alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2023-23355 (published 2023-03-29)
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors.
QES is not affected.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2346 build 20230322 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2348 build 20230324 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: qnap
Affected products: qts, quts_hero, qutscloud, qvp-21a, qvp-21a_firmware, qvp-41a, qvp-41a_firmware, qvp-41b, qvp-41b_firmware, qvp-63a, qvp-63a_firmware, qvp-63b, qvp-63b_firmware, qvp-85a, qvp-85a_firmware, qvp-85b, qvp-85b_firmware, qvr
CVE-2023-23356 (published 2024-12-19)
A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands.

We have already fixed the vulnerability in the following versions:
QuFirewall 2.3.3 ( 2023/03/27 ) and later
  and later
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: qnap
Affected products: qufirewall
CVE-2023-23357 (published 2024-12-19)
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following versions:
QuLog Center 1.5.0.738 ( 2023/03/06 ) and later
QuLog Center 1.4.1.691 ( 2023/03/01 ) and later
QuLog Center 1.3.1.645 ( 2023/02/22 ) and later
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: qnap
Affected products: qts, qulog_center, quts_hero, qutscloud
CVE-2023-2336 (published 2023-04-27)
Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: pimcore
Affected products: pimcore
CVE-2023-23362 (published 2023-09-22)
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2376 build 20230421 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2376 build 20230421 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: qnap
Affected products: qts, quts_hero, qutscloud
CVE-2023-23363 (published 2023-09-22)
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.

We have already fixed the vulnerability in the following versions:
QTS 4.3.6.2441 build 20230621 and later
QTS 4.3.3.2420 build 20230621 and later
QTS 4.2.6 build 20230621 and later
QTS 4.3.4.2451 build 20230621 and later

Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qnap
Affected products: qts
CVE-2023-23364 (published 2023-09-22)
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.

We have already fixed the vulnerability in the following versions:
Multimedia Console 2.1.1 ( 2023/03/29 ) and later
Multimedia Console 1.4.7 ( 2023/03/20 ) and later

Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qnap
Affected products: multimedia_console
CVE-2023-23365 (published 2023-10-06)
A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following version:
Music Station 5.3.22 and later

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: qnap
Affected products: music_station
CVE-2023-23366 (published 2023-10-06)
A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following version:
Music Station 5.3.22 and later

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: qnap
Affected products: music_station
CVE-2023-23367 (published 2023-11-10)
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2376 build 20230421 and later
QuTS hero h5.0.1.2376 build 20230421 and later
QuTScloud c5.1.0.2498 and later

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: qnap
Affected products: qts, quts_hero, qutscloud
CVE-2023-23368 (published 2023-11-03)
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2376 build 20230421 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2376 build 20230421 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later

Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: qnap
Affected products: qts, quts_hero, qutscloud
CVE-2023-23369 (published 2023-11-03)
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions:
Multimedia Console 2.1.2 ( 2023/05/04 ) and later
Multimedia Console 1.4.8 ( 2023/05/05 ) and later
QTS 5.1.0.2399 build 20230515 and later
QTS 4.3.6.2441 build 20230621 and later
QTS 4.3.4.2451 build 20230621 and later
QTS 4.3.3.2420 build 20230621 and later
QTS 4.2.6 build 20230621 and later
Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later
Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: qnap
Affected products: media_streaming_add-on, multimedia_console, qts
CVE-2023-2337 (published 2023-06-05)
The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: convertkit
Affected products: convertkit_-_email_marketing\,_email_newsletter_and_landing_pages
CVE-2023-23370 (published 2023-10-06)
An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors.

We have already fixed the vulnerability in the following version:
QVPN Windows 2.1.0.0518 and later

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: qnap
Affected products: qvpn
CVE-2023-23371 (published 2023-10-06)
A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors.

