alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2023-38371 (published 2024-06-27)
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  261198.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-327
Affected vendors: ibm
Affected products: security_access_manager
CVE-2023-38372 (published 2024-02-29)
An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user.  IBM X-Force ID:  261201.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-287
Affected vendors: ibm
Affected products: watson_iot_platform
CVE-2023-38378 (published 2023-07-16)
The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: rigol
Affected products: mso5000, mso5000_firmware
CVE-2023-38379 (published 2023-07-16)
The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin password via a zero-length pass0 to the webcontrol changepwd.cgi application, i.e., the entered password only needs to match the first zero characters of the saved password.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-306
Affected vendors: rigol
Affected products: mso5000, mso5000_firmware
CVE-2023-3838 (published 2023-07-23)
A vulnerability classified as problematic was found in DedeBIZ 6.2.10. Affected by this vulnerability is an unknown functionality of the file /admin/vote_edit.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235189 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dedebiz
Affected products: dedebiz
CVE-2023-38380 (published 2023-12-12)
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE (All versions < V3.4.29), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) (All versions < V3.0.37), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SINAMICS S210 (6SL5...) (All versions >= V6.1 < V6.1 HF2), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) (All versions < V3.0.37). The webserver implementation of the affected products does not correctly release allocated memory after it has been used.

An attacker with network access could use this vulnerability to cause a denial-of-service condition in the webserver of the affected product.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: siemens
Affected products: 6ag1543-1ax00-2xe0, 6ag1543-1ax00-2xe0_firmware, 6gk7243-8rx30-0xe0, 6gk7243-8rx30-0xe0_firmware, 6gk7543-1ax00-0xe0, 6gk7543-1ax00-0xe0_firmware, simatic_cp_1242-7_v2, simatic_cp_1242-7_v2_firmware, simatic_cp_1243-1, simatic_cp_1243-1_dnp3, simatic_cp_1243-1_dnp3_firmware, simatic_cp_1243-1_firmware, simatic_cp_1243-1_iec, simatic_cp_1243-1_iec_firmware, simatic_cp_1243-7_lte, simatic_cp_1243-7_lte_firmware, sinamics_s210, sinamics_s210_firmware
CVE-2023-38381 (published 2023-10-03)
Cross-Site Request Forgery (CSRF) vulnerability in Cyle Conoly WP-FlyBox plugin <= 6.46 versions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: wp-flybox_project
Affected products: wp-flybox
CVE-2023-38382 (published 2023-11-06)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category allows SQL Injection.This issue affects Subscribe to Category: from n/a through 2.7.4.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: subscribe_to_category_project
Affected products: subscribe_to_category
CVE-2023-38383 (published 2024-12-13)
Missing Authorization vulnerability in OnTheGoSystems Language allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Language: from n/a through 1.2.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Weakness: CWE-862
CVE-2023-38384 (published 2023-08-08)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Syntactics, Inc. EaSYNC plugin <= 1.3.7 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: syntacticsinc
Affected products: easync
CVE-2023-38385 (published 2024-12-13)
Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: artbees
Affected products: jupiter_x_core
CVE-2023-38386 (published 2024-06-19)
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: ninjaforms
Affected products: ninja_forms
CVE-2023-38387 (published 2023-09-03)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Elastic Email Sender plugin <= 1.2.6 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: elasticemail
Affected products: elastic_email_sender
CVE-2023-38388 (published 2024-03-26)
Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: artbees
Affected products: jupiter_x_core
CVE-2023-38389 (published 2024-06-21)
Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3.3.8.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-863
Affected vendors: artbees
Affected products: jupiter_x_core
CVE-2023-3839 (published 2023-07-23)
A vulnerability, which was classified as problematic, has been found in DedeBIZ 6.2.10. Affected by this issue is some unknown functionality of the file /admin/sys_sql_query.php. The manipulation of the argument sqlquery leads to sql injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-235190 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: dedebiz
Affected products: dedebiz
CVE-2023-38390 (published 2023-10-03)
Cross-Site Request Forgery (CSRF) vulnerability in Anshul Labs Mobile Address Bar Changer plugin <= 3.0 versions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: anshullabs
Affected products: mobile_address_bar_changer
CVE-2023-38391 (published 2023-11-04)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themesgrove Onepage Builder allows SQL Injection.This issue affects Onepage Builder: from n/a through 2.4.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: themesgrove
Affected products: onepage_builder
CVE-2023-38392 (published 2023-08-07)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.9 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wpgogo
Affected products: custom_field_template
CVE-2023-38393 (published 2024-06-19)
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: ninjaforms
Affected products: ninja_forms
CVE-2023-38394 (published 2024-06-19)
