon-site, https://security.friendsofpresta.org/module/2023/06/20/envoimoinscher.html
CWE: CWE-89
CVE-2023-0133
Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to bypass main origin permission delegation via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products: chrome, android
Related CWEs: CWE-863
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html, https://crbug.com/1375132, https://security.gentoo.org/glsa/202305-10
CWE: CWE-863
CVE-2023-6705
Use after free in WebRTC in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: chrome
Related CWEs: CWE-416
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html, https://crbug.com/1505708, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/
CWE: CWE-416
CVE-2023-38159
Windows Graphics Component Elevation of Privilege Vulnerability
CVSS v3.1 Score: 7.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows_10_1809, windows_11_22h2, windows_11_21h2, windows_10_1507, windows_10_21h2
Related CWEs: CWE-362, CWE-591
Related CAPECs: CAPEC-29, CAPEC-26
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38159, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38159
CWE: CWE-362, CWE-591
CVE-2023-28218
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVSS v3.1 Score: 7.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_21h2, windows_10_20h2
Related CWEs: CWE-122
Related CAPECs: CAPEC-92
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28218, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28218
CWE: CWE-122
CVE-2023-41728
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through 2.5.


CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected Products: rescue_shortcodes
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/rescue-shortcodes/wordpress-rescue-shortcodes-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/rescue-shortcodes/wordpress-rescue-shortcodes-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-45230
EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This
 vulnerability can be exploited by an attacker to gain unauthorized 
access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
CVSS v3.1 Score: 8.3 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Affected Products: edk2
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html, http://www.openwall.com/lists/oss-security/2024/01/16/2, https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
CWE: CWE-119
CVE-2023-36813
Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information. Version 1.2.31 contains a fix for this issue.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected Products: kanboard
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/kanboard/kanboard/commit/25b93343baeaf8ad018dcd87b094e47a5c6a3e0a, https://github.com/kanboard/kanboard/releases/tag/v1.2.31, https://github.com/kanboard/kanboard/security/advisories/GHSA-9gvq-78jp-jxcx
CWE: CWE-89
CVE-2023-52360
Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products: harmonyos, emui
Related CWEs: CWE-511
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-0000001834855405, https://https://consumer.huawei.com/en/support/bulletin/2024/2/, https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-0000001834855405
CWE: CWE-511
CVE-2023-21201
In on_create_record_event of btif_sdp_server.cc, there is a possible out of bounds read due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-263545186
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: android
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://source.android.com/security/bulletin/pixel/2023-06-01, https://source.android.com/security/bulletin/pixel/2023-06-01
CWE: CWE-125
CVE-2023-47345
Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP Heartbeat message whose Recovery Time Stamp IE length is mutated to zero.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: free5gc
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://github.com/free5gc/free5gc/issues/483, https://github.com/free5gc/free5gc/issues/483
CWE: CWE-120
CVE-2023-22495
Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the authentication token (JWT), an attacker could compromise another instance of Izanami. This issue has been patched in version 1.11.0.

CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: izanami
Related CWEs: CWE-288, CWE-798
Related CAPECs: CAPEC-665, CAPEC-70, CAPEC-127
MITRE ATT&CK Techniques: T1083, T1556, T1078.001
MITRE ATT&CK Tactics: T1078, T1542, T1552
References: https://github.com/MAIF/izanami/releases/tag/v1.11.0, https://github.com/MAIF/izanami/security/advisories/GHSA-9r7j-m337-792c, https://github.com/MAIF/izanami/releases/tag/v1.11.0
CWE: CWE-288, CWE-798
MITRE ATT&CK techniques: T1083, T1556, T1078.001, T1552.001, T1211, T1542.002
MITRE ATT&CK tactics: T1078, T1542, T1552
CVE-2023-45773
In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: android
Related CWEs: CWE-787
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7b30443dac7bb9138275c909549110191bcbcae9, https://source.android.com/security/bulletin/2023-12-01, https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7b30443dac7bb9138275c909549110191bcbcae9
CWE: CWE-787
CVE-2023-51460
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: experience_manager
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html, https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html
CWE: CWE-79
CVE-2023-41228
D-Link DIR-3040 prog.cgi SetUsersSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21654.
CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: dir-3040, dir-3040_firmware
Related CWEs: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350, https://www.zerodayinitiative.com/advisories/ZDI-23-1336/, https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CWE: CWE-121, CWE-787
CVE-2023-21813
Windows Secure Channel Denial of Service Vulnerability
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_10, windows_11_22h2, windows_11_21h2
Related CWEs: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21813, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21813
CWE: CWE-126
CVE-2023-27793
An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak encoding of sensitive information.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: easyinstall
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue, https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue
CWE: CWE-269
MITRE ATT&CK techniques: T1548
CVE-2023-42009
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  265504.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: linux_kernel, infosphere_information_server, windows, aix
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265504, https://https://www.ibm.com/support/pages/node/7070755, https://exchange.xforce.ibmcloud.com/vulnerabilities/265504
CWE: CWE-79
CVE-2023-34310
Ashlar-Vellum Cobalt Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CO files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-19878.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: cobalt
Related CWEs: CWE-457
References: https://www.zerodayinitiative.com/advisories/ZDI-23-870/, https://www.zerodayinitiative.com/advisories/ZDI-23-870/
CWE: CWE-457
CVE-2023-20153
Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid Administrator privileges on the affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.
CVSS v3.1 Score: 6.0 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected Products: identity_services_engine
Related CWEs: CWE-78, CWE-77
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-2XbOg9Dg, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-2XbOg9Dg
CWE: CWE-78, CWE-77
CVE-2023-44482
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: leave_management_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://fluidattacks.com/advisories/martin/, https://projectworlds.in/, https://fluidattacks.com/advisories/martin/
CWE: CWE-89
CVE-2023-53411
In the Linux kernel, the following vulnerability has been resolved:

PM: EM: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-401
References: https://git.kernel.org/stable/c/30fee10192e1239478a0987bc7ee445d5e980d46, https://git.kernel.org/stable/c/5100c4efc30636aa48ac517dece3c3b7f84fe367, https://git.kernel.org/stable/c/84e4d4885d0ae011860fb599d50d01b8fdca2b87
CWE: CWE-401
CVE-2023-28565
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: wsa8832, ipq8070a, snapdragon_730g_firmware, mdm9250_firmware, sc8180xp-aa
Related CWEs: CWE-787, CWE-129
Related CAPECs: CAPEC-100
References: https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin, https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin
CWE: CWE-787, CWE-129
CVE-2023-45178
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 CLI is vulnerable to a denial of service when a specially crafted request is used.  IBM X-Force ID:  268073.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: db2
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/268073, https://security.netapp.com/advisory/ntap-20240112-0004/, https://www.ibm.com/support/pages/node/7087207
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-52093
An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: apex_one
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US, https://www.zerodayinitiative.com/advisories/ZDI-24-029/, https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US
CWE: CWE-269
MITRE ATT&CK techniques: T1548
CVE-2023-36505
Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24.


CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Affected Products: ninja_forms
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-contact-form-the-drag-and-drop-form-builder-for-wordpress-plugin-3-6-24-arbitrary-file-deletion-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-contact-form-the-drag-and-drop-form-builder-for-wordpress-plugin-3-6-24-arbitrary-file-deletion-vulnerability?_s_id=cve
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-29505
An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected Products: manageengine_network_configuration_manager
Related CWEs: CWE-346
Related CAPECs: CAPEC-388, CAPEC-142, CAPEC-160
MITRE ATT&CK Techniques: T1134, T1539, T1550.004
MITRE ATT&CK Tactics: T1134, T1584, T1550
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-29505, https://excellium-services.com/cert-xlm-advisory/CVE-2023-29505, https://www.manageengine.com/itom/advisory/cve-2023-29505.html
CWE: CWE-346
MITRE ATT&CK techniques: T1134, T1539, T1550.004, T1557.002, T1134.001, T1584.002, T1528
MITRE ATT&CK tactics: T1134, T1584, T1550, T1557
CVE-2023-27951
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An archive may be able to bypass Gatekeeper.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products: macos
Related CWEs: CWE-863
References: https://support.apple.com/en-us/HT213670, https://support.apple.com/en-us/HT213675, https://support.apple.com/en-us/HT213677
CWE: CWE-863
CVE-2023-25551











A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') vulnerability exists on a DCE file upload endpoint when tampering with parameters
over HTTP.



 




 

 

 Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)


CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Affected Products: struxureware_data_center_expert
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf, https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf
CWE: CWE-79
CVE-2023-49734
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2.

Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
CVSS v3.1 Score: 7.7 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Affected Products: superset
Related CWEs: CWE-863
References: http://www.openwall.com/lists/oss-security/2023/12/19/3, https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5, http://www.openwall.com/lists/oss-security/2023/12/19/3
CWE: CWE-863
CVE-2023-6993
The Custom post types, Custom Fields & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and custom post meta in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping on user supplied post meta values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 Score: 6.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3063871%40custom-post-types&new=3063871%40custom-post-types&sfp_email=&sfph_mail=, https://www.wordfence.com/threat-intel/vulnerabilities/id/2b1449a9-6c89-4dec-8107-86cf8a295025?source=cve, https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3063871%40custom-post-types&new=3063871%40custom-post-types&sfp_email=&sfph_mail=
CWE: CWE-79
CVE-2023-51605
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XML files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process.
. Was ZDI-CAN-18644.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products: saia_pg5_controls_suite
Related CWEs: CWE-611
Related CAPECs: CAPEC-221
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1854/, https://www.zerodayinitiative.com/advisories/ZDI-23-1854/
CWE: CWE-611
CVE-2023-5786
A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243592.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: geowebcache
Related CWEs: CWE-425
Related CAPECs: CAPEC-668, CAPEC-144, CAPEC-127
MITRE ATT&CK Techniques: T1565.002, T1083
MITRE ATT&CK Tactics: T1565
References: https://github.com/Qxyday/GeoServe---unauthorized, https://vuldb.com/?ctiid.243592, https://vuldb.com/?id.243592
CWE: CWE-425
MITRE ATT&CK techniques: T1565.002, T1083
MITRE ATT&CK tactics: T1565
CVE-2023-48694
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference and type confusion vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host class, related to device linked classes, ASIX, Prolific, SWAR, audio, CDC ECM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: threadx_usbx
Related CWEs: CWE-825, CWE-843
References: https://github.com/azure-rtos/usbx/security/advisories/GHSA-qjw8-7w86-44qj, https://github.com/azure-rtos/usbx/security/advisories/GHSA-qjw8-7w86-44qj
CWE: CWE-825, CWE-843
CVE-2023-31101
Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0.  Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick  https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836  to solve it.



CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: inlong
Related CWEs: CWE-1188
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://lists.apache.org/thread/shvwwr6toqz5rr39rwh4k03z08sh9jmr, https://lists.apache.org/thread/shvwwr6toqz5rr39rwh4k03z08sh9jmr
CWE: CWE-1188
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-0856
Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: i-sensys_lbp633cdw_firmware, i-sensys_mf746cx, pixma_g4270, mf644cdw_firmware, lbp623cdw
Related CWEs: CWE-121, CWE-787
References: https://canon.jp/support/support-info/230414vulnerability-response, https://psirt.canon/advisory-information/cp2023-001/, https://www.canon-europe.com/support/product-security-latest-news/
CWE: CWE-121, CWE-787
CVE-2023-34045
VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during 
installation for the first time (the user needs to drag or copy the 
application to a folder from the '.dmg' volume) or when installing an 
upgrade. A malicious actor with local non-administrative user privileges may 
exploit this vulnerability to escalate privileges to root on the system 
where Fusion is installed or being installed for the first time.
CVSS v3.1 Score: 6.6 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected Products: fusion, mac_os_x
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: https://www.vmware.com/security/advisories/VMSA-2023-0022.html, https://www.vmware.com/security/advisories/VMSA-2023-0022.html
CWE: CWE-269
MITRE ATT&CK techniques: T1548
CVE-2023-2141
An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.

CVSS v3.1 Score: 8.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products: delmia_apriso
Related CWEs: CWE-502
Related CAPECs: CAPEC-586
References: https://www.3ds.com/vulnerability/advisories, https://www.3ds.com/vulnerability/advisories
CWE: CWE-502
CVE-2023-38187
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected Products: edge_chromium
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38187, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38187
CWE: CWE-269
MITRE ATT&CK techniques: T1548
CVE-2023-54042
In the Linux kernel, the following vulnerability has been resolved:

powerpc/64s: Fix VAS mm use after free

The refcount on mm is dropped before the coprocessor is detached.
References: https://git.kernel.org/stable/c/421cd1544480f2458042fe7f4913a2069c4d7251, https://git.kernel.org/stable/c/4e82f92c349ea603736ade1e814861c0182a55ad, https://git.kernel.org/stable/c/b4bda59b47879cce38a6ec5a01cd3cac702b5331
CVE-2023-24909
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_21h2, windows_10_20h2
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24909, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24909
CWE: CWE-190
CVE-2023-45623
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.


CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: arubaos, instantos
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt, https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt
CVE-2023-53461
In the Linux kernel, the following vulnerability has been resolved:

io_uring: wait interruptibly for request completions on exit

WHen the ring exits, cleanup is done and the final cancelation and
waiting on completions is done by io_ring_exit_work. That function is
invoked by kworker, which doesn't take any signals. Because of that, it
doesn't really matter if we wait for completions in TASK_INTERRUPTIBLE
or TASK_UNINTERRUPTIBLE state. However, it does matter to the hung task
detection checker!

Normally we expect cancelations and completions to happen rather
quickly. Some test cases, however, will exit the ring and park the
owning task stopped (eg via SIGSTOP). If the owning task needs to run
task_work to complete requests, then io_ring_exit_work won't make any
progress until the task is runnable again. Hence io_ring_exit_work can
trigger the hung task detection, which is particularly problematic if
panic-on-hung-task is enabled.

As the ring exit doesn't take signals to begin with, have it wait
interruptibly rather than uninterruptibly. io_uring has a separate
stuck-exit warning that triggers independently anyway, so we're not
really missing anything by making this switch.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/28e649dc9947e6525c95e32aa9a8e147925e3f56, https://git.kernel.org/stable/c/4826c59453b3b4677d6bf72814e7ababdea86949, https://git.kernel.org/stable/c/58e80cb68b057e974768792c34708c6957810486
CVE-2023-40528
This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6.4. An app may be able to bypass Privacy preferences.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products: tvos, iphone_os, macos, ipados, watchos
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: http://seclists.org/fulldisclosure/2024/Jan/37, https://support.apple.com/en-us/HT213936, https://support.apple.com/en-us/HT213937
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2023-42805
quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: quinn
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://github.com/quinn-rs/quinn/pull/1667, https://github.com/quinn-rs/quinn/pull/1668, https://github.com/quinn-rs/quinn/pull/1669
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-50019
An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm_UECM_Registration response.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: open5gs
Related CWEs: CWE-755, CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://github.com/open5gs/open5gs/commit/7278714133422cee46c32c7523f81ec2cecad9e2, https://github.com/open5gs/open5gs/issues/2733, https://github.com/open5gs/open5gs/commit/7278714133422cee46c32c7523f81ec2cecad9e2
CWE: CWE-755, CWE-400
MITRE ATT&CK techniques: T1499
CVE-2023-4670
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection.This issue affects Probbys: before 2.


CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: innosa_probbys
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://www.usom.gov.tr/bildirim/tr-23-0531, https://www.usom.gov.tr/bildirim/tr-23-0531
CWE: CWE-89
CVE-2023-47506
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Master slider Master Slider Pro allows SQL Injection.This issue affects Master Slider Pro: from n/a through 3.6.5.


CVSS v3.1 Score: 7.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Affected Products: master_slider
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://patchstack.com/database/vulnerability/masterslider/wordpress-master-slider-pro-plugin-3-6-5-authenticated-editor-sql-injection-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/masterslider/wordpress-master-slider-pro-plugin-3-6-5-authenticated-editor-sql-injection-vulnerability?_s_id=cve
CWE: CWE-89