saikiranpennam/new_cves_pps huggingface dataset:
Explain the vulnerability: CVE-2023-33461
Description:iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getstring's return.
Explain the vulnerability: CVE-2023-33174
Description:Windows Cryptographic Information Disclosure Vulnerability
Explain the vulnerability: CVE-2023-33524
Description:Advent/SSC Inc. Tamale RMS < 23.1 is vulnerable to Directory Traversal. If one traverses to the affected URL, one enumerates Contact information on the host which contains usernames, e-mail addresses, and other internal information stored within the web app.
Explain the vulnerability: CVE-2023-33877
Description:Out-of-bounds write in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Explain the vulnerability: CVE-2023-33965
Description:Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local `tproxy` service leading to remote code execution. A patch is available in version 20230606.
Explain the vulnerability: CVE-2023-33089
Description:Transient DOS when processing a NULL buffer while parsing WLAN vdev.
Explain the vulnerability: CVE-2023-33123
Description:A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V13.3 (All versions < V13.3.0.10), Teamcenter Visualization V14.0 (All versions < V14.0.0.6), Teamcenter Visualization V14.1 (All versions < V14.1.0.8), Teamcenter Visualization V14.2 (All versions < V14.2.0.3). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.
Explain the vulnerability: CVE-2023-33088
Description:Memory corruption when processing cmd parameters while parsing vdev.
Explain the vulnerability: CVE-2023-33933
Description:Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.

8.x users should upgrade to 8.1.7 or later versions
9.x users should upgrade to 9.2.1 or later versions
Explain the vulnerability: CVE-2023-33030
Description:Memory corruption in HLOS while running playready use-case.
Explain the vulnerability: CVE-2023-33876
Description:A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15332 handles destroying annotations. Specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Explain the vulnerability: CVE-2023-33476
Description:ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/write.
Explain the vulnerability: CVE-2023-33026
Description:Transient DOS in WLAN Firmware while parsing a NAN management frame.
Explain the vulnerability: CVE-2023-33925
Description:Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PluginForage WooCommerce Product Categories Selection Widget plugin <= 2.0 versions.
Explain the vulnerability: CVE-2023-33163
Description:Windows Network Load Balancing Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2023-33972
Description:Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.
Explain the vulnerability: CVE-2023-33564
Description:There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.
Explain the vulnerability: CVE-2023-33837
Description:IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission.  IBM X-Force ID:  256020.
Explain the vulnerability: CVE-2023-33909
Description:In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
Explain the vulnerability: CVE-2023-33289
Description:The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs.
Explain the vulnerability: CVE-2023-33323
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.2 versions.
Explain the vulnerability: CVE-2023-33636
Description:H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm.
Explain the vulnerability: CVE-2023-33374
Description:Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices OS commands to execute, resulting in arbitrary remote command execution.
Explain the vulnerability: CVE-2023-33231
Description:XSS attack was possible in DPA 2023.2 due to insufficient input validation
Explain the vulnerability: CVE-2023-33661
Description:Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.
Explain the vulnerability: CVE-2023-33948
Description:The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.
Explain the vulnerability: CVE-2023-33362
Description:Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
Explain the vulnerability: CVE-2023-33227
Description:The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to perform the actions with SYSTEM privileges.
Explain the vulnerability: CVE-2023-33509
Description:KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection.
Explain the vulnerability: CVE-2023-33159
Description:Microsoft SharePoint Server Spoofing Vulnerability
Explain the vulnerability: CVE-2023-33335
Description:Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed.
Explain the vulnerability: CVE-2023-33270
Description:An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the Curl check function is vulnerable to OS command injection (blind).
Explain the vulnerability: CVE-2023-33620
Description:GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-middle attack.
Explain the vulnerability: CVE-2023-33657
Description:A use-after-free vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_mqtt_msg_get_publish_property() in the file mqtt_msg.c. This vulnerability is caused by improper data tracing, and an attacker could exploit it to cause a denial of service attack.