Missing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: artbees
Affected products: jupiter_x_core
CVE-2023-38395 (published 2024-06-12)
Missing Authorization vulnerability in Afzal Multani WP Clone Menu.This issue affects WP Clone Menu: from n/a through 1.0.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-862
Affected vendors: afzalmultani
Affected products: wp_clone_menu
CVE-2023-38396 (published 2023-10-03)
Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez plugin <= 3.1.2 versions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: web-argument
Affected products: google-map-shortcode
CVE-2023-38397 (published 2023-08-10)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eggemplo Gestion-Pymes plugin <= 1.5.6 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: eggemplo
Affected products: gestion-pymes
CVE-2023-38398 (published 2023-10-03)
Cross-Site Request Forgery (CSRF) vulnerability in Taboola plugin <= 2.0.1 versions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: tablooa
Affected products: tablooa
CVE-2023-38399 (published 2024-05-17)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Portfolio allows PHP Local File Inclusion.This issue affects Phlox Portfolio: from n/a through 2.3.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)
Weakness: CWE-22
CVE-2023-3840 (published 2023-07-23)
A vulnerability, which was classified as problematic, was found in NxFilter 4.3.2.5. This affects an unknown part of the file /report,daily.jsp?stime=2023%2F07%2F12&timeOption=yesterday&. The manipulation of the argument user leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-235191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: nxfilter
Affected products: nxfilter
CVE-2023-38400 (published 2023-11-30)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme allows Reflected XSS.This issue affects Enfold - Responsive Multi-Purpose Theme: from n/a through 5.6.4.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: kriesi
Affected products: enfold
CVE-2023-38401 (published 2023-08-15)
A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow local users to elevate privileges. Successful exploitation could allow execution of arbitrary code with NT AUTHORITY\SYSTEM privileges on the operating system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: hp, microsoft
Affected products: aruba_virtual_intranet_access, windows
CVE-2023-38402 (published 2023-08-15)
A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could allow these malicious users to create a Denial-of-Service (DoS) condition affecting the Microsoft Windows operating System boot process.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Affected vendors: hp, microsoft
Affected products: aruba_virtual_intranet_access, windows
CVE-2023-38403 (published 2023-07-17)
iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: apple, debian, es, fedoraproject, linux, netapp
Affected products: clustered_data_ontap, debian_linux, fedora, iperf3, linux_kernel, macos, ontap_select_deploy_administration_utility
CVE-2023-38404 (published 2023-07-17)
The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the server. An authenticated attacker can then execute the malicious file to perform command execution on the remote server.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: veritas
Affected products: infoscale_operations_manager
CVE-2023-38405 (published 2023-07-17)
On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: crestron
Affected products: cp3-gv_6506034, cp3-gv_6506034_firmware, cp3_6504877, cp3_6504877_firmware, cp3n_6505417, cp3n_6505417_firmware
CVE-2023-38406 (published 2023-11-06)
bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-755
Affected vendors: frrouting
Affected products: frrouting
CVE-2023-38407 (published 2023-11-06)
bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: frrouting
Affected products: frrouting
CVE-2023-38408 (published 2023-07-20)
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-428
Affected vendors: fedoraproject, openbsd
Affected products: fedora, openssh
CVE-2023-38409 (published 2023-07-17)
An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-362
Affected vendors: linux
Affected products: linux_kernel
CVE-2023-3841 (published 2023-07-23)
A vulnerability has been found in NxFilter 4.3.2.5 and classified as problematic. This vulnerability affects unknown code of the file user.jsp. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The identifier of this vulnerability is VDB-235192. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: nxfilter
Affected products: nxfilter
CVE-2023-38410 (published 2023-07-27)
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A user may be able to elevate privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2023-38411 (published 2023-11-14)
Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: intel
Affected products: smart_campus
CVE-2023-38412 (published 2023-08-07)
Netgear R6900P v1.3.3.154 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at ia_ap_setting.cgi.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: netgear
Affected products: r6900p, r6900p_firmware
CVE-2023-38417 (published 2024-05-16)
Improper input validation for some Intel(R) PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-20
CVE-2023-38418 (published 2023-08-02)

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-347
Affected vendors: f5
Affected products: access_policy_manager_clients, big-ip_access_policy_manager
CVE-2023-38419 (published 2023-08-02)
An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-755
Affected vendors: f5
