alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2023-0836 (published 2023-03-29)
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: haproxy
Affected products: haproxy
CVE-2023-0837 (published 2023-06-14)
An improper  authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged user to change basic local device settings even though the options were locked. This can result in unwanted changes to the configuration.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-285
Affected vendors: apple, microsoft, teamviewer
Affected products: macos, remote, windows
CVE-2023-0838 (published 2023-04-05)
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-200
Affected vendors: gitlab
Affected products: gitlab
CVE-2023-0839 (published 2023-03-06)
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co. InSCADA allows Account Footprinting.

This issue affects inSCADA: before 20230115-1.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1320
Affected vendors: inscada_project
Affected products: inscada
CVE-2023-0840 (published 2023-02-15)
A vulnerability classified as problematic was found in PHPCrazy 1.1.1. This vulnerability affects unknown code of the file admin/admin.php?action=users&mode=info&user=2. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221086 is the identifier assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: phpcrazy_project
Affected products: phpcrazy
CVE-2023-0841 (published 2023-02-15)
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded. This issue affects the function mp3_dmx_process of the file filters/reframe_mp3.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221087.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: gpac
Affected products: gpac
CVE-2023-0842 (published 2023-04-05)
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-1321
Affected vendors: xml2js_project
Affected products: xml2js
CVE-2023-0844 (published 2023-03-13)
The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: kibokolabs
Affected products: namaste\!_lms
CVE-2023-0845 (published 2023-03-09)
Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: hashicorp
Affected products: consul
CVE-2023-0846 (published 2023-02-22)
Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization's private networks and should not be directly accessible
from the Internet.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: opennms
Affected products: horizon, meridian
CVE-2023-0847 (published 2023-03-01)

The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementation version 0.5.0. If the protocol has been compiled using default settings, this will only grant the attacker access to allocated but unused memory. However, if it was configured using non-default settings, there is the possibility that exploiting this vulnerability could lead to system crashes and remote code execution. 


