rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-39546 
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.


Problem types: cwe_id: CWE-836
description: CWE-836 Use of password hash instead of password for authentication
Affected products: vendor: NEC Corporation
product: CLUSTERPRO X (EXPRESSCLUSTER X)
vendor: NEC Corporation
product: CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)
Credits: lang: en
value: Mr. David Levard in Videotron.
Published: 2023-11-17T05:31:08.331Z
CVE-2023-39547 
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.


Problem types: cwe_id: CWE-294
description: CWE-294 Authentication bypass by Capture-replay
Affected products: vendor: NEC Corporation
product: CLUSTERPRO X (EXPRESSCLUSTER X)
vendor: NEC Corporation
product: CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)
Credits: lang: en
value: Mr. David Levard in Videotron.
Published: 2023-11-17T05:31:27.701Z
CVE-2023-39548 
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.


Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted upload of file with dangerous type
Affected products: vendor: NEC Corporation
product: CLUSTERPRO X (EXPRESSCLUSTER X)
vendor: NEC Corporation
product: CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)
Credits: lang: en
value: Mr. David Levard in Videotron.
Published: 2023-11-17T05:31:40.336Z
CVE-2023-39549 
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 2). The affected application contains a use-after-free vulnerability that could be triggered while parsing specially crafted DWG file. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19562)
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Siemens
product: Solid Edge SE2023
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2023-08-08T09:21:01.403Z
CVE-2023-39550 
Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_passwd and http_username parameters in the check_auth function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-39551 
PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-04T00:00:00.000Z
CVE-2023-39553 Apache Airflow Drill Provider Arbitrary File Read Vulnerability
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.

Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server.
This issue affects Apache Airflow Drill Provider: before 2.4.3.
It is recommended to upgrade to a version that is not affected.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Airflow Drill Provider
default_status: unaffected
Credits: lang: en
value: sw0rd1ight of Caiji Sec Team and 4ra1n of Chaitin Tech
Published: 2023-08-11T07:18:14.202Z
CVE-2023-39558 
AudimexEE v15.0 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai Data component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-29T00:00:00.000Z
CVE-2023-39559 
AudimexEE 15.0 was discovered to contain a full path disclosure vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-29T00:00:00.000Z
CVE-2023-39560 
ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-28T00:00:00.000Z
CVE-2023-39562 
GPAC v2.3-DEV-rev449-g5948e4f70-master was discovered to contain a heap-use-after-free via the gf_bs_align function at bitstream.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-28T00:00:00.000Z
CVE-2023-39575 
A reflected cross-site scripting (XSS) vulnerability in the url_str URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-19T00:00:00.000Z
CVE-2023-39578 
A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-28T00:00:00.000Z
CVE-2023-39582 
SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-01T00:00:00.000Z
CVE-2023-39584 
Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-08T00:00:00.000Z
CVE-2023-39593 
Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-17T00:00:00.000Z
CVE-2023-39598 
Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitrary code via a crafted payload to the mid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-05T00:00:00.000Z
CVE-2023-39599 
Cross-Site Scripting (XSS) vulnerability in CSZ CMS v.1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Social Settings parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2023-39600 
IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-25T00:00:00.000Z
CVE-2023-39610 
An issue in TP-Link Tapo C100 v1.1.15 Build 211130 Rel.15378n(4555) and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted web request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-31T00:00:00.000Z
CVE-2023-39611 
An issue in Software FX Chart FX 7 version 7.0.4962.20829 allows attackers to enumerate and read files from the local filesystem by sending crafted web requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2023-39612 
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-16T00:00:00.000Z
CVE-2023-39615 
Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-29T00:00:00.000Z
CVE-2023-39616 
AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-29T00:00:00.000Z
CVE-2023-39617 
TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-39618 
TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-39619 
ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-39620 
An Issue in Buffalo America, Inc. TeraStation NAS TS5410R v.5.00 thru v.0.07 allows a remote attacker to obtain sensitive information via the guest account function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-08T00:00:00.000Z
CVE-2023-39631 
An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-01T00:00:00.000Z
CVE-2023-39637 
D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-12T00:00:00.000Z
CVE-2023-39638 
D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-14T00:00:00.000Z
CVE-2023-39639 
LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-14T00:00:00.000Z
CVE-2023-39640 
UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-25T00:00:00.000Z
CVE-2023-39641 
Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-14T00:00:00.000Z
CVE-2023-39642 
Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-14T00:00:00.000Z
CVE-2023-39643 
Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-15T00:00:00.000Z
CVE-2023-39645 
Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module “Theme Volty CMS Payment Icon” (tvcmspaymenticon) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-03T00:00:00.000Z
CVE-2023-39646 
Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop. In the module “Theme Volty CMS Category Chain Slide"(tvcmscategorychainslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-03T00:00:00.000Z
CVE-2023-39647 
Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop. In the module “Theme Volty CMS Category Product” (tvcmscategoryproduct) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-03T00:00:00.000Z
CVE-2023-39648 
Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module “Theme Volty CMS Testimonial” (tvcmstestimonial) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-03T00:00:00.000Z
CVE-2023-39649 
Improper neutralization of SQL parameter in Theme Volty CMS Category Slider module for PrestaShop. In the module “Theme Volty CMS Category Slider” (tvcmscategoryslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-03T00:00:00.000Z
CVE-2023-39650 
Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-28T00:00:00.000Z
CVE-2023-39651 
Improper neutralization of SQL parameter in Theme Volty CMS BrandList module for PrestaShop In the module “Theme Volty CMS BrandList” (tvcmsbrandlist) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-03T00:00:00.000Z
CVE-2023-39652 
theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-28T00:00:00.000Z
CVE-2023-39654 
abupy up to v0.4.0 was discovered to contain a SQL injection vulnerability via the component abupy.MarketBu.ABuSymbol.search_to_symbol_dict.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-05T00:00:00.000Z
CVE-2023-39655 
A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords and take over their accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-03T00:00:00.000Z
CVE-2023-39659 
An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-39660 
An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-39661 
An issue in pandas-ai v.0.9.1 and before allows a remote attacker to execute arbitrary code via the _is_jailbreak function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-39662 
An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-39663 
Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-29T00:00:00.000Z
CVE-2023-39665 
D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the acStack_50 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-39666 
D-Link DIR-842 fw_revA_1-02_eu_multi_20151008 was discovered to contain multiple buffer overflows in the fgets function via the acStack_120 and acStack_220 parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-39667 
D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in the FUN_0000acb4 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-39668 
D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in the inet_ntoa() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-39669 
D-Link DIR-880 A1_FW107WWb08 was discovered to contain a NULL pointer dereference in the function FUN_00010824.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-39670 
Tenda AC6 _US_AC6V1.0BR_V15.03.05.16 was discovered to contain a buffer overflow via the function fgets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-39671 
D-Link DIR-880 A1_FW107WWb08 was discovered to contain a buffer overflow via the function FUN_0001be68.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-39672 
Tenda WH450 v1.0.0.18 was discovered to contain a buffer overflow via the function fgets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-39673 
Tenda AC15 V1.0BR_V15.03.05.18_multi_TD01 was discovered to contain a buffer overflow via the function FUN_00010e34().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-39674 
D-Link DIR-880 A1_FW107WWb08 was discovered to contain a buffer overflow via the function fgets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-39675 
SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-39676 
FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-08T00:00:00.000Z
CVE-2023-39677 
MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-39678 
A cross-site scripting (XSS) vulnerability in the device web interface (Log Query page) of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-29T00:00:00.000Z
CVE-2023-39680 
Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Published: 2023-10-20T00:00:00.000Z
CVE-2023-39681 
Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php. This vulnerability is triggered via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-05T00:00:00.000Z
CVE-2023-39683 
Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user input parameter(s). NOTE: Researcher claims issue is present in all versions prior and later than tested version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2023-39685 
An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-01T00:00:00.000Z
CVE-2023-39691 
An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-16T00:00:00.000Z
CVE-2023-39695 
Insufficient session expiration in Elenos ETG150 FM Transmitter v3.12 allows attackers to arbitrarily change transmitter configuration and data after logging out.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-31T00:00:00.000Z
CVE-2023-39699 
IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-24T00:00:00.000Z
CVE-2023-39700 
IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-24T00:00:00.000Z