rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-0097 Post Grid, Post Carousel, & List Category Posts < 2.4.19 - Contributor+ Stored XSS
The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Post Grid, Post Carousel, & List Category Posts
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:47.957Z
CVE-2023-0098 Simple URLs < 115 - Subscriber+ SQLi
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Simple URLs
default_status: unaffected
Credits: lang: en
value: dc11
lang: en
value: WPScan
Published: 2023-02-13T14:32:15.988Z
CVE-2023-0099 Simple URLs < 115 - Multiple Reflected XSS
The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple URLs
default_status: unaffected
Credits: lang: en
value: WPScan
lang: en
value: WPScan
Published: 2023-02-13T14:32:05.647Z
CVE-2023-0100 
In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: The Eclipse Foundation
product: Eclipse BIRT (Business Intelligence Reporting Tool)
Published: 2023-03-15T00:00:00.000Z
CVE-2023-0101 
A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potentially execute a specially crafted file to obtain root or NT AUTHORITY / SYSTEM privileges on the Nessus host.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Nessus
Published: 2023-01-20T00:00:00.000Z
CVE-2023-0102 CVE-2023-0102
LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files.


Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: LS Electric
product: XBC-DN32U
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: HeeA Go of Dankook University reported these vulnerabilities.
Published: 2023-02-15T17:20:48.504Z
CVE-2023-0103 CVE-2023-0103
If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communication buffer, the device stops operating. This could allow an attacker to cause a denial-of-service condition.


Problem types: cwe_id: CWE-788
description: CWE-788 Access of Memory Location After End of Buffer
Affected products: vendor: LS Electric
product: XBC-DN32U
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: HeeA Go of Dankook University reported these vulnerabilities
Published: 2023-02-15T17:22:35.371Z
CVE-2023-0104 

The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user’s computer or gain access to sensitive data.   