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: dash7-alliance
Affected products: dash7_alliance_protcol
CVE-2023-0848 (published 2023-02-15)
A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Management Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221147.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-404
Affected vendors: netgear
Affected products: wndr3700, wndr3700_firmware
CVE-2023-0849 (published 2023-02-15)
A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221152.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: netgear
Affected products: wndr3700, wndr3700_firmware
CVE-2023-0850 (published 2023-02-15)
A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic. This issue affects some unknown processing of the component Web Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221153 was assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-404
Affected vendors: netgear
Affected products: wndr3700, wndr3700_firmware
CVE-2023-0851 (published 2023-05-11)
Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: canon
Affected products: i-sensys_lbp621cw, i-sensys_lbp621cw_firmware, i-sensys_lbp623cdw, i-sensys_lbp623cdw_firmware, i-sensys_lbp633cdw, i-sensys_lbp633cdw_firmware, i-sensys_lbp664cx, i-sensys_lbp664cx_firmware, i-sensys_mf641cw, i-sensys_mf641cw_firmware, i-sensys_mf643cdw, i-sensys_mf643cdw_firmware, i-sensys_mf645cx, i-sensys_mf645cx_firmware, i-sensys_mf742cdw, i-sensys_mf742cdw_firmware, i-sensys_mf744cdw, i-sensys_mf744cdw_firmware, i-sensys_mf746cx, i-sensys_mf746cx_firmware, i-sensys_x_c1127i, i-sensys_x_c1127i_firmware, i-sensys_x_c1127if, i-sensys_x_c1127if_firmware, i-sensys_x_c1127p
CVE-2023-0852 (published 2023-05-11)
Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: canon
Affected products: i-sensys_lbp621cw, i-sensys_lbp621cw_firmware, i-sensys_lbp623cdw, i-sensys_lbp623cdw_firmware, i-sensys_lbp633cdw, i-sensys_lbp633cdw_firmware, i-sensys_lbp664cx, i-sensys_lbp664cx_firmware, i-sensys_mf641cw, i-sensys_mf641cw_firmware, i-sensys_mf643cdw, i-sensys_mf643cdw_firmware, i-sensys_mf645cx, i-sensys_mf645cx_firmware, i-sensys_mf742cdw, i-sensys_mf742cdw_firmware, i-sensys_mf744cdw, i-sensys_mf744cdw_firmware, i-sensys_mf746cx, i-sensys_mf746cx_firmware, i-sensys_x_c1127i, i-sensys_x_c1127i_firmware, i-sensys_x_c1127if, i-sensys_x_c1127if_firmware, i-sensys_x_c1127p
CVE-2023-0853 (published 2023-05-11)
Buffer overflow in mDNS NSEC record registering process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: canon
Affected products: i-sensys_lbp621cw, i-sensys_lbp621cw_firmware, i-sensys_lbp623cdw, i-sensys_lbp623cdw_firmware, i-sensys_lbp633cdw, i-sensys_lbp633cdw_firmware, i-sensys_lbp664cx, i-sensys_lbp664cx_firmware, i-sensys_mf641cw, i-sensys_mf641cw_firmware, i-sensys_mf643cdw, i-sensys_mf643cdw_firmware, i-sensys_mf645cx, i-sensys_mf645cx_firmware, i-sensys_mf742cdw, i-sensys_mf742cdw_firmware, i-sensys_mf744cdw, i-sensys_mf744cdw_firmware, i-sensys_mf746cx, i-sensys_mf746cx_firmware, i-sensys_x_c1127i, i-sensys_x_c1127i_firmware, i-sensys_x_c1127if, i-sensys_x_c1127if_firmware, i-sensys_x_c1127p
CVE-2023-0854 (published 2023-05-11)
Buffer overflow in NetBIOS QNAME registering and communication process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: canon
Affected products: i-sensys_lbp621cw, i-sensys_lbp621cw_firmware, i-sensys_lbp623cdw, i-sensys_lbp623cdw_firmware, i-sensys_lbp633cdw, i-sensys_lbp633cdw_firmware, i-sensys_lbp664cx, i-sensys_lbp664cx_firmware, i-sensys_mf641cw, i-sensys_mf641cw_firmware, i-sensys_mf643cdw, i-sensys_mf643cdw_firmware, i-sensys_mf645cx, i-sensys_mf645cx_firmware, i-sensys_mf742cdw, i-sensys_mf742cdw_firmware, i-sensys_mf744cdw, i-sensys_mf744cdw_firmware, i-sensys_mf746cx, i-sensys_mf746cx_firmware, i-sensys_x_c1127i, i-sensys_x_c1127i_firmware, i-sensys_x_c1127if, i-sensys_x_c1127if_firmware, i-sensys_x_c1127p
CVE-2023-0855 (published 2023-05-11)
Buffer overflow in IPP number-up attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: canon
Affected products: i-sensys_lbp621cw, i-sensys_lbp621cw_firmware, i-sensys_lbp623cdw, i-sensys_lbp623cdw_firmware, i-sensys_lbp633cdw, i-sensys_lbp633cdw_firmware, i-sensys_lbp664cx, i-sensys_lbp664cx_firmware, i-sensys_mf641cw, i-sensys_mf641cw_firmware, i-sensys_mf643cdw, i-sensys_mf643cdw_firmware, i-sensys_mf645cx, i-sensys_mf645cx_firmware, i-sensys_mf742cdw, i-sensys_mf742cdw_firmware, i-sensys_mf744cdw, i-sensys_mf744cdw_firmware, i-sensys_mf746cx, i-sensys_mf746cx_firmware, i-sensys_x_c1127i, i-sensys_x_c1127i_firmware, i-sensys_x_c1127if, i-sensys_x_c1127if_firmware, i-sensys_x_c1127p
CVE-2023-0856 (published 2023-05-11)
Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: canon
Affected products: i-sensys_lbp621cw, i-sensys_lbp621cw_firmware, i-sensys_lbp623cdw, i-sensys_lbp623cdw_firmware, i-sensys_lbp633cdw, i-sensys_lbp633cdw_firmware, i-sensys_lbp664cx, i-sensys_lbp664cx_firmware, i-sensys_mf641cw, i-sensys_mf641cw_firmware, i-sensys_mf643cdw, i-sensys_mf643cdw_firmware, i-sensys_mf645cx, i-sensys_mf645cx_firmware, i-sensys_mf742cdw, i-sensys_mf742cdw_firmware, i-sensys_mf744cdw, i-sensys_mf744cdw_firmware, i-sensys_mf746cx, i-sensys_mf746cx_firmware, i-sensys_x_c1127i, i-sensys_x_c1127i_firmware, i-sensys_x_c1127if, i-sensys_x_c1127if_firmware, i-sensys_x_c1127p
CVE-2023-0857 (published 2023-05-11)
Unintentional change of settings during initial registration of system administrators which uses control protocols. The affected Office / Small Office Multifunction Printers and Laser Printers(*) may allow an attacker on the network segment to trigger unauthorized access to the product. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-286
Affected vendors: canon
Affected products: i-sensys_lbp621cw, i-sensys_lbp621cw_firmware, i-sensys_lbp623cdw, i-sensys_lbp623cdw_firmware, i-sensys_lbp633cdw, i-sensys_lbp633cdw_firmware, i-sensys_lbp664cx, i-sensys_lbp664cx_firmware, i-sensys_mf641cw, i-sensys_mf641cw_firmware, i-sensys_mf643cdw, i-sensys_mf643cdw_firmware, i-sensys_mf645cx, i-sensys_mf645cx_firmware, i-sensys_mf742cdw, i-sensys_mf742cdw_firmware, i-sensys_mf744cdw, i-sensys_mf744cdw_firmware, i-sensys_mf746cx, i-sensys_mf746cx_firmware, i-sensys_x_c1127i, i-sensys_x_c1127i_firmware, i-sensys_x_c1127if, i-sensys_x_c1127if_firmware, i-sensys_x_c1127p
CVE-2023-0858 (published 2023-05-11)
Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger unauthorized access to the product. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-284
Affected vendors: canon
Affected products: i-sensys_lbp621cw, i-sensys_lbp621cw_firmware, i-sensys_lbp623cdw, i-sensys_lbp623cdw_firmware, i-sensys_lbp633cdw, i-sensys_lbp633cdw_firmware, i-sensys_lbp664cx, i-sensys_lbp664cx_firmware, i-sensys_mf641cw, i-sensys_mf641cw_firmware, i-sensys_mf643cdw, i-sensys_mf643cdw_firmware, i-sensys_mf645cx, i-sensys_mf645cx_firmware, i-sensys_mf742cdw, i-sensys_mf742cdw_firmware, i-sensys_mf744cdw, i-sensys_mf744cdw_firmware, i-sensys_mf746cx, i-sensys_mf746cx_firmware, i-sensys_x_c1127i, i-sensys_x_c1127i_firmware, i-sensys_x_c1127if, i-sensys_x_c1127if_firmware, i-sensys_x_c1127p
CVE-2023-0859 (published 2023-05-11)
Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers and Laser Printers(*). *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-1285
Affected vendors: canon
Affected products: i-sensys_lbp621cw, i-sensys_lbp621cw_firmware, i-sensys_lbp623cdw, i-sensys_lbp623cdw_firmware, i-sensys_lbp633cdw, i-sensys_lbp633cdw_firmware, i-sensys_lbp664cx, i-sensys_lbp664cx_firmware, i-sensys_mf641cw, i-sensys_mf641cw_firmware, i-sensys_mf643cdw, i-sensys_mf643cdw_firmware, i-sensys_mf645cx, i-sensys_mf645cx_firmware, i-sensys_mf742cdw, i-sensys_mf742cdw_firmware, i-sensys_mf744cdw, i-sensys_mf744cdw_firmware, i-sensys_mf746cx, i-sensys_mf746cx_firmware, i-sensys_x_c1127i, i-sensys_x_c1127i_firmware, i-sensys_x_c1127if, i-sensys_x_c1127if_firmware, i-sensys_x_c1127p
CVE-2023-0860 (published 2023-02-16)
Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-307
Affected vendors: modoboa
Affected products: installer
CVE-2023-0861 (published 2023-02-16)
NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges.
This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: netmodule
Affected products: nb1601, nb1800, nb1810, nb2800, nb2810, nb3701, nb3800, nb800, netmodule_router_software, ng800
CVE-2023-0862 (published 2023-02-16)
The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges.

