DuyTa/cve-kgrag-db huggingface dataset:
CVE-2023-44235
Improper Restriction of Excessive Authentication Attempts vulnerability in Devnath verma WP Captcha allows Functionality Bypass.This issue affects WP Captcha: from n/a through 2.0.0.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Related CWEs: CWE-307
Related CAPECs: CAPEC-560, CAPEC-653, CAPEC-600
MITRE ATT&CK Techniques: T1110.004, T1110.001, T1558
MITRE ATT&CK Tactics: T1110
References: https://patchstack.com/database/vulnerability/wp-captcha/wordpress-wp-captcha-plugin-2-0-0-captcha-bypass-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/wp-captcha/wordpress-wp-captcha-plugin-2-0-0-captcha-bypass-vulnerability?_s_id=cve
CWE: CWE-307
MITRE ATT&CK techniques: T1110.004, T1110.001, T1558, T1110.003, T1078
MITRE ATT&CK tactics: T1110
CVE-2023-5150
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /useratte/web.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-240246 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: dar-7000, dar-8000_firmware, dar-8000, dar-7000_firmware
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_upload_%20web.md, https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_upload_%20web.md, https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-25712
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-Buddy Google Analytics Opt-Out plugin <= 2.3.4 versions.
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected Products: google_analytics_opt-out
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/google-analytics-opt-out/wordpress-opt-out-for-google-analytics-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/google-analytics-opt-out/wordpress-opt-out-for-google-analytics-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-46349
In the module "Product Catalog (CSV, Excel) Export/Update" (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `productsUpdateModel::getExportIds()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: updateproducts
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://security.friendsofpresta.org/modules/2023/11/23/updateproducts.html, https://security.friendsofpresta.org/modules/2023/11/23/updateproducts.html
CWE: CWE-89
CVE-2023-51925
An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: yonbip
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: http://yonbip.com, https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about/51925.txt, https://www.yonyou.com/
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-33234
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.

In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner.  Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.


CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: airflow_cncf_kubernetes
Related CWEs: CWE-74
Related CAPECs: CAPEC-53, CAPEC-51, CAPEC-9
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq, https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq
CWE: CWE-74
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2023-37173
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: a3300r_firmware, a3300r
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_4, https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_4
CWE: CWE-78
CVE-2023-0574
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0


CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected Products: yugabytedb_managed
Related CWEs: CWE-915, CWE-307, CWE-918
Related CAPECs: CAPEC-560, CAPEC-664, CAPEC-653
MITRE ATT&CK Techniques: T1110.004, T1110.001, T1558
MITRE ATT&CK Tactics: T1110
References: https://www.yugabyte.com/, https://www.yugabyte.com/
CWE: CWE-915, CWE-307, CWE-918
MITRE ATT&CK techniques: T1110.004, T1110.001, T1558, T1110.003, T1078
MITRE ATT&CK tactics: T1110
CVE-2023-32652









PiiGAB M-Bus does not validate identification strings before processing, which could make it vulnerable to cross-site scripting attacks.












CVSS v3.1 Score: 8.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products: m-bus_900s, m-bus_900s_firmware
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01, https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01
CWE: CWE-79
CVE-2023-28535
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Paytm Paytm Payment Donation plugin <= 2.2.0 versions.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected Products: paytm_payment_donation
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/paytm-donation/wordpress-paytm-payment-donation-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/paytm-donation/wordpress-paytm-payment-donation-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-48677
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40901, Acronis Cyber Protect Cloud Agent (Windows) before build 39378, Acronis Cyber Protect 16 (Windows) before build 39938, Acronis True Image OEM (Windows) before build 42575.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: cyber_protect_home_office, windows
Related CWEs: CWE-427
Related CAPECs: CAPEC-38, CAPEC-471
MITRE ATT&CK Techniques: T1574.007, T1574.008, T1574.004
MITRE ATT&CK Tactics: T1574
References: https://security-advisory.acronis.com/advisories/SEC-5620, https://security-advisory.acronis.com/advisories/SEC-5620
CWE: CWE-427
MITRE ATT&CK techniques: T1574.007, T1574.008, T1574.004, T1574.009, T1574.001
MITRE ATT&CK tactics: T1574
CVE-2023-26524
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versions.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: quiz_and_survey_master
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-8-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-8-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-6267
A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.
CVSS v3.1 Score: 8.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected Products: quarkus
Related CWEs: CWE-755
References: https://access.redhat.com/errata/RHSA-2024:0494, https://access.redhat.com/errata/RHSA-2024:0495, https://access.redhat.com/security/cve/CVE-2023-6267
CWE: CWE-755
CVE-2023-33137
Microsoft Excel Remote Code Execution Vulnerability
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: office, office_online_server
Related CWEs: CWE-415
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33137, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33137
CWE: CWE-415
CVE-2023-49113
The Kiuwan Local Analyzer (KLA) Java scanning application contains several 
hard-coded secrets in plain text format. In some cases, this can 
potentially compromise the confidentiality of the scan results. Several credentials were found in the JAR files of the Kiuwan Local Analyzer.