Affected products: big-ip_access_policy_manager, big-ip_advanced_firewall_manager, big-ip_advanced_web_application_firewall, big-ip_analytics, big-ip_application_acceleration_manager, big-ip_application_security_manager, big-ip_application_visibility_and_reporting, big-ip_carrier-grade_nat, big-ip_ddos_hybrid_defender, big-ip_domain_name_system, big-ip_edge_gateway, big-ip_fraud_protection_service, big-ip_global_traffic_manager, big-ip_link_controller, big-ip_local_traffic_manager, big-ip_policy_enforcement_manager, big-ip_ssl_orchestrator, big-ip_webaccelerator, big-ip_websafe, big-iq_centralized_management
CVE-2023-3842 (published 2023-07-23)
A vulnerability was found in Pointware EasyInventory 1.0.12.0 and classified as critical. This issue affects some unknown processing of the file C:\Program Files (x86)\EasyInventory\Easy2W.exe. The manipulation leads to unquoted search path. Attacking locally is a requirement. The identifier VDB-235193 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-428
Affected vendors: pointware
Affected products: easyinventory
CVE-2023-38420 (published 2024-05-16)
Improper conditions check in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable information disclosure via local access.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
Weakness: CWE-754
Affected vendors: apple, intel
Affected products: macos, power_gadget
CVE-2023-38421 (published 2023-07-27)
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5, macOS Monterey 12.6.8. Processing a 3D model may result in disclosure of process memory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: apple
Affected products: macos
CVE-2023-38422 (published 2023-08-23)
Walchem Intuition 9 firmware versions prior to v4.21 are missing authentication for some of the API routes of the management web server. This could allow an attacker to download and export sensitive data.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-306
Affected vendors: walchem
Affected products: intuition_9, intuition_9_firmware
CVE-2023-38423 (published 2023-08-02)

A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: f5
Affected products: big-ip_access_policy_manager, big-ip_advanced_firewall_manager, big-ip_advanced_web_application_firewall, big-ip_analytics, big-ip_application_acceleration_manager, big-ip_application_security_manager, big-ip_application_visibility_and_reporting, big-ip_carrier-grade_nat, big-ip_ddos_hybrid_defender, big-ip_domain_name_system, big-ip_edge_gateway, big-ip_fraud_protection_service, big-ip_global_traffic_manager, big-ip_link_controller, big-ip_local_traffic_manager, big-ip_policy_enforcement_manager, big-ip_ssl_orchestrator, big-ip_webaccelerator, big-ip_websafe
CVE-2023-38424 (published 2023-07-27)
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2023-38425 (published 2023-07-27)
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2023-38426 (published 2023-07-18)
An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: linux, netapp
Affected products: h300s, h410s, h500s, h700s, linux_kernel, solidfire_\&_hci_management_node, solidfire_\&_hci_storage_node
CVE-2023-38427 (published 2023-07-18)
An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_contexts.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: linux, netapp
Affected products: h300s, h410s, h500s, h700s, linux_kernel
CVE-2023-38428 (published 2023-07-18)
An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: linux, netapp
Affected products: h300s, h410s, h500s, h700s, linux_kernel, solidfire_\&_hci_management_node, solidfire_\&_hci_storage_node
CVE-2023-38429 (published 2023-07-18)
An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-193
Affected vendors: linux
Affected products: linux_kernel
CVE-2023-3843 (published 2023-07-23)
A vulnerability was found in mooSocial mooDating 1.2. It has been classified as problematic. Affected is an unknown function of the file /matchmakings/question of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-235194 is the identifier assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: moosocial
Affected products: moodating
CVE-2023-38430 (published 2023-07-18)
An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: linux, netapp
Affected products: h300s, h410s, h500s, h700s, hci_management_node, linux_kernel
CVE-2023-38431 (published 2023-07-18)
An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: linux, netapp
Affected products: h300s, h410s, h500s, h700s, linux_kernel, solidfire_\&_hci_management_node
CVE-2023-38432 (published 2023-07-18)
An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: linux, netapp
Affected products: h300s, h410s, h500s, h700s, linux_kernel, solidfire, solidfire_\&_hci_storage_node
CVE-2023-38433 (published 2023-07-26)
Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as follows: IP-HE950E firmware versions V01L001 to V01L053, IP-HE950D firmware versions V01L001 to V01L053, IP-HE900E firmware versions V01L001 to V01L010, IP-HE900D firmware versions V01L001 to V01L004, IP-900E / IP-920E firmware versions V01L001 to V02L061, IP-900D / IP-900ⅡD / IP-920D firmware versions V01L001 to V02L061, IP-90 firmware versions V01L001 to V01L013, and IP-9610 firmware versions V01L001 to V02L007.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-798
Affected vendors: fujitsu
Affected products: ip-90, ip-900d, ip-900d_firmware, ip-900e, ip-900e_firmware, ip-900iid, ip-900iid_firmware, ip-90_firmware, ip-920d, ip-920d_firmware, ip-920e, ip-920e_firmware, ip-9610, ip-9610_firmware, ip-he900d, ip-he900d_firmware, ip-he900e, ip-he900e_firmware, ip-he950d, ip-he950d_firmware, ip-he950e, ip-he950e_firmware
CVE-2023-38434 (published 2023-07-18)
xHTTP 72f812d has a double free in close_connection in xhttp.c via a malformed HTTP request method.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-415
Affected vendors: linux, xhttp_project
Affected products: linux_kernel, xhttp
CVE-2023-38435 (published 2023-07-25)
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Apache Felix Healthcheck Webconsole Plugin version 2.0.2 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack.