This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: netmodule
Affected products: nb1601, nb1800, nb1810, nb2800, nb2810, nb3701, nb3800, nb800, netmodule_router_software, ng800
CVE-2023-0863 (published 2023-05-17)
Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symbiosis, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): from 1.0;0 through 1.5.5; Terra AC wallbox (UL32A) : from 1.0;0 through 1.6.5; Terra AC wallbox (CE) (Terra AC MID): from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC Juno CE: from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC PTB : from 1.0;0 through 1.5.25; Terra AC wallbox (CE) Symbiosis: from 1.0;0 through 1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: abb
Affected products: terra_ac_wallbox_80a, terra_ac_wallbox_80a_firmware, terra_ac_wallbox_ce_juno, terra_ac_wallbox_ce_juno_firmware, terra_ac_wallbox_ce_mid, terra_ac_wallbox_ce_mid_firmware, terra_ac_wallbox_ce_ptb, terra_ac_wallbox_ce_ptb_firmware, terra_ac_wallbox_ce_symbiosis, terra_ac_wallbox_ce_symbiosis_firmware, terra_ac_wallbox_jp, terra_ac_wallbox_jp_firmware, terra_ac_wallbox_ul32a, terra_ac_wallbox_ul32a_firmware, terra_ac_wallbox_ul40, terra_ac_wallbox_ul40_firmware
CVE-2023-0864 (published 2023-05-17)
Cleartext Transmission of Sensitive Information vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symbiosis, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): from 1.0;0 through 1.5.5; Terra AC wallbox (UL32A) : from 1.0;0 through 1.6.5; Terra AC wallbox (CE) (Terra AC MID): from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC Juno CE: from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC PTB : from 1.0;0 through 1.5.25; Terra AC wallbox (CE) Symbiosis: from 1.0;0 through 1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-319
Affected vendors: abb
Affected products: terra_ac_wallbox_80a, terra_ac_wallbox_80a_firmware, terra_ac_wallbox_ce_juno, terra_ac_wallbox_ce_juno_firmware, terra_ac_wallbox_ce_mid, terra_ac_wallbox_ce_mid_firmware, terra_ac_wallbox_ce_ptb, terra_ac_wallbox_ce_ptb_firmware, terra_ac_wallbox_ce_symbiosis, terra_ac_wallbox_ce_symbiosis_firmware, terra_ac_wallbox_jp, terra_ac_wallbox_jp_firmware, terra_ac_wallbox_ul32a, terra_ac_wallbox_ul32a_firmware, terra_ac_wallbox_ul40, terra_ac_wallbox_ul40_firmware
CVE-2023-0865 (published 2023-03-20)
The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-639
Affected vendors: woocommerce_multiple_customer_addresses_\&_shipping_project
Affected products: woocommerce_multiple_customer_addresses_\&_shipping
CVE-2023-0866 (published 2023-02-16)
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3.0-DEV.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: gpac
Affected products: gpac
CVE-2023-0867 (published 2023-02-23)
Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization's private networks and should not be directly accessible
from the Internet.








Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: opennms
Affected products: horizon, meridian
CVE-2023-0868 (published 2023-02-23)
Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization's private networks and should not be directly accessible
from the Internet.











Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: opennms
Affected products: horizon, meridian
CVE-2023-0869 (published 2023-02-23)
Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. 











Meridian
and Horizon installation instructions state that they are intended for
installation within an organization's private networks and should not be
directly accessible from the Internet.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: opennms
Affected products: horizon, meridian
CVE-2023-0870 (published 2023-03-22)
A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)
Weakness: CWE-352
Affected vendors: opennms
Affected products: horizon, meridian
CVE-2023-0871 (published 2023-08-11)
XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
Weakness: CWE-611
Affected vendors: opennms
Affected products: horizon, meridian
CVE-2023-0872 (published 2023-08-14)
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

OpenNMS thanks Erik Wynter for reporting this issue.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: opennms
Affected products: horizon, meridian
CVE-2023-0873 (published 2023-06-27)
The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: kanbanwp
Affected products: kanban_boards_for_wordpress
CVE-2023-0874 (published 2023-04-10)
The Klaviyo WordPress plugin before 3.0.10 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: klaviyo
Affected products: klavio
CVE-2023-0875 (published 2023-03-20)
The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: joomunited
Affected products: wp_meta_seo
CVE-2023-0876 (published 2023-03-20)
The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: joomunited
Affected products: wp_meta_seo
CVE-2023-0877 (published 2023-02-17)
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: froxlor
Affected products: froxlor
CVE-2023-0878 (published 2023-02-17)
Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: nuxt
Affected products: nuxt
CVE-2023-0879 (published 2023-02-17)
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: btcpayserver
Affected products: btcpay_server
CVE-2023-0880 (published 2023-02-17)
Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-115
Affected vendors: phpmyfaq
Affected products: phpmyfaq
CVE-2023-0882 (published 2023-02-17)
Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse. This issue affects Single Connect: 2.16.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-639
Affected vendors: krontech, microsoft
Affected products: single_connect, windows
CVE-2023-0883 (published 2023-02-17)
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php-opos/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221350 is the identifier assigned to this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: online_pizza_ordering_system_project
Affected products: online_pizza_ordering_system
CVE-2023-0887 (published 2023-02-17)
A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical. This issue affects some unknown processing of the file tftpd64_svc.exe. The manipulation leads to unquoted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The associated identifier of this vulnerability is VDB-221351.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-428
Affected vendors: tftpd64_project
Affected products: tftpd64
CVE-2023-0888 (published 2023-03-13)
An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-95
Affected vendors: bbraun
Affected products: battery-pack_sp_with_wifi, battery-pack_sp_with_wifi_firmware
CVE-2023-0889 (published 2023-04-17)
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: metagauss
Affected products: themeflection_numbers
CVE-2023-0890 (published 2023-03-20)
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: getshortcodes
Affected products: shortcodes_ultimate
CVE-2023-0891 (published 2023-05-02)
The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: codestag
Affected products: stagtools
CVE-2023-0892 (published 2023-05-15)
The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: bizlibrary
Affected products: bizlibrary
CVE-2023-0893 (published 2023-04-10)
The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dcac
Affected products: time_sheets
CVE-2023-0894 (published 2023-05-08)
The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: byconsole
Affected products: pickup_\|_delivery_\|_dine-in_date_time
CVE-2023-0895 (published 2023-02-17)
The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-89
Affected vendors: wow-company
Affected products: wp_coder
CVE-2023-0896 (published 2023-05-01)
A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attacker with local network access. 
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: lenovo
Affected products: smart_clock_essential_with_alexa_built_in, smart_clock_essential_with_alexa_built_in_firmware
CVE-2023-0897 (published 2023-10-26)