The
 JAR file "lib.engine/insight/optimyth-insight.jar" contains the file 
"InsightServicesConfig.properties", which has the configuration tokens 
"insight.github.user" as well as "insight.github.password" prefilled 
with credentials. At least the specified username corresponds to a valid
 GitHub account. The
 JAR file "lib.engine/insight/optimyth-insight.jar" also contains the 
file "es/als/security/Encryptor.properties", in which the key used for 
encrypting the results of any performed scan.




This issue affects Kiuwan SAST: <master.1808.p685.q13371
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-312
Related CAPECs: CAPEC-37
MITRE ATT&CK Techniques: T1005, T1552.004
MITRE ATT&CK Tactics: T1552
References: https://r.sec-consult.com/kiuwan, https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log, http://seclists.org/fulldisclosure/2024/Jun/3
CWE: CWE-312
MITRE ATT&CK techniques: T1005, T1552.004
MITRE ATT&CK tactics: T1552
CVE-2023-29657
eXtplorer 2.1.15 is vulnerable to Insecure Permissions. File upload in file manager allows uploading zip file containing php pages with arbitrary code executions.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: extplorer
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: http://blog.tristaomarinho.com/extplorer-2-1-15-arbitrary-file-upload/, http://extplorer.net/, http://blog.tristaomarinho.com/extplorer-2-1-15-arbitrary-file-upload/
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-6692
The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tab anchor metabox in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 Score: 6.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3022998%40ultimate-blocks%2Ftrunk&old=3016254%40ultimate-blocks%2Ftrunk&sfp_email=&sfph_mail=, https://www.wordfence.com/threat-intel/vulnerabilities/id/33e7006f-3fb9-4493-9ce5-67698c877159?source=cve, https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3022998%40ultimate-blocks%2Ftrunk&old=3016254%40ultimate-blocks%2Ftrunk&sfp_email=&sfph_mail=
CWE: CWE-79
CVE-2023-21021
In isTargetSdkLessThanQOrPrivileged of WifiServiceImpl.java, there is a possible way for the guest user to change admin user network settings due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-255537598
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: android
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://source.android.com/security/bulletin/pixel/2023-03-01, https://source.android.com/security/bulletin/pixel/2023-03-01
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-32074
user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.2