We have already fixed the vulnerability in the following version:
QVPN Windows 2.2.0.0823 and later

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-311
Affected vendors: qnap
Affected products: qvpn
CVE-2023-23372 (published 2023-12-08)
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to inject malicious code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2425 build 20230609 and later
QTS 5.1.0.2444 build 20230629 and later
QTS 4.5.4.2467 build 20230718 and later
QuTS hero h5.1.0.2424 build 20230609 and later
QuTS hero h5.0.1.2515 build 20230907 and later
QuTS hero h4.5.4.2476 build 20230728 and later

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: qnap
Affected products: qts, quts_hero
CVE-2023-23373 (published 2023-10-20)
An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following version:
QUSBCam2 2.0.3 ( 2023/06/15 ) and later

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: qnap
Affected products: qusbcam2
CVE-2023-23374 (published 2023-02-14)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Affected vendors: google, microsoft
Affected products: android, edge_chromium
CVE-2023-23375 (published 2023-04-11)
Microsoft ODBC and OLE DB Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: microsoft
Affected products: odbc, ole_db
CVE-2023-23376 (published 2023-02-14)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
Added to CISA KEV catalog: 2023-02-14
KEV required action: Apply updates per vendor instructions.
CVE-2023-23377 (published 2023-02-14)
3D Builder Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: microsoft
Affected products: 3d_builder
CVE-2023-23378 (published 2023-02-14)
Print 3D Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: microsoft
Affected products: print_3d
CVE-2023-23379 (published 2023-02-14)
Microsoft Defender for IoT Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-23
Affected vendors: microsoft
Affected products: defender_for_iot
CVE-2023-2338 (published 2023-04-27)
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: pimcore
Affected products: pimcore
CVE-2023-23381 (published 2023-02-14)
Visual Studio Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: microsoft
Affected products: visual_studio_2017, visual_studio_2019, visual_studio_2022
CVE-2023-23382 (published 2023-02-14)
Azure Machine Learning Compute Instance Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-257
Affected vendors: microsoft
Affected products: azure_machine_learning
CVE-2023-23383 (published 2023-03-14)
Service Fabric Explorer Spoofing Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: microsoft
Affected products: azure_service_fabric
CVE-2023-23384 (published 2023-04-11)
Microsoft SQL Server Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-122
Affected vendors: microsoft
Affected products: sql_server
CVE-2023-23385 (published 2023-03-14)
Windows Point-to-Point Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23388 (published 2023-03-14)
Windows Bluetooth Driver Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-681
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23389 (published 2023-03-14)
Microsoft Defender Elevation of Privilege Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-367
Affected vendors: microsoft
Affected products: malware_protection_engine
CVE-2023-2339 (published 2023-04-27)
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pimcore
Affected products: pimcore
CVE-2023-23390 (published 2023-02-14)
3D Builder Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: microsoft
Affected products: 3d_builder
CVE-2023-23391 (published 2023-03-14)
Office for Android Spoofing Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-23
Affected vendors: microsoft
Affected products: 365_copilot
CVE-2023-23392 (published 2023-03-14)
HTTP Protocol Stack Remote Code Execution Vulnerability
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: microsoft
Affected products: windows_11_21h2, windows_11_22h2, windows_server_2022
CVE-2023-23393 (published 2023-03-14)
Windows BrokerInfrastructure Service Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-591
Affected vendors: microsoft
Affected products: windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2019, windows_server_2022
CVE-2023-23394 (published 2023-03-14)
Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-822
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23395 (published 2023-03-14)
Microsoft SharePoint Server Spoofing Vulnerability
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-601
Affected vendors: microsoft
Affected products: sharepoint_foundation, sharepoint_server
CVE-2023-23396 (published 2023-03-14)
Microsoft Excel Denial of Service Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: microsoft
Affected products: office_online_server, office_web_apps_server
CVE-2023-23397 (published 2023-03-14)
Microsoft Outlook Elevation of Privilege Vulnerability
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel, outlook
Added to CISA KEV catalog: 2023-03-14
KEV required action: Apply updates per vendor instructions.
CVE-2023-23398 (published 2023-03-14)
Microsoft Excel Spoofing Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Weakness: CWE-290
Affected vendors: microsoft
Affected products: 365_apps, excel, office, office_long_term_servicing_channel
CVE-2023-23399 (published 2023-03-14)
Microsoft Excel Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: microsoft
Affected products: 365_apps, excel, office, office_long_term_servicing_channel, office_online_server, office_web_apps_server
CVE-2023-2340 (published 2023-04-27)
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pimcore
Affected products: pimcore
CVE-2023-23400 (published 2023-03-14)
Windows DNS Server Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: microsoft
Affected products: windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23401 (published 2023-03-14)
Windows Media Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-681
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23402 (published 2023-03-14)
Windows Media Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-415
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23403 (published 2023-03-14)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23404 (published 2023-03-14)
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23405 (published 2023-03-14)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23406 (published 2023-03-14)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23407 (published 2023-03-14)
Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-591
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23408 (published 2023-03-14)
Azure Apache Ambari Spoofing Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-79
Affected vendors: microsoft
Affected products: azure_hdinsight
CVE-2023-23409 (published 2023-03-14)
Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-2341 (published 2023-04-27)
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pimcore
Affected products: pimcore
CVE-2023-23410 (published 2023-03-14)
Windows HTTP.sys Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23411 (published 2023-03-14)
Windows Hyper-V Denial of Service Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23412 (published 2023-03-14)
Windows Accounts Picture Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23413 (published 2023-03-14)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-908
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23414 (published 2023-03-14)
Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-591
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23415 (published 2023-03-14)
Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23416 (published 2023-03-14)
Windows Cryptographic Services Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23417 (published 2023-03-14)
Windows Partition Management Driver Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: microsoft
Affected products: windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23418 (published 2023-03-14)
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: microsoft
Affected products: windows_11_22h2
CVE-2023-23419 (published 2023-03-14)
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: microsoft
Affected products: windows_11_22h2
CVE-2023-2342 (published 2023-04-27)
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pimcore
Affected products: pimcore
CVE-2023-23420 (published 2023-03-14)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: microsoft
Affected products: windows_10, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23421 (published 2023-03-14)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: microsoft
Affected products: windows_10, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23422 (published 2023-03-14)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23423 (published 2023-03-14)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2023-23424 (published 2023-12-29)

Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution


Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: hihonor
Affected products: nth-an00, nth-an00_firmware
CVE-2023-23426 (published 2023-12-29)

Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: hihonor
Affected products: fri-an00, fri-an00_firmware
CVE-2023-23427 (published 2023-12-29)

Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-269
Affected vendors: honor
Affected products: magicos
CVE-2023-23428 (published 2023-12-29)

Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-269
Affected vendors: honor
Affected products: magicos
CVE-2023-23429 (published 2023-12-29)

Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-269
Affected vendors: honor
Affected products: magicos
CVE-2023-2343 (published 2023-04-27)
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pimcore
Affected products: pimcore
CVE-2023-23430 (published 2023-12-29)

Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-269
Affected vendors: hihonor
Affected products: magichome
CVE-2023-23431 (published 2023-12-29)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-347
Affected vendors: hihonor
Affected products: nth-an00, nth-an00_firmware
CVE-2023-23432 (published 2023-12-29)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-347
Affected vendors: hihonor
Affected products: nth-an00, nth-an00_firmware
CVE-2023-23433 (published 2023-12-29)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-347
Affected vendors: hihonor
Affected products: nth-an00, nth-an00_firmware
CVE-2023-23434 (published 2023-12-29)

Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: hihonor
Affected products: honorboardapp
CVE-2023-23435 (published 2023-12-29)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-347
Affected vendors: honor
Affected products: magicos
CVE-2023-23436 (published 2023-12-29)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file





Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-347
Affected vendors: honor
Affected products: magicos
CVE-2023-23437 (published 2023-12-29)

Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-922
Affected vendors: hihonor
Affected products: vmall
CVE-2023-23438 (published 2023-12-29)

Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-269
Affected vendors: hihonor
Affected products: lge-an00, lge-an00_firmware
CVE-2023-23439 (published 2023-12-29)

Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: hihonor
Affected products: lge-an00, lge-an00_firmware
CVE-2023-2344 (published 2023-04-27)
A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_service of the component HTTP POST Request Handler. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227587.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: oretnom23
Affected products: service_provider_management_system
CVE-2023-23440 (published 2023-12-29)

Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: hihonor
Affected products: lge-an00, lge-an00_firmware
CVE-2023-23441 (published 2023-12-29)

Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: hihonor
Affected products: magic_ui
CVE-2023-23442 (published 2023-12-29)

Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-843
Affected vendors: honor
Affected products: magicos
CVE-2023-23443 (published 2023-12-29)

Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-843
Affected vendors: hihonor
Affected products: magic_os
CVE-2023-23444 (published 2023-05-12)
Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an unauthenticated remote attacker to influence the availability of the device by changing the IP settings of the device via broadcasted UDP packets.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Weakness: CWE-306
Affected vendors: sick
Affected products: fx0-gent00000, fx0-gent00000_firmware, fx0-gent00010, fx0-gent00010_firmware, fx0-gent00030, fx0-gent00030_firmware, fx0-gmod00000, fx0-gmod00000_firmware, fx0-gmod00010, fx0-gmod00010_firmware, fx0-gpnt00000, fx0-gpnt00000_firmware, fx0-gpnt00010, fx0-gpnt00010_firmware, fx0-gpnt00030, fx0-gpnt00030_firmware, ue410-en1, ue410-en1_firmware, ue410-en3, ue410-en3_firmware, ue410-en4, ue410-en4_firmware
CVE-2023-23445 (published 2023-05-15)
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers
1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote
attacker to gain unauthorized access to data fields by using a therefore unpriviledged account via the
REST interface.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: sick
Affected products: ftmg-esd15axx, ftmg-esd15axx_firmware, ftmg-esd20axx, ftmg-esd20axx_firmware, ftmg-esd25axx, ftmg-esd25axx_firmware, ftmg-esn40sxx, ftmg-esn40sxx_firmware, ftmg-esn50sxx, ftmg-esn50sxx_firmware, ftmg-esr40sxx, ftmg-esr40sxx_firmware, ftmg-esr50sxx, ftmg-esr50sxx_firmware
CVE-2023-23446 (published 2023-05-15)
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers
1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the REST interface.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: sick
Affected products: ftmg-esd15axx, ftmg-esd15axx_firmware, ftmg-esd20axx, ftmg-esd20axx_firmware, ftmg-esd25axx, ftmg-esd25axx_firmware, ftmg-esn40sxx, ftmg-esn40sxx_firmware, ftmg-esn50sxx, ftmg-esn50sxx_firmware, ftmg-esr40sxx, ftmg-esr40sxx_firmware, ftmg-esr50sxx, ftmg-esr50sxx_firmware
CVE-2023-23447 (published 2023-05-15)
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged
remote attacker to influence the availability of the webserver by invocing several open file requests via
the REST interface.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: sick
Affected products: ftmg-esd15axx, ftmg-esd15axx_firmware, ftmg-esd20axx, ftmg-esd20axx_firmware, ftmg-esd25axx, ftmg-esd25axx_firmware, ftmg-esn40sxx, ftmg-esn40sxx_firmware, ftmg-esn50sxx, ftmg-esn50sxx_firmware, ftmg-esr40sxx, ftmg-esr40sxx_firmware, ftmg-esr50sxx, ftmg-esr50sxx_firmware
CVE-2023-23448 (published 2023-05-15)
Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a
remote attacker to gain information about valid usernames via analysis of source code.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-540
Affected vendors: sick
Affected products: ftmg-esd15axx, ftmg-esd15axx_firmware, ftmg-esd20axx, ftmg-esd20axx_firmware, ftmg-esd25axx, ftmg-esd25axx_firmware, ftmg-esn40sxx, ftmg-esn40sxx_firmware, ftmg-esn50sxx, ftmg-esn50sxx_firmware, ftmg-esr40sxx, ftmg-esr40sxx_firmware, ftmg-esr50sxx, ftmg-esr50sxx_firmware
CVE-2023-23449 (published 2023-05-15)
Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker
to gain information about valid usernames by analyzing challenge responses from the server via the
REST interface.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-204
Affected vendors: sick
Affected products: ftmg-esd15axx, ftmg-esd15axx_firmware, ftmg-esd20axx, ftmg-esd20axx_firmware, ftmg-esd25axx, ftmg-esd25axx_firmware, ftmg-esn40sxx, ftmg-esn40sxx_firmware, ftmg-esn50sxx, ftmg-esn50sxx_firmware, ftmg-esr40sxx, ftmg-esr40sxx_firmware, ftmg-esr50sxx, ftmg-esr50sxx_firmware
CVE-2023-2345 (published 2023-04-27)
A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to improper authorization. The attack may be launched remotely. The identifier of this vulnerability is VDB-227588.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-285
Affected vendors: oretnom23
Affected products: service_provider_management_system
CVE-2023-23450 (published 2023-05-15)