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.





Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-384
Affected vendors: sielco
Affected products: polyeco1000, polyeco1000_firmware, polyeco300, polyeco300_firmware, polyeco500, polyeco500_firmware
CVE-2023-0898 (published 2023-11-07)

General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the application.





Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: ge
Affected products: micom_s1_agile
CVE-2023-0899 (published 2023-04-24)
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: wp_live_chat_shoutbox_project
Affected products: wp_live_chat_shoutbox
CVE-2023-0900 (published 2023-06-05)
The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: wpdevart
Affected products: pricing_table_builder
CVE-2023-0901 (published 2023-02-18)
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: pixelfed
Affected products: pixelfed
CVE-2023-0902 (published 2023-02-18)
A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: simple_food_ordering_system_project
Affected products: simple_food_ordering_system
CVE-2023-0903 (published 2023-02-18)
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file edit-task.php. The manipulation of the argument task_id leads to sql injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221452.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: employee_task_management_system_project
Affected products: employee_task_management_system
CVE-2023-0904 (published 2023-02-18)
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221453 was assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: employee_task_management_system_project
Affected products: employee_task_management_system
CVE-2023-0905 (published 2023-02-18)
A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221454 is the identifier assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-287
Affected vendors: employee_task_management_system_project
Affected products: employee_task_management_system
CVE-2023-0906 (published 2023-02-18)
A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. Affected by this vulnerability is the function delete_category of the file ajax.php of the component POST Parameter Handler. The manipulation leads to missing authentication. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-221455.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: online_pizza_ordering_system_project
Affected products: online_pizza_ordering_system
CVE-2023-0907 (published 2023-02-18)
A vulnerability, which was classified as problematic, has been found in Filseclab Twister Antivirus 8.17. Affected by this issue is the function 0x220017 in the library ffsmon.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221456.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-404
Affected vendors: filseclab
Affected products: twister_antivirus
CVE-2023-0908 (published 2023-02-18)
A vulnerability, which was classified as problematic, was found in Xoslab Easy File Locker 2.2.0.184. This affects the function MessageNotifyCallback in the library xlkfs.sys. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-221457 was assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-404
Affected vendors: xoslab
Affected products: easy_file_locker
CVE-2023-0909 (published 2023-02-18)
A vulnerability, which was classified as problematic, was found in cxasm notepad-- 1.22. This affects an unknown part of the component Directory Comparison Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The associated identifier of this vulnerability is VDB-221475.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-404
Affected vendors: notepad--_project
Affected products: notepad--
CVE-2023-0910 (published 2023-02-18)
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file view_prod.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-221476.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: online_pizza_ordering_system_project
Affected products: online_pizza_ordering_system
CVE-2023-0911 (published 2023-03-20)
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: getshortcodes
Affected products: shortcodes_ultimate
CVE-2023-0912 (published 2023-02-18)
A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. This affects an unknown part of the file /adms/admin/?page=vehicles/view_transaction. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221481 was assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: auto_dealer_management_system_project
Affected products: auto_dealer_management_system
CVE-2023-0913 (published 2023-02-18)
A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. This vulnerability affects unknown code of the file /adms/admin/?page=vehicles/sell_vehicle. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221482 is the identifier assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: auto_dealer_management_system_project
Affected products: auto_dealer_management_system
CVE-2023-0914 (published 2023-02-19)
Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-285
Affected vendors: pixelfed
Affected products: pixelfed