Problem types: cwe_id: CWE-29
description: CWE-29 Path Traversal: '\..\filename'
Affected products: vendor: Weintek
product: EasyBuilder Pro cMT 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H
version: 3.1
Credits: lang: en
value: Hank Chen and Mars Cheng of PSIRT and Threat Research of TXOne Networks reported this vulnerability to CISA. Patrick Kuo of TXOne Networks also contributed to this research.
Published: 2023-02-22T20:25:04.680Z
CVE-2023-0105 
A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.
Problem types: description: n/a
Affected products: vendor: redhat.com
product: Keycloak
default_status: unaffected
Published: 2023-01-11T20:46:51.617Z
CVE-2023-0106 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: usememos
product: usememos/memos
Published: 2023-01-07T00:00:00.000Z
CVE-2023-0107 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: usememos
product: usememos/memos
Published: 2023-01-07T00:00:00.000Z
CVE-2023-0108 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: usememos
product: usememos/memos
Published: 2023-01-07T00:00:00.000Z
CVE-2023-0109 Stored XSS in usememos/memos
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: usememos
product: usememos/memos
Published: 2024-11-15T10:57:21.900Z
CVE-2023-0110 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: usememos
product: usememos/memos
Published: 2023-01-07T00:00:00.000Z
CVE-2023-0111 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: usememos
product: usememos/memos
Published: 2023-01-07T00:00:00.000Z
CVE-2023-0112 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: usememos
product: usememos/memos
Published: 2023-01-07T00:00:00.000Z
CVE-2023-0113 Netis Netcore Router Backup param.file.tgz information disclosure
A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-217591.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Disclosure
Affected products: vendor: Netis
product: Netcore Router
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: c4ng4c3ir0 (VulDB User)
Published: 2023-01-07T08:22:36.918Z
CVE-2023-0114 Netis Netcore Router Backup param.file.tgz cleartext storage in a file or on disk
A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to cleartext storage in a file or on disk. Local access is required to approach this attack. The identifier of this vulnerability is VDB-217592.
Problem types: cwe_id: CWE-313
description: CWE-313 Cleartext Storage in a File or on Disk
Affected products: vendor: Netis
product: Netcore Router
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Published: 2023-01-07T08:24:17.736Z
CVE-2023-0116 
The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Weaknesses Introduced During Design
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-05-26T00:00:00.000Z
CVE-2023-0117 
The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this vulnerability may affect availability of features,such as MeeTime.
Problem types: description: Improper Input Validation
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-05-26T00:00:00.000Z
CVE-2023-0118 Foreman: arbitrary code execution through templates
An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.
Problem types: cwe_id: CWE-78
description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.11 for RHEL 7
cpes: cpe:/a:redhat:satellite_capsule:6.11::el8
cpe:/a:redhat:satellite_capsule:6.11::el7
cpe:/a:redhat:satellite_utils:6.11::el8
cpe:/a:redhat:satellite:6.11::el7
cpe:/a:redhat:satellite_utils:6.11::el7
cpe:/a:redhat:satellite:6.11::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.11 for RHEL 7
cpes: cpe:/a:redhat:satellite_capsule:6.11::el8
cpe:/a:redhat:satellite_capsule:6.11::el7
cpe:/a:redhat:satellite_utils:6.11::el8
cpe:/a:redhat:satellite:6.11::el7
cpe:/a:redhat:satellite_utils:6.11::el7
cpe:/a:redhat:satellite:6.11::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.11 for RHEL 8
cpes: cpe:/a:redhat:satellite_capsule:6.11::el8
cpe:/a:redhat:satellite_capsule:6.11::el7
cpe:/a:redhat:satellite_utils:6.11::el8
cpe:/a:redhat:satellite:6.11::el7
cpe:/a:redhat:satellite_utils:6.11::el7
cpe:/a:redhat:satellite:6.11::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.11 for RHEL 8
cpes: cpe:/a:redhat:satellite_capsule:6.11::el8
cpe:/a:redhat:satellite_capsule:6.11::el7
cpe:/a:redhat:satellite_utils:6.11::el8
cpe:/a:redhat:satellite:6.11::el7
cpe:/a:redhat:satellite_utils:6.11::el7
cpe:/a:redhat:satellite:6.11::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.12 for RHEL 8
cpes: cpe:/a:redhat:satellite:6.12::el8
cpe:/a:redhat:satellite_capsule:6.12::el8
cpe:/a:redhat:satellite_utils:6.12::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.13 for RHEL 8
cpes: cpe:/a:redhat:satellite_capsule:6.13::el8
cpe:/a:redhat:satellite_utils:6.13::el8
cpe:/a:redhat:satellite_maintenance:6.13::el8
cpe:/a:redhat:satellite:6.13::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.14 for RHEL 8
cpes: cpe:/a:redhat:satellite_maintenance:6.14::el8
cpe:/a:redhat:satellite_utils:6.14::el8
cpe:/a:redhat:satellite:6.14::el8
cpe:/a:redhat:satellite_capsule:6.14::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.14 for RHEL 8
cpes: cpe:/a:redhat:satellite_maintenance:6.14::el8
cpe:/a:redhat:satellite_utils:6.14::el8
cpe:/a:redhat:satellite:6.14::el8
cpe:/a:redhat:satellite_capsule:6.14::el8
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Andrew Danau (Onsec.io) for reporting this issue.
Published: 2023-09-20T13:39:27.756Z
CVE-2023-0119 Foreman: stored cross-site scripting in host tab
A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Red Hat
product: Red Hat Satellite 6.13 for RHEL 8
cpes: cpe:/a:redhat:satellite_capsule:6.13::el8
cpe:/a:redhat:satellite_utils:6.13::el8
cpe:/a:redhat:satellite_maintenance:6.13::el8
cpe:/a:redhat:satellite:6.13::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.13 for RHEL 8
cpes: cpe:/a:redhat:satellite_capsule:6.13::el8
cpe:/a:redhat:satellite_utils:6.13::el8
cpe:/a:redhat:satellite_maintenance:6.13::el8
cpe:/a:redhat:satellite:6.13::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.14 for RHEL 8
cpes: cpe:/a:redhat:satellite_maintenance:6.14::el8
cpe:/a:redhat:satellite_utils:6.14::el8
cpe:/a:redhat:satellite:6.14::el8
cpe:/a:redhat:satellite_capsule:6.14::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.14 for RHEL 8
cpes: cpe:/a:redhat:satellite_maintenance:6.14::el8
cpe:/a:redhat:satellite_utils:6.14::el8
cpe:/a:redhat:satellite:6.14::el8
cpe:/a:redhat:satellite_capsule:6.14::el8
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Dinko Dimitrov (Onsec.io) for reporting this issue.
Published: 2023-09-12T15:14:29.533Z
CVE-2023-0120 Incorrect Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Credits: lang: en
value: Thanks [drjgouveia](https://hackerone.com/drjgouveia) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-09-01T10:01:51.685Z
CVE-2023-0121 Allocation of Resources Without Limits or Throttling in GitLab
A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Thanks [luryus](https://hackerone.com/luryus) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-06-07T00:00:00.000Z
CVE-2023-0122 
A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2023-01-17T00:00:00.000Z
CVE-2023-0123 CVE-2023-0123
Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.


Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Delta Industrial Automation
product: DOPSoft
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Natnael Samson (@NattiSamson), working with Trend Micro’s Zero Day Initiative
Published: 2023-02-02T22:57:48.508Z
CVE-2023-0124 CVE-2023-0124
Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to an out-of-bounds write, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.


Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Delta Industrial Automation
product: DOPSoft
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Natnael Samson (@NattiSamson), working with Trend Micro’s Zero Day Initiative
Published: 2023-02-02T22:59:15.110Z
CVE-2023-0125 Control iD Gerencia Web Web Interface cross site scripting
A vulnerability was found in Control iD Gerencia Web 1.30. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation of the argument Nome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217717 was assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Control iD
product: Gerencia Web
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: SQU4NCH
lang: en
value: Leonardo Teodoro (VulDB User)
lang: en
value: Leonardo Teodoro (VulDB User)
Published: 2023-01-09T20:51:06.425Z
CVE-2023-0126 
Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: SonicWall
product: SonicWall SMA1000
Published: 2023-01-19T00:00:00.000Z
CVE-2023-0127 
A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: D-Link DWL-2600AP with firmware v4.2.0.17
Published: 2023-02-11T00:00:00.000Z
CVE-2023-0128 
Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2023-01-10T00:00:00.000Z
CVE-2023-0129 
Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and specific interactions. (Chromium security severity: High)
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2023-01-10T00:00:00.000Z
CVE-2023-0130 
Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2023-01-10T00:00:00.000Z
CVE-2023-0131 
Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2023-01-10T00:00:00.000Z
CVE-2023-0132 
Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2023-01-10T00:00:00.000Z