Explain the vulnerability: CVE-2023-33207
Description:Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Wielogórski Stop Referrer Spam plugin <= 1.3.0 versions.
Explain the vulnerability: CVE-2023-33591
Description:User Registration & Login and User Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/search-result.php.
Explain the vulnerability: CVE-2023-33987
Description:An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify information on the server or make it temporarily unavailable.
Explain the vulnerability: CVE-2023-33250
Description:The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c.
Explain the vulnerability: CVE-2023-33315
Description:Cross-Site Request Forgery (CSRF) vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin <= 1.1.2 versions.
Explain the vulnerability: CVE-2023-33745
Description:TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection, simply entering the su command provides root access (without requiring a password).
Explain the vulnerability: CVE-2023-33196
Description:Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
Explain the vulnerability: CVE-2023-33895
Description:In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2023-33179
Description:Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the `nameFilter` function used throughout the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical operators. Users should upgrade to version 3.3.5 which fixes this issue. There are no known workarounds aside from upgrading.
Explain the vulnerability: CVE-2023-33246
Description:For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. 

Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. 

To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Explain the vulnerability: CVE-2023-33303
Description:A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request
Explain the vulnerability: CVE-2023-33929
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joaquín Ruiz Easy Admin Menu plugin <= 1.3 versions.
Explain the vulnerability: CVE-2023-33883
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2023-33180
Description:Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the `/display/map` API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `bounds` parameter. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
Explain the vulnerability: CVE-2023-33495
Description:Craft CMS through 4.4.9 is vulnerable to HTML Injection.
Explain the vulnerability: CVE-2023-33211
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in André Bräkling WP-Matomo Integration (WP-Piwik) plugin <= 1.0.27 versions.
Explain the vulnerability: CVE-2023-33641
Description:H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.
Explain the vulnerability: CVE-2023-33568
Description:An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
Explain the vulnerability: CVE-2023-33092
Description:Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.
Explain the vulnerability: CVE-2023-33285
Description:An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server.
Explain the vulnerability: CVE-2023-33790
Description:A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Explain the vulnerability: CVE-2023-33840
Description:IBM Security Verify Governance 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  256037.
Explain the vulnerability: CVE-2023-33143
Description:Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2023-33006
Description:A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker's account.
Explain the vulnerability: CVE-2023-33905
Description:In iwnpi server, there is a possible out of bounds write due to a missing bounds check.  This could lead to local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2023-33378
Description:Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.
Explain the vulnerability: CVE-2023-33114
Description:Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.
Explain the vulnerability: CVE-2023-33544
Description:hawtio 2.17.2 is vulnerable to Path Traversal. it is possible to input malicious zip files, which can result in the high-risk files after decompression being stored in any location, even leading to file overwrite.
Explain the vulnerability: CVE-2023-33817
Description:hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability.
Explain the vulnerability: CVE-2023-33952
Description:A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel.
Explain the vulnerability: CVE-2023-33381
Description:A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0b7_2). The vulnerability allows an authenticated user to execute arbitrary OS commands by sending specially crafted input to the router via the ping function.
Explain the vulnerability: CVE-2023-33047
Description:Transient DOS in WLAN Firmware while parsing no-inherit IES.
Explain the vulnerability: CVE-2023-33944
Description:Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.
Explain the vulnerability: CVE-2023-33293
Description:An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed applications, e.g., myapp.localhost. An attacker can make fetch requests to api-deamon to determine if a given app is installed and read the manifest.webmanifest contents, including the app version.
Explain the vulnerability: CVE-2023-33786
Description:A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Explain the vulnerability: CVE-2023-33155
Description:Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2023-33913
Description:In DRM/oemcrypto, there is a possible out of bounds write due to an incorrect calculation of buffer size.This could lead to remote escalation of privilege with System execution privileges needed
Explain the vulnerability: CVE-2023-33010
Description:A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
Explain the vulnerability: CVE-2023-33440
Description:Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.
