rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-37562 
Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed.
Problem types: description: Cross-site request forgery (CSRF)
Affected products: vendor: ELECOM CO.,LTD.
product: WTC-C1167GC-B
vendor: ELECOM CO.,LTD.
product: WTC-C1167GC-W
Published: 2023-07-13T02:55:50.990Z
CVE-2023-37563 
ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtain sensitive information. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, WRC-1167FEBK-A v1.18 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1467GHBK-S all versions, WRC-1900GHBK-A all versions, and WRC-1900GHBK-S all versions.
Problem types: description: Information disclosure
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1167GEBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1167FEBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK3-A
vendor: ELECOM CO.,LTD.
product: WRC-1167FEBK-A
vendor: ELECOM CO.,LTD.
product: WRC-F1167ACF2
vendor: ELECOM CO.,LTD.
product: WRC-600GHBK-A
vendor: ELECOM CO.,LTD.
product: WRC-733FEBK2-A
vendor: ELECOM CO.,LTD.
product: WRC-1467GHBK-A
vendor: ELECOM CO.,LTD.
product: WRC-1467GHBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1900GHBK-A
vendor: ELECOM CO.,LTD.
product: WRC-1900GHBK-S
Published: 2023-07-13T02:59:04.187Z
CVE-2023-37564 
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a root privilege by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, and WRC-1167FEBK-A v1.18 and earlier.
Problem types: description: OS command injection
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1167GEBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1167FEBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK3-A
vendor: ELECOM CO.,LTD.
product: WRC-1167FEBK-A
Published: 2023-07-13T03:01:41.200Z
CVE-2023-37565 
Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, and WRC-1167FEBK-A v1.18 and earlier.
Problem types: description: Code injection
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1167GEBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1167FEBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK3-A
vendor: ELECOM CO.,LTD.
product: WRC-1167FEBK-A
Published: 2023-07-13T03:04:25.910Z
CVE-2023-37566 
Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A v1.24 and earlier, WRC-1167FEBK-A v1.18 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, and LAN-W301NR all versions.
Problem types: description: Arbitrary command execution
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK3-A
vendor: ELECOM CO.,LTD.
product: WRC-1167FEBK-A
vendor: ELECOM CO.,LTD.
product: WRC-F1167ACF2
vendor: ELECOM CO.,LTD.
product: WRC-600GHBK-A
vendor: ELECOM CO.,LTD.
product: WRC-733FEBK2-A
vendor: ELECOM CO.,LTD.
product: WRC-1467GHBK-A
vendor: ELECOM CO.,LTD.
product: WRC-1900GHBK-A
vendor: LOGITEC CORPORATION
product: LAN-W301NR
Published: 2023-07-13T01:44:48.791Z
CVE-2023-37567 
Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A v1.24 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, and LAN-W301NR all versions.
Problem types: description: Arbitrary command execution
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK3-A
vendor: ELECOM CO.,LTD.
product: WRC-F1167ACF2
vendor: ELECOM CO.,LTD.
product: WRC-600GHBK-A
vendor: ELECOM CO.,LTD.
product: WRC-733FEBK2-A
vendor: ELECOM CO.,LTD.
product: WRC-1467GHBK-A
vendor: ELECOM CO.,LTD.
product: WRC-1900GHBK-A
vendor: LOGITEC CORPORATION
product: LAN-W301NR
Published: 2023-07-13T01:46:47.274Z
CVE-2023-37568 
ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page.
Problem types: description: Arbitrary command execution
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK-S
vendor: ELECOM CO.,LTD.
product: WRC-1167GEBK-S
Published: 2023-07-13T01:48:09.334Z
CVE-2023-37569 OS Command Injection Vulnerability in Emagic Data Center Management Suite
This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system.

Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on targeted system.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: ESDS
product: Emagic Data Center Management Suite
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Shubham Pandey of C3i Center, IIT Kanpur
lang: en
value: Lohitya Pushkar of C3i Center, IIT Kanpur
lang: en
value: Chinamay Joshi of ESDS Software Solution Limited, Maharashtra
Published: 2023-08-08T08:04:22.979Z
CVE-2023-37570 Insufficient Session Expiration Vulnerability in Emagic Data Center Management Suite
This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. 
By reusing the stolen cookie, a remote attacker could gain unauthorized access to the targeted system.

Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: ESDS
product: Emagic Data Center Management Suite
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Chinamay Joshi of ESDS Software Solution Limited, Maharashtra
Published: 2023-08-08T08:11:08.948Z
CVE-2023-37571 
Softing TH SCOPE through 3.70 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-30T00:00:00.000Z
CVE-2023-37572 
Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSF_discovery service. The service executable could be changed or the service could be deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-05T00:00:00.000Z
CVE-2023-37573 
Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI's recoder (default) VCD parsing code.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: GTKWave
product: GTKWave
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2024-01-08T14:47:51.260Z
CVE-2023-37574 
Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI's legacy VCD parsing code.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: GTKWave
product: GTKWave
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2024-01-08T14:47:51.369Z
CVE-2023-37575 
Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI's interactive VCD parsing code.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: GTKWave
product: GTKWave
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2024-01-08T14:47:51.477Z
CVE-2023-37576 
Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2vzt conversion utility.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: GTKWave
product: GTKWave
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2024-01-08T14:47:51.560Z
CVE-2023-37577 
Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt2 conversion utility.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: GTKWave
product: GTKWave
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2024-01-08T14:47:51.642Z
CVE-2023-37578 
Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt conversion utility.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: GTKWave
product: GTKWave
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2024-01-08T14:47:51.743Z
CVE-2023-37579 Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials
Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker.

This issue affects Apache Pulsar: before 2.10.4, and 2.11.0.

Any authenticated user can retrieve a source's configuration or a sink's configuration without authorization. Many sources and sinks contain credentials in the configuration, which could lead to leaked credentials. This vulnerability is mitigated by the fact that there is not a known way for an authenticated user to enumerate another tenant's sources or sinks, meaning the source or sink name would need to be guessed in order to exploit this vulnerability.

The recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version.

2.10 Pulsar Function Worker users should upgrade to at least 2.10.4.
2.11 Pulsar Function Worker users should upgrade to at least 2.11.1.
3.0 Pulsar Function Worker users are unaffected.
Any users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions.


Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Apache Software Foundation
product: Apache Pulsar Function Worker
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Michael Marshall of DataStax
Published: 2023-07-12T09:05:24.408Z
CVE-2023-37580 
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-31T00:00:00.000Z
CVE-2023-37581 Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.
Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature. 


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Apache Software Foundation
product: Apache Roller
default_status: affected
Credits: lang: en
value: SecureLayer7 Technologies Pvt Ltd
Published: 2023-08-06T07:21:04.307Z
CVE-2023-37582 Apache RocketMQ: Possible remote code execution when using the update configuration function
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. 

When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. 

It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Apache Software Foundation
product: Apache RocketMQ
default_status: unaffected
Credits: lang: en
value: soreatu@gmail.com
lang: en
value: yuansec@outlook.com
Published: 2023-07-12T09:26:18.652Z
CVE-2023-37596 
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-11T00:00:00.000Z
CVE-2023-37597 
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete user grouplist function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-11T00:00:00.000Z
CVE-2023-37598 
A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-13T00:00:00.000Z
CVE-2023-37599 
An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-13T00:00:00.000Z
CVE-2023-37600 
Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-20T00:00:00.000Z
CVE-2023-37601 
Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-20T00:00:00.000Z
CVE-2023-37602 
An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-20T00:00:00.000Z
CVE-2023-37605 
Weak Exception Handling vulnerability in baramundi software GmbH EMM Agent 23.1.50 and before allows an attacker to cause a denial of service via a crafted request to the password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-02T00:00:00.000Z
CVE-2023-37607 
Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file= with a .. in the dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-03T00:00:00.000Z
CVE-2023-37608 
An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystems super admin account with astech as its hardcoded password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-03T00:00:00.000Z
CVE-2023-37611 
Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/management/media component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-37613 
A cross-site scripting (XSS) vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-24T00:00:00.000Z
CVE-2023-37623 
Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-26T00:00:00.000Z
CVE-2023-37624 
Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-26T00:00:00.000Z
CVE-2023-37625 
A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Link templates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-10T00:00:00.000Z
CVE-2023-37627 
Code-projects Online Restaurant Management System 1.0 is vulnerable to SQL Injection. Through SQL injection, an attacker can bypass the admin panel and view order records, add items, delete items etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-12T00:00:00.000Z
CVE-2023-37628 
Online Piggery Management System 1.0 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-12T00:00:00.000Z
CVE-2023-37629 
Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to "add-pig.php."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-12T00:00:00.000Z
CVE-2023-37630 
Online Piggery Management System 1.0 is vulnerable to Cross Site Scripting (XSS). An unauthenticated user can POST JavaScript code to "manage-breed.php" resulting in Persistent XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-12T00:00:00.000Z
CVE-2023-37635 
UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-23T00:00:00.000Z
CVE-2023-37636 
A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-23T00:00:00.000Z