stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-40593 (severity: HIGH, weakness: CWE-400)
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.
CVE-2023-40594 (severity: HIGH, weakness: CWE-400)
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.
CVE-2023-40595 (severity: HIGH, weakness: CWE-502)
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code.
CVE-2023-40596 (severity: HIGH, weakness: CWE-665)
In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine.
CVE-2023-40597 (severity: HIGH, weakness: CWE-36)
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.
CVE-2023-40598 (severity: HIGH, weakness: CWE-77)
In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
CVE-2023-40599 (severity: HIGH, weakness: CWE-1333)
Regular expression Denial-of-Service (ReDoS) exists in multiple add-ons for Mailform Pro CGI 4.3.1.3 and earlier, which allows a remote unauthenticated attacker to cause a denial-of-service condition. Affected add-ons are as follows: call/call.js, prefcodeadv/search.cgi, estimate/estimate.js, search/search.js, suggest/suggest.js, and coupon/coupon.js.
CVE-2023-4060 (severity: MEDIUM, weakness: NVD-CWE-Other)
The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-40600 (severity: HIGH, weakness: CWE-200)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.
CVE-2023-40601 (severity: MEDIUM, weakness: CWE-79)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions.
CVE-2023-40602 (severity: MEDIUM, weakness: CWE-601)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 1.5.49.
CVE-2023-40603 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Gangesh Matta Simple Org Chart.This issue affects Simple Org Chart: from n/a through 2.3.4.
CVE-2023-40604 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jes Madsen Cookies by JM plugin <= 1.0 versions.
CVE-2023-40605 (severity: MEDIUM, weakness: CWE-79)
Auth. (contributor) Cross-Site Scripting (XSS) vulnerability in 93digital Typing Effect plugin <= 1.3.6 versions.
CVE-2023-40606 (severity: HIGH, weakness: CWE-94)
Improper Control of Generation of Code ('Code Injection') vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.
CVE-2023-40607 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in CLUEVO CLUEVO LMS, E-Learning Platform plugin <= 1.10.0 versions.
CVE-2023-40608 (severity: HIGH, weakness: CWE-862)
Missing Authorization vulnerability in Paid Memberships Pro Paid Memberships Pro CCBill Gateway.This issue affects Paid Memberships Pro CCBill Gateway: from n/a through 0.3.
CVE-2023-40609 (severity: CRITICAL, weakness: CWE-89)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aiyaz, maheshpatel Contact form 7 Custom validation allows SQL Injection.This issue affects Contact form 7 Custom validation: from n/a through 1.1.3.
CVE-2023-4061 (severity: MEDIUM, weakness: CWE-200)
A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.
CVE-2023-40610 (severity: HIGH, weakness: CWE-863)
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.
CVE-2023-40611 (severity: MEDIUM, weakness: CWE-863)
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability.
CVE-2023-40612 (severity: HIGH, weakness: CWE-91)
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
CVE-2023-40617 (severity: MEDIUM, weakness: CWE-79)
A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start 7 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'file' parameter in 'displayPDF.php'.
CVE-2023-40618 (severity: MEDIUM, weakness: CWE-79)
A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Visual Project Explorer 1.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'service' parameter in 'headstart_snapshot.php'.
CVE-2023-40619 (severity: CRITICAL, weakness: CWE-502)
phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.
CVE-2023-40621 (severity: MEDIUM, weakness: CWE-94)
SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. The application has a security option to disable or prompt users before untrusted scripts are executed, but this is not set as default.
CVE-2023-40622 (severity: CRITICAL, weakness: CWE-732)
SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.
CVE-2023-40623 (severity: HIGH, weakness: CWE-1386)
SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the operating system files causing a limited impact on integrity and completely compromising the availability of the system.
CVE-2023-40624 (severity: MEDIUM, weakness: CWE-79)
SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can be executed in the web-application. An attacker could thereby control the behavior of this web-application.
CVE-2023-40625 (severity: MEDIUM, weakness: CWE-862)
S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and integrity with no impact on availibility of the system.
CVE-2023-40626 (severity: HIGH, weakness: NVD-CWE-Other)
The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
CVE-2023-40627 (severity: MEDIUM, weakness: CWE-79)
A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.
CVE-2023-40628 (severity: MEDIUM, weakness: CWE-79)
A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.
CVE-2023-40629 (severity: CRITICAL, weakness: CWE-89)
SQLi vulnerability in LMS Lite component for Joomla.
CVE-2023-4063 (severity: MEDIUM, weakness: CWE-400)
Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request.
CVE-2023-40630 (severity: CRITICAL, weakness: CWE-918)
Unauthenticated LFI/SSRF in JCDashboards component for Joomla.
CVE-2023-40631 (severity: MEDIUM, weakness: CWE-862)
In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed
CVE-2023-40632 (severity: HIGH, weakness: CWE-416)
In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execution privileges needed
CVE-2023-40633 (severity: MEDIUM, weakness: CWE-862)
In phasecheckserver, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-40634 (severity: HIGH, weakness: CWE-862)
In phasechecksercer, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
CVE-2023-40635 (severity: HIGH, weakness: CWE-862)
In linkturbo, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
CVE-2023-40636 (severity: MEDIUM, weakness: CWE-862)
In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with System execution privileges needed
CVE-2023-40637 (severity: MEDIUM, weakness: CWE-862)
In telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
CVE-2023-40638 (severity: MEDIUM, weakness: CWE-862)
In Telecom service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
CVE-2023-40639 (severity: MEDIUM, weakness: CWE-862)
In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
CVE-2023-40640 (severity: MEDIUM, weakness: CWE-862)
In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
CVE-2023-40641 (severity: MEDIUM, weakness: CWE-862)
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-40642 (severity: MEDIUM, weakness: CWE-862)
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-40643 (severity: MEDIUM, weakness: CWE-862)
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-40644 (severity: MEDIUM, weakness: CWE-862)
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-40645 (severity: MEDIUM, weakness: CWE-862)
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-40646 (severity: MEDIUM, weakness: CWE-862)
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-40647 (severity: MEDIUM, weakness: CWE-862)
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-40648 (severity: MEDIUM, weakness: CWE-862)
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-40649 (severity: MEDIUM, weakness: CWE-862)
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-4065 (severity: MEDIUM, weakness: CWE-117)
A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local attacker to access information outside of their permissions.
CVE-2023-40650 (severity: MEDIUM, weakness: CWE-862)
In Telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVE-2023-40651 (severity: MEDIUM, weakness: CWE-787)
In urild service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVE-2023-40652 (severity: MEDIUM, weakness: CWE-787)
In jpg driver, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with System execution privileges needed
CVE-2023-40653 (severity: MEDIUM, weakness: CWE-862)
In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed
CVE-2023-40654 (severity: MEDIUM, weakness: CWE-862)
In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed
CVE-2023-40655 (severity: MEDIUM, weakness: CWE-79)
A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.
CVE-2023-40656 (severity: MEDIUM, weakness: CWE-79)
A reflected XSS vulnerability was discovered in the