Explain the vulnerability: CVE-2023-33762
Description:eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity parameter.
Explain the vulnerability: CVE-2023-33298
Description:com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usingCAPath.
Explain the vulnerability: CVE-2023-33277
Description:The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 allows a remote attacker to read sensitive files via directory-traversal sequences in the URL.
Explain the vulnerability: CVE-2023-33627
Description:H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.
Explain the vulnerability: CVE-2023-33735
Description:D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in the /HNAP1 interface.
Explain the vulnerability: CVE-2023-33365
Description:A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files from the server's web server.
Explain the vulnerability: CVE-2023-33670
Description:Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sub_4a79ec function.
Explain the vulnerability: CVE-2023-33220
Description:






During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes 
to check. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted 
device
Explain the vulnerability: CVE-2023-33559
Description:A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file.
Explain the vulnerability: CVE-2023-33373
Description:Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices.
Explain the vulnerability: CVE-2023-33666
Description:ai-dev aioptimizedcombinations before v0.1.3 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php.
Explain the vulnerability: CVE-2023-33959
Description:notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Explain the vulnerability: CVE-2023-33631
Description:H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelSTList interface at /goform/aspForm.
Explain the vulnerability: CVE-2023-33148
Description:Microsoft Office Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2023-33518
Description:emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request.
Explain the vulnerability: CVE-2023-33975
Description:RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. This issue is fixed in pull request 19680. As a workaround, disable support for fragmented IP datagrams.
Explain the vulnerability: CVE-2023-33133
Description:Microsoft Excel Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2023-33563
Description:In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
Explain the vulnerability: CVE-2023-33308
Description:A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.
Explain the vulnerability: CVE-2023-33888
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2023-33021
Description:Memory corruption in Graphics while processing user packets for command submission.
Explain the vulnerability: CVE-2023-33534
Description:A Cross-Site Request Forgery (CSRF) in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G_3.11.6 allows attackers to takeover user accounts via sending a crafted POST request to /goform/goform_set_cmd_process.
Explain the vulnerability: CVE-2023-33164
Description:Remote Procedure Call Runtime Denial of Service Vulnerability
Explain the vulnerability: CVE-2023-33867
Description:Improper buffer restrictions in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Explain the vulnerability: CVE-2023-33037
Description:Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.
Explain the vulnerability: CVE-2023-33934
Description:Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
Explain the vulnerability: CVE-2023-33871
Description:Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a directory traversal vulnerability that could allow an unauthenticated user to directly access any file outside the webroot.
Explain the vulnerability: CVE-2023-33172
Description:Remote Procedure Call Runtime Denial of Service Vulnerability
Explain the vulnerability: CVE-2023-33719
Description:mp4v2 v2.1.3 was discovered to contain a memory leak via MP4SdpAtom::Read() at atom_sdp.cpp
Explain the vulnerability: CVE-2023-33963
Description:DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.
Explain the vulnerability: CVE-2023-33152
Description:Microsoft ActiveX Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2023-33017
Description:Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
Explain the vulnerability: CVE-2023-33914
Description:In NIA0 algorithm in Security Mode Command, there is a possible missing verification incorrect input. This could lead to remote information disclosure no additional execution privileges needed
Explain the vulnerability: CVE-2023-33294
Description:An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctweb_server binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns proper CORS headers, it's accessible to all websites via the browser. At a bare minimum, this allows an attacker to retrieve a list of the user's installed apps, notifications, and downloads. It also allows an attacker to delete local files and modify system properties including the boolean persist.moz.killswitch property (which would render the device inoperable). This vulnerability is partially mitigated by SELinux which prevents reads, writes, or modifications to files or permissions within protected partitions.
Explain the vulnerability: CVE-2023-33781
Description:An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file.
Explain the vulnerability: CVE-2023-33943
Description:Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.
Explain the vulnerability: CVE-2023-33410
Description:Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file.