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR
FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526
allows an unprivileged remote attacker to use a password hash instead of an actual password to login
to a valid user account via the REST interface.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-836
Affected vendors: sick
Affected products: ftmg-esd15axx, ftmg-esd15axx_firmware, ftmg-esd20axx, ftmg-esd20axx_firmware, ftmg-esd25axx, ftmg-esd25axx_firmware, ftmg-esn40sxx, ftmg-esn40sxx_firmware, ftmg-esn50sxx, ftmg-esn50sxx_firmware, ftmg-esr40sxx, ftmg-esr40sxx_firmware, ftmg-esr50sxx, ftmg-esr50sxx_firmware
CVE-2023-23451 (published 2023-04-19)
The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN1 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN3S04 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN4 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK FX0-GENT00000 FLEXISOFT EIP GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GMOD00000 FLEXISOFT MOD GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GPNT00000 FLEXISOFT PNET GATEW. with serial number <=2311xxxx with Firmware <=V2.12.0, SICK FX0-GENT00030 FLEXISOFT EIP GATEW.V2 with serial number <=2311xxxx all Firmware versions, SICK FX0-GPNT00030 FLEXISOFT PNET GATEW.V2 with serial number <=2311xxxx all Firmware versions and SICK FX0-GMOD00010 FLEXISOFT MOD GW with serial number <=2311xxxx with Firmware <=V2.11.0 all have Telnet enabled by factory default. No password is set in the default configuration.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-477
Affected vendors: sick
Affected products: fx0-gent00000, fx0-gent00000_firmware, fx0-gent00030, fx0-gent00030_firmware, fx0-gmod00000, fx0-gmod00000_firmware, fx0-gmod00010, fx0-gmod00010_firmware, fx0-gpnt00000, fx0-gpnt00000_firmware, fx0-gpnt00030, fx0-gpnt00030_firmware, ue410-en1, ue410-en1_firmware, ue410-en3, ue410-en3_firmware, ue410-en3s04, ue410-en3s04_firmware, ue410-en4, ue410-en4_firmware
CVE-2023-23452 (published 2023-02-20)
Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution via maliciously crafted RK512 commands to the listener on TCP port 9000.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: sick
Affected products: fx0-gpnt00000, fx0-gpnt00000_firmware, fx0-gpnt00010, fx0-gpnt00010_firmware
CVE-2023-23453 (published 2023-02-20)
Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution via maliciously crafted RK512 commands to the listener on TCP port 9000.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: sick
Affected products: fx0-gent00000, fx0-gent00000_firmware, fx0-gent00010, fx0-gent00010_firmware
CVE-2023-23454 (published 2023-01-12)
cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-843
Affected vendors: debian, linux
Affected products: debian_linux, linux_kernel
CVE-2023-23455 (published 2023-01-12)
atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-843
Affected vendors: debian, linux
Affected products: debian_linux, linux_kernel
CVE-2023-23456 (published 2023-01-12)
A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: fedoraproject, upx
Affected products: fedora, upx
CVE-2023-23457 (published 2023-01-12)
A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: fedoraproject, upx
Affected products: fedora, upx
CVE-2023-23458 (published 2023-02-15)
Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: sunellsecurity
Affected products: sn-adr3804e1, sn-adr3804e1_firmware, sn-adr3808e1, sn-adr3808e1_firmware, sn-adr3808e2, sn-adr3808e2_firmware, sn-adr3816e1, sn-adr3816e1_firmware, sn-adr3816e2, sn-adr3816e2_firmware, sn-xvr3804e1, sn-xvr3804e1_firmware, sn-xvr3808e2, sn-xvr3808e2_firmware
CVE-2023-23459 (published 2023-02-15)
Priority Windows may allow Command Execution via SQL Injection using an unspecified method.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: microsoft, priority-software
Affected products: priority, windows
CVE-2023-2346 (published 2023-04-27)
A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227589 was assigned to this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: oretnom23
Affected products: service_provider_management_system