rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-22939 SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk Enterprise
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled.
Problem types: cwe_id: CWE-20
description: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.
Affected products: vendor: Splunk
product: Splunk Enterprise
vendor: Splunk
product: Splunk Cloud Platform
CVSS v3.1: vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Klevis Luli, Splunk
Published: 2023-02-14T17:24:47.539Z
CVE-2023-22940 SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.
Problem types: cwe_id: CWE-20
description: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.
Affected products: vendor: Splunk
product: Splunk Enterprise
vendor: Splunk
product: Splunk Cloud Platform
CVSS v3.1: vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.1
baseScore: 6.3
baseSeverity: MEDIUM
Credits: lang: en
value: James Ervin, Splunk
Published: 2023-02-14T17:22:34.688Z
CVE-2023-22941 Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).
Problem types: cwe_id: CWE-248
description: An exception is thrown from a function, but it is not caught.
Affected products: vendor: Splunk
product: Splunk Enterprise
vendor: Splunk
product: Splunk Cloud Platform
CVSS v3.1: vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: James Ervin, Splunk
Published: 2023-02-14T17:22:37.444Z
CVE-2023-22942 Cross-Site Request Forgery in the ‘ssg/kvstore_client’ REST Endpoint in Splunk Enterprise
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request.
Problem types: cwe_id: CWE-352
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Affected products: vendor: Splunk
product: Splunk Enterprise
CVSS v3.1: vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Anton (therceman)
Published: 2023-02-14T17:22:39.330Z
CVE-2023-22943 Modular Input REST API Requests Connect via HTTP after Certificate Validation Failure in Splunk Add-on Builder and Splunk CloudConnect SDK
In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs.
Problem types: cwe_id: CWE-636
description: When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
Affected products: vendor: Splunk
product: Splunk Add-on Builder
vendor: Splunk
product: Splunk CloudConnect SDK
CVSS v3.1: vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
baseScore: 4.8
baseSeverity: MEDIUM
Credits: lang: en
value: Chris Green
Published: 2023-02-14T17:22:40.690Z
CVE-2023-22945 
In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll as mentors or edit any of their mentorship-related properties.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-11T00:00:00.000Z
CVE-2023-22946 Apache Spark proxy-user privilege escalation from malicious configuration class
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that 
spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its 
default of "false", and is not overridden by submitted applications.



Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Apache Software Foundation
product: Apache Spark
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Hideyuki Furue
lang: en
value: Yi Wu (Databricks)
Published: 2023-04-17T07:30:19.865Z
CVE-2023-22947 
Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt (rather than C:\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that "We consider the ACLs a best effort thing" and "it was a documentation mistake."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-11T00:00:00.000Z
CVE-2023-22948 
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs as the tigergraph user is able to read the SSH private key. With this, an attacker is granted password-less SSH access to all machines in the TigerGraph cluster.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-13T00:00:00.000Z
CVE-2023-22949 
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That could allow a TigerGraph administrator to effectively harvest usernames/passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2023-22950 
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permissions, can read sensitive data from arbitrary locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-13T00:00:00.000Z
CVE-2023-22951 
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the configuration file. Using this token on the REST API provides an attacker with anonymous admin-level privileges on all REST API endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-13T00:00:00.000Z
CVE-2023-22952 
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-11T00:00:00.000Z
CVE-2023-22953 
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-09T00:00:00.000Z
CVE-2023-22955 
An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums for the flasher tool, an attacker is able to store malicious firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2023-22956 
An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is able to decrypt encrypted configuration files and retrieve sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2023-22957 
An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive information, e.g., the device root password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2023-22958 
The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-11T00:00:00.000Z
CVE-2023-22959 
WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-11T00:00:00.000Z
CVE-2023-22960 
Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-23T00:00:00.000Z
CVE-2023-22963 
The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-11T00:00:00.000Z
CVE-2023-22964 
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2023-22970 
Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-26T00:00:00.000Z
CVE-2023-22971 
Cross Site Scripting (XSS) vulnerability in Hughes Network Systems Router Terminal for HX200 v8.3.1.14, HX90 v6.11.0.5, HX50L v6.10.0.18, HN9460 v8.2.0.48, and HN7000S v6.9.0.37, allows unauthenticated attackers to misuse frames, include JS/HTML code and steal sensitive information from legitimate users of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-26T00:00:00.000Z
CVE-2023-22972 
A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUEST_URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-22T00:00:00.000Z
CVE-2023-22973 
A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-22T00:00:00.000Z
CVE-2023-22974 
A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-22T00:00:00.000Z
CVE-2023-22975 
A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2023-22984 
A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker to execute arbitrary JavaScript via URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-21T00:00:00.000Z
CVE-2023-22985 
Sourcecodester Simple Guestbook Management System version 1 is vulnerable to Cross Site Scripting (XSS) via Name, Referrer, Location, and Comments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-06T00:00:00.000Z
CVE-2023-22995 
In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-28T00:00:00.000Z
CVE-2023-22996 
In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-28T00:00:00.000Z
CVE-2023-22997 
In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-28T00:00:00.000Z
CVE-2023-22998 
In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-28T00:00:00.000Z
CVE-2023-22999 
In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-28T00:00:00.000Z
CVE-2023-23000 
In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-01T00:00:00.000Z
CVE-2023-23001 
In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-01T00:00:00.000Z
CVE-2023-23002 
In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-01T00:00:00.000Z
CVE-2023-23003 
In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-01T00:00:00.000Z
CVE-2023-23004 
In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-01T00:00:00.000Z
CVE-2023-23005 
In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-01T00:00:00.000Z
CVE-2023-23006 
In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-01T00:00:00.000Z
CVE-2023-23007 
An issue was discovered in ESPCMS P8.21120101 after logging in to the background, there is a SQL injection vulnerability in the function node where members are added.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2023-23009 
Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-21T00:00:00.000Z
CVE-2023-23010 
Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows attackers to execute arbitrary code via the languages and trans_load parameters in file add_product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2023-23011 
Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-07T00:00:00.000Z
CVE-2023-23012 
Cross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecified impacts via the input bgcol in file Weeks.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2023-23014 
Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_store_name and edit_active inputs in file InventorySystem.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2023-23015 
Cross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2023-23019 
Cross site scripting (XSS) vulnerability in file main.php in sourcecodester oretnom23 Blog Site 1.0 via the name and email parameters to function user_add.\
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-01T00:00:00.000Z
CVE-2023-23021 
Cross Site Scripting (XSS) vulnerability in sourcecodester oretnom23 pos point sale system 1.0, allows attackers to execute arbitrary code via the code, name, and description inputs in file Main.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-01T00:00:00.000Z
CVE-2023-23022 
Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 employee's payroll management system 1.0, allows attackers to execute arbitrary code via the code, title, from_date and to_date inputs in file Main.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-01T00:00:00.000Z
CVE-2023-23024 
Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the writer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2023-23026 
Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to execute arbitrary code via the product_name and product_price inputs in file print.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-07T00:00:00.000Z
CVE-2023-23039 
An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-22T00:00:00.000Z
CVE-2023-23040 
TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-22T00:00:00.000Z
CVE-2023-23059 
An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions within the default installation and allows attackers to execute arbitrary code and gain escalated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-04T00:00:00.000Z
CVE-2023-23063 
Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-22T00:00:00.000Z
CVE-2023-23064 
TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2023-23073 
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23074 
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23075 
Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23076 
OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z