Explain the vulnerability: CVE-2023-33040
Description:Transient DOS in Data Modem during DTLS handshake.
Explain the vulnerability: CVE-2023-33369
Description:A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.
Explain the vulnerability: CVE-2023-33693
Description:A buffer overflow in EasyPlayerPro-Win v3.2.19.0106 to v3.6.19.0823 allows attackers to cause a Denial of Service (DoS) via a crafted XML file.
Explain the vulnerability: CVE-2023-33113
Description:Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Explain the vulnerability: CVE-2023-33056
Description:Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
Explain the vulnerability: CVE-2023-33955
Description:Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.
Explain the vulnerability: CVE-2023-33144
Description:Visual Studio Code Spoofing Vulnerability
Explain the vulnerability: CVE-2023-33847
Description:
IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 257102.
Explain the vulnerability: CVE-2023-33902
Description:In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2023-33328
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps MailChimp Subscribe Form plugin <= 4.0.9.1 versions.
Explain the vulnerability: CVE-2023-33778
Description:Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.
Explain the vulnerability: CVE-2023-33282
Description:Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This makes it possible to make backend calls to endpoints in the application.
Explain the vulnerability: CVE-2023-33797
Description:A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Explain the vulnerability: CVE-2023-33580
Description:Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" field on Admin Profile page.
Explain the vulnerability: CVE-2023-33187
Description:Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `type="password"` inputs. A customer may assume that switching to `type="text"` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used. This issue was patched in version 6.0.0.
This patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type="password"` continues to be obfuscated.
Explain the vulnerability: CVE-2023-33884
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2023-33168
Description:Remote Procedure Call Runtime Denial of Service Vulnerability
Explain the vulnerability: CVE-2023-33492
Description:EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS).
Explain the vulnerability: CVE-2023-33538
Description:TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .
Explain the vulnerability: CVE-2023-33241
Description:Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signatures or more fully exfiltrate the other parties' private key shares.
Explain the vulnerability: CVE-2023-33754
Description:The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers to brute force valid user accounts to gain access to login credentials.
Explain the vulnerability: CVE-2023-33304
Description:A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections via the use of static credentials.
Explain the vulnerability: CVE-2023-33892
Description:In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2023-33938
Description:Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.
Explain the vulnerability: CVE-2023-33191
Description:Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.
Explain the vulnerability: CVE-2023-33257
Description:Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat.
Explain the vulnerability: CVE-2023-33742
Description:TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Cleartext Storage of Sensitive Information: RSA private key in Update.exe.
Explain the vulnerability: CVE-2023-33980
Description:Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) via a series of long messages to a contact.
Explain the vulnerability: CVE-2023-33129
Description:Microsoft SharePoint Denial of Service Vulnerability
Explain the vulnerability: CVE-2023-33083
Description:Memory corruption in WLAN Host while processing RRM beacon on the AP.
Explain the vulnerability: CVE-2023-33651
Description:An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.
Explain the vulnerability: CVE-2023-33201
Description:Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.
Explain the vulnerability: CVE-2023-33981
Description:Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need to be an exact duplicate of a legitimate message displayed alongside the spoofed one.
Explain the vulnerability: CVE-2023-33128
Description:.NET and Visual Studio Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2023-33313
Description:Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions.
Explain the vulnerability: CVE-2023-33743
Description:TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Access Control; specifically, Android Debug Bridge (adb) is available.
Explain the vulnerability: CVE-2023-33893
Description:In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2023-33939
Description:Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.
Explain the vulnerability: CVE-2023-33485
Description:TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort in the addEffect function.
Explain the vulnerability: CVE-2023-33240
Description:Foxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous 12.x versions, 11.2.5.53785 and all previous 11.x versions, and 10.1.11.37866 and earlier) on Windows allows Local Privilege Escalation when installed to a non-default directory because unprivileged users have access to an executable file of a system service. This is fixed in 12.1.2.
Explain the vulnerability: CVE-2023-33186
Description:Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker.