CVSS v3.1 Score: 8.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products: user_oidc
Related CWEs: CWE-307
Related CAPECs: CAPEC-560, CAPEC-653, CAPEC-600
MITRE ATT&CK Techniques: T1110.004, T1110.001, T1558
MITRE ATT&CK Tactics: T1110
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x8mc-84wj-rf34, https://github.com/nextcloud/user_oidc/pull/615, https://hackerone.com/reports/1954711
CWE: CWE-307
MITRE ATT&CK techniques: T1110.004, T1110.001, T1558, T1110.003, T1078
MITRE ATT&CK tactics: T1110
CVE-2023-25665
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `SparseSparseMaximum` is given invalid sparse tensors as inputs, it can give a null pointer error. A fix is included in TensorFlow version 2.12 and version 2.11.1.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: tensorflow
Related CWEs: CWE-476
References: https://github.com/tensorflow/tensorflow/commit/5e0ecfb42f5f65629fd7a4edd6c4afe7ff0feb04, https://github.com/tensorflow/tensorflow/security/advisories/GHSA-558h-mq8x-7q9g, https://github.com/tensorflow/tensorflow/commit/5e0ecfb42f5f65629fd7a4edd6c4afe7ff0feb04
CWE: CWE-476
CVE-2023-38588
Archer C3150 firmware versions prior to 'Archer C3150(JP)_V2_230511' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
CVSS v3.1 Score: 8.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: archer_c3150_firmware, archer_c3150
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://jvn.jp/en/vu/JVNVU99392903/, https://www.tp-link.com/jp/support/download/archer-c3150/#Firmware, https://jvn.jp/en/vu/JVNVU99392903/
CWE: CWE-78
CVE-2023-6319
A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.

  *  webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA 

  *  webOS 5.5.0 - 04.50.51 running on OLED55CXPUA 

  *  webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB 

  *  webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA


CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected Products: lg43um7000pla, oled48c1pub, webos, oled55cxpua, oled55a23la
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/, https://lgsecurity.lge.com/bulletins/tv#updateDetails, https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/
CWE: CWE-78
CVE-2023-48409
In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: android
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: https://source.android.com/security/bulletin/pixel/2023-12-01, https://source.android.com/security/bulletin/pixel/2023-12-01
CWE: CWE-190
CVE-2023-27103
Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: libde265
Related CWEs: CWE-787
References: https://github.com/strukturag/libde265/issues/394, https://lists.debian.org/debian-lts-announce/2023/11/msg00032.html, https://github.com/strukturag/libde265/issues/394
CWE: CWE-787
CVE-2023-26818
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: telegram
Related CWEs: CWE-863
References: http://telegram.com, https://danrevah.github.io/2023/05/15/CVE-2023-26818-Bypass-TCC-with-Telegram/, http://telegram.com
CWE: CWE-863
CVE-2023-21702
Windows iSCSI Service Denial of Service Vulnerability
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_10, windows_11_22h2, windows_11_21h2
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21702, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21702
CWE: CWE-125
CVE-2023-36309
There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Document Creator v1.0.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: document_creator
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4, https://www.phpjabbers.com/document-creator, https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4
CWE: CWE-79
CVE-2023-6263
An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact identification of a legitimate VMS server. As result, it was possible to retrieve authorization headers from legitimate users when the legitimate client connects to the fake VMS server.

CVSS v3.1 Score: 8.3 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products: nxcloud
Related CWEs: CWE-290
Related CAPECs: CAPEC-21, CAPEC-459, CAPEC-94
MITRE ATT&CK Techniques: T1134, T1553.002, T1539
MITRE ATT&CK Tactics: T1134, T1550, T1553
References: https://networkoptix.atlassian.net/wiki/spaces/CHS/blog/2023/09/22/3074195467/vulnerability+2023-09-21+-+Server+Spoofing, https://networkoptix.atlassian.net/wiki/spaces/CHS/blog/2023/09/22/3074195467/vulnerability+2023-09-21+-+Server+Spoofing
CWE: CWE-290
MITRE ATT&CK techniques: T1134, T1553.002, T1539, T1550.004, T1557, T1134.001, T1036.001, T1528
MITRE ATT&CK tactics: T1134, T1550, T1553, T1036
CVE-2023-36331
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.
CVSS v3.1 Score: 8.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected Products: xmall
Related CWEs: CWE-639
References: https://github.com/Exrick/xmall/issues/100
CWE: CWE-639
CVE-2023-0203
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.
CVSS v3.1 Score: 5.0 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Affected Products: connectx-6, connectx_firmware, connectx-5, connectx-6-dx
Related CWEs: CWE-1220
Related CAPECs: CAPEC-180, CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5459, https://nvidia.custhelp.com/app/answers/detail/a_id/5459
CWE: CWE-1220
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-38409
An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-362
Related CAPECs: CAPEC-29, CAPEC-26
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.12, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=fffb0b52d5258554c645c966c6cbef7de50b851d, https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.12
CWE: CWE-362
CVE-2023-37423
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected Products: edgeconnect_sd-wan_orchestrator
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt, https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
CWE: CWE-79
CVE-2023-40208
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aleksandar Urošević Stock Ticker plugin <= 3.23.3 versions.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected Products: stock_ticker
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-3-unauth-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-3-unauth-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-0572
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.


CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products: froxlor
Related CWEs: CWE-391, CWE-754
References: https://github.com/froxlor/froxlor/commit/7b08a71c59430d06c1efb012a6c6448262aacdb1, https://huntr.dev/bounties/4ab24ee2-3ff6-4248-9555-0af3e5f754ec, https://github.com/froxlor/froxlor/commit/7b08a71c59430d06c1efb012a6c6448262aacdb1
CWE: CWE-391, CWE-754
CVE-2023-38088
Kofax Power PDF printf Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of util objects. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20566.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: power_pdf
Related CWEs: CWE-457
References: https://www.zerodayinitiative.com/advisories/ZDI-23-964/, https://www.zerodayinitiative.com/advisories/ZDI-23-964/
CWE: CWE-457
CVE-2023-53423
In the Linux kernel, the following vulnerability has been resolved:

objtool: Fix memory leak in create_static_call_sections()

strdup() allocates memory for key_name. We need to release the memory in
the following error paths. Add free() to avoid memory leak.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-401
References: https://git.kernel.org/stable/c/3a75866a5ceff5d4fdd5471e06c4c4d03e0298b3, https://git.kernel.org/stable/c/3da73f102309fe29150e5c35acd20dd82063ff67, https://git.kernel.org/stable/c/a1368eaea058e451d20ea99ca27e72d9df0d16dd
CWE: CWE-401
CVE-2023-25056
Cross-Site Request Forgery (CSRF) vulnerability in SlickRemix Feed Them Social plugin <= 3.0.2 versions.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: feed_them_social
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/feed-them-social/wordpress-feed-them-social-for-twitter-feed-youtube-and-more-plugin-3-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/feed-them-social/wordpress-feed-them-social-for-twitter-feed-youtube-and-more-plugin-3-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2023-46694
Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exists due to the application's failure to enforce proper authentication controls when accessing the Ckeditor file manager functionality.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://github.com/invisiblebyte/CVE-2023-46694, https://github.com/invisiblebyte/CVE-2023-46694
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-24605
OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.
CVSS v3.1 Score: 4.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected Products: ox_app_suite
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: http://seclists.org/fulldisclosure/2023/May/3, https://open-xchange.com, http://seclists.org/fulldisclosure/2023/May/3
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-51543
Authentication Bypass by Spoofing vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.2.5.0.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products: registrationmagic
Related CWEs: CWE-290
Related CAPECs: CAPEC-21, CAPEC-459, CAPEC-94
MITRE ATT&CK Techniques: T1134, T1553.002, T1539
MITRE ATT&CK Tactics: T1134, T1550, T1553
References: https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-2-5-0-ip-limit-bypass-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-2-5-0-ip-limit-bypass-vulnerability?_s_id=cve
CWE: CWE-290
MITRE ATT&CK techniques: T1134, T1553.002, T1539, T1550.004, T1557, T1134.001, T1036.001, T1528
MITRE ATT&CK tactics: T1134, T1550, T1553, T1036
CVE-2023-43705
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "translation_value[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: oscommerce
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://fluidattacks.com/advisories/bts/, https://www.oscommerce.com/, https://fluidattacks.com/advisories/bts/
CWE: CWE-79
CVE-2023-47227
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Social Feed | All social media in one place plugin <= 1.5.4.6 versions.
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products: social_feed_\|_all_social_media_in_one_place
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/add-facebook/wordpress-social-feed-all-social-media-in-one-place-plugin-1-5-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/add-facebook/wordpress-social-feed-all-social-media-in-one-place-plugin-1-5-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-46007
Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_staff.php.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: best_courier_management_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/SQL-Injection-Vulnerability-3.md, https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/SQL-Injection-Vulnerability-3.md
CWE: CWE-89
CVE-2023-32683
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the `url_preview_ip_range_blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client: 1. For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. 2. For discovered image URLs, any non-image response is discarded. Systems which have URL preview disabled (via the `url_preview_enabled` setting) or have not configured a `url_preview_url_blacklist` are not affected. This issue has been addressed in version 1.85.0. Users are advised to upgrade. User unable to upgrade may also disable URL previews.
CVSS v3.1 Score: 3.5 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected Products: synapse
Related CWEs: CWE-863, CWE-918
Related CAPECs: CAPEC-664
References: https://github.com/matrix-org/synapse/pull/15601, https://github.com/matrix-org/synapse/security/advisories/GHSA-98px-6486-j7qc, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2/
CWE: CWE-863, CWE-918
CVE-2023-53878
Member Login Script 3.3 contains a client-side desynchronization vulnerability that allows attackers to manipulate HTTP request handling by exploiting Content-Length header parsing. Attackers can send crafted POST requests with smuggled secondary requests to potentially bypass server-side request processing controls.