Upgrade to Apache Felix Healthcheck Webconsole Plugin 2.1.0 or higher.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: apache
Affected products: felix_health_check_webconsole_plugin
CVE-2023-38436 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38437 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38438 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38439 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-3844 (published 2023-07-23)
A vulnerability was found in mooSocial mooDating 1.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /friends of the component URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235195. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: moosocial
Affected products: moodating
CVE-2023-38440 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38441 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38442 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38443 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38444 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38445 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38446 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38447 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38448 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38449 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-3845 (published 2023-07-23)
A vulnerability was found in mooSocial mooDating 1.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /friends/ajax_invite of the component URL Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235196. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: moosocial
Affected products: moodating
CVE-2023-38450 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38451 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38452 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38453 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38454 (published 2023-09-04)
In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38455 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38456 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38457 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38458 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38459 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-3846 (published 2023-07-23)
A vulnerability classified as problematic has been found in mooSocial mooDating 1.2. This affects an unknown part of the file /pages of the component URL Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235197 was assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: moosocial
Affected products: moodating
CVE-2023-38460 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38461 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38462 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38463 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38464 (published 2023-09-04)
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t606, t610, t612, t616, t618
CVE-2023-38465 (published 2023-09-04)
In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2023-38466 (published 2023-09-04)
In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2023-38467 (published 2023-09-04)
In urild service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2023-38468 (published 2023-09-04)
In urild service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2023-38469 (published 2023-11-02)
A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: avahi, redhat
Affected products: avahi, enterprise_linux
CVE-2023-3847 (published 2023-07-23)
A vulnerability classified as problematic was found in mooSocial mooDating 1.2. This vulnerability affects unknown code of the file /users of the component URL Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-235198 is the identifier assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: moosocial
Affected products: moodating
CVE-2023-38470 (published 2023-11-02)
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: avahi, redhat
Affected products: avahi, enterprise_linux
CVE-2023-38471 (published 2023-11-02)
A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: avahi, redhat
Affected products: avahi, enterprise_linux
CVE-2023-38472 (published 2023-11-02)
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: avahi, redhat
Affected products: avahi, enterprise_linux
CVE-2023-38473 (published 2023-11-02)
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: avahi, redhat
Affected products: avahi, enterprise_linux
CVE-2023-38474 (published 2023-11-30)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Reflected XSS.This issue affects Campaign Monitor for WordPress: from n/a through 2.8.12.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: campaignmonitor
Affected products: campaign_monitor
CVE-2023-38475 (published 2024-12-13)
Missing Authorization vulnerability in RedNao Donations Made Easy – Smart Donations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: rednao
Affected products: donations_made_easy_-_smart_donations
CVE-2023-38476 (published 2023-09-03)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SuiteDash :: ONE Dashboard® Client Portal : SuiteDash Direct Login plugin <= 1.7.6 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: suitedash
Affected products: client_portal_\
CVE-2023-38477 (published 2024-12-13)
Missing Authorization vulnerability in Stanislav Kuznetsov QR code MeCard/vCard generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QR code MeCard/vCard generator: from n/a through 1.6.0.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-862