Explain the vulnerability: CVE-2023-33885
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2023-33169
Description:Remote Procedure Call Runtime Denial of Service Vulnerability
Explain the vulnerability: CVE-2023-33094
Description:Memory corruption while running VK synchronization with KASAN enabled.
Explain the vulnerability: CVE-2023-33997
Description:Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.5.5 versions.
Explain the vulnerability: CVE-2023-33779
Description:A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.
Explain the vulnerability: CVE-2023-33796
Description:A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. NOTE: the vendor disputes this because the reporter's only query was for the schema of the API, which is public; queries for database objects would have been denied.
Explain the vulnerability: CVE-2023-33515
Description:SoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens.
Explain the vulnerability: CVE-2023-33846
Description:IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  257100.
Explain the vulnerability: CVE-2023-33684
Description:Weak session management in DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware: 1.9.3 Bios firmware: 7.1 (Apr 19 2021) Gui: 2.46 FPGA: 169.55 uc: 6.15 allows attackers on the same network to bypass authentication by re-using the IP address assigned to the device by the NAT protocol.
Explain the vulnerability: CVE-2023-33112
Description:Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
Explain the vulnerability: CVE-2023-33368
Description:Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes.
Explain the vulnerability: CVE-2023-33387
Description:A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link.
Explain the vulnerability: CVE-2023-33942
Description:Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field.
Explain the vulnerability: CVE-2023-33411
Description:A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information.
Explain the vulnerability: CVE-2023-33041
Description:Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
Explain the vulnerability: CVE-2023-33295
Description:Cohesity DataProtect prior to 6.8.1_u5 or 7.1 was discovered to have a incorrect access control vulnerability due to a lack of TLS Certificate Validation.
Explain the vulnerability: CVE-2023-33850
Description:
IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 257132.
Explain the vulnerability: CVE-2023-33153
Description:Microsoft Outlook Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2023-33016
Description:Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
Explain the vulnerability: CVE-2023-33915
Description:In LTE protocol stack, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed
Explain the vulnerability: CVE-2023-33962
Description:JStachio is a  type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowing an attacker to inject malicious code. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of other users visiting pages that use this template engine. This can lead to various consequences, including session hijacking, defacement of web pages, theft of sensitive information, or even the propagation of malware.

Version 1.0.1 contains a patch for this issue. To mitigate this vulnerability, the template engine should properly escape special characters, including single quotes. Common practice is to escape `'` as `&#39`. As a workaround, users can avoid this issue by using only double quotes `"` for HTML attributes.
Explain the vulnerability: CVE-2023-33061
Description:Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
Explain the vulnerability: CVE-2023-33124
Description:A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V13.3 (All versions < V13.3.0.10), Teamcenter Visualization V14.0 (All versions < V14.0.0.6), Teamcenter Visualization V14.1 (All versions < V14.1.0.8), Teamcenter Visualization V14.2 (All versions < V14.2.0.3). The affected applications contain a memory corruption vulnerability while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.
Explain the vulnerability: CVE-2023-33718
Description:mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file_io.cpp
Explain the vulnerability: CVE-2023-33036
Description:Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.
Explain the vulnerability: CVE-2023-33466
Description:Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).
Explain the vulnerability: CVE-2023-33173
Description:Remote Procedure Call Runtime Denial of Service Vulnerability
Explain the vulnerability: CVE-2023-33020
Description:Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.
Explain the vulnerability: CVE-2023-33165
Description:Microsoft SharePoint Server Security Feature Bypass Vulnerability
Explain the vulnerability: CVE-2023-33866
Description:A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Explain the vulnerability: CVE-2023-33309
Description:Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.
Explain the vulnerability: CVE-2023-33562
Description:User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Explain the vulnerability: CVE-2023-33098
Description:Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
Explain the vulnerability: CVE-2023-33149
Description:Microsoft Office Graphics Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2023-33325
Description:Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.1 versions.
Explain the vulnerability: CVE-2023-33630
Description:H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EditvsList interface at /goform/aspForm.