Related CWEs: CWE-444
Related CAPECs: CAPEC-273, CAPEC-33
References: https://www.exploit-db.com/exploits/51710, https://www.phpjabbers.com/member-login-script/, https://www.vulncheck.com/advisories/member-login-script-client-side-request-desynchronization-vulnerability
CWE: CWE-444
CVE-2023-21714
Microsoft Office Information Disclosure Vulnerability
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products: 365_apps, office_long_term_servicing_channel
Related CWEs: CWE-668, CWE-125
Related CAPECs: CAPEC-540
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714
CWE: CWE-668, CWE-125
CVE-2023-43078
Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary folder deletion, which could lead to Privilege Escalation or Denial of Service.
CVSS v3.1 Score: 6.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products: chengming_3990, vostro_3400_firmware, xps_15_7590_firmware, latitude_3330_firmware, latitude_3410
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: https://www.dell.com/support/kbdoc/en-us/000217981/dsa-2023-362-security-update-for-dell-dock-firmware-and-dell-client-platform-for-an-improper-link-resolution-vulnerability
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2023-47229
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vyas Dipen Top 25 Social Icons plugin <= 3.1 versions.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: top_25_social_icons
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/vulnerability/top-25-social-icons/wordpress-top-25-social-icons-plugin-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/top-25-social-icons/wordpress-top-25-social-icons-plugin-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2023-0711
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the view state of the folder structure maintained by the plugin.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected Products: wicked_folders
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php, https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=, https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c43e93-69a3-407e-860e-ab25af5d7177?source=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2023-31679
Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: videogo
References: https://github.com/zzh-newlearner/record/blob/main/yingshi_privacy.md, https://github.com/zzh-newlearner/record/blob/main/yingshi_privacy.md
CVE-2023-40293
Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.
CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: harman_infotainment
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/, https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/
CWE: CWE-77
CVE-2023-49284
fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. While this may cause unexpected behavior with direct input (for example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if the output is being fed from an external program into a command substitution where this output may not be expected. This design flaw was introduced in very early versions of fish, predating the version control system, and is thought to be present in every version of fish released in the last 15 years or more, although with different characters. Code execution does not appear to be possible, but denial of service (through large brace expansion) or information disclosure (such as variable expansion) is potentially possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1 Score: 3.9 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Affected Products: fish
Related CWEs: CWE-436
Related CAPECs: CAPEC-273, CAPEC-105, CAPEC-34
References: http://www.openwall.com/lists/oss-security/2023/12/08/1, https://github.com/fish-shell/fish-shell/commit/09986f5563e31e2c900a606438f1d60d008f3a14, https://github.com/fish-shell/fish-shell/security/advisories/GHSA-2j9r-pm96-wp4f
CWE: CWE-436
CVE-2023-32032
.NET and Visual Studio Elevation of Privilege Vulnerability
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Affected Products: visual_studio_2022, .net
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2023-36533
Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network access.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Affected Products: meeting_software_development_kit, video_software_development_kit
Related CWEs: CWE-772
Related CAPECs: CAPEC-469
MITRE ATT&CK Techniques: T1499.002
MITRE ATT&CK Tactics: T1499
References: https://explore.zoom.us/en/trust/security/security-bulletin/, https://explore.zoom.us/en/trust/security/security-bulletin/
CWE: CWE-772
MITRE ATT&CK techniques: T1499.002
MITRE ATT&CK tactics: T1499
CVE-2023-40180
 silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. This issue has been addressed in versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: graphql
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://docs.silverstripe.org/en/developer_guides/graphql/security_and_best_practices/recursive_or_complex_queries, https://github.com/silverstripe/silverstripe-graphql/commit/f6d5976ec4608e51184b0db1ee5b9e9a99d2501c, https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-v23w-pppm-jh66
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2023-4626
The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ladiflow_save_hook() function in versions up to, and including, 4.3. This makes it possible for authenticated attackers with subscriber-level access and above to update the 'ladiflow_hook_configs' option.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Products: ladipage
References: https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1983, https://www.wordfence.com/threat-intel/vulnerabilities/id/47dccf26-6c8d-4418-a874-c29749bee537?source=cve, https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1983
CVE-2023-1717

Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.






CVSS v3.1 Score: 9.6 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products: bitrix24
Related CWEs: CWE-79, CWE-1321
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://starlabs.sg/advisories/23/23-1717/, https://starlabs.sg/advisories/23/23-1717/
CWE: CWE-79, CWE-1321
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2023-6068
On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in some packets that should be denied being permitted and some
CVSS v3.1 Score: 3.1 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Products: 7130-48lb, 7130-32lba, 7130-48la, 7130-48eh, 7130-96lba
Related CWEs: CWE-283
References: https://www.arista.com/en/support/advisories-notices/security-advisory/19023-security-advisory-0091, https://www.arista.com/en/support/advisories-notices/security-advisory/19023-security-advisory-0091
CWE: CWE-283
CVE-2023-23315
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: stripe_payment_pro
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://friends-of-presta.github.io/security-advisories/modules/2023/03/01/stripejs.html, https://friends-of-presta.github.io/security-advisories/modules/2023/03/01/stripejs.html
CWE: CWE-89
CVE-2023-44350
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: coldfusion
Related CWEs: CWE-502
Related CAPECs: CAPEC-586
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html, https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
CWE: CWE-502
CVE-2023-44117
Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: harmonyos, emui
Related CWEs: CWE-290
Related CAPECs: CAPEC-21, CAPEC-459, CAPEC-94
MITRE ATT&CK Techniques: T1134, T1553.002, T1539
MITRE ATT&CK Tactics: T1134, T1550, T1553
References: https://consumer.huawei.com/en/support/bulletin/2024/1/, https://device.harmonyos.com/en/docs/security/update/security-bulletins-202401-0000001799925977, https://consumer.huawei.com/en/support/bulletin/2024/1/
CWE: CWE-290
MITRE ATT&CK techniques: T1134, T1553.002, T1539, T1550.004, T1557, T1134.001, T1036.001, T1528
MITRE ATT&CK tactics: T1134, T1550, T1553, T1036
CVE-2023-32178
VIPRE Antivirus Plus TelFileTransfer Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the TelFileTransfer method. By creating a symbolic link, an attacker can abuse the method to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
. Was ZDI-CAN-19396.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: antivirus
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530, https://www.zerodayinitiative.com/advisories/ZDI-23-758/, https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2023-53893
Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass network restrictions. Attackers can exploit the unvalidated parameter to initiate file, service, and network enumeration by forcing the application to make HTTP, DNS, or file requests to arbitrary destinations.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products: titan_file
Related CWEs: CWE-918
Related CAPECs: CAPEC-664
References: https://www.ateme.com/product-titan-software/, https://www.exploit-db.com/exploits/51582, https://www.vulncheck.com/advisories/ateme-titan-file-authenticated-server-side-request-forgery-vulnerability
CWE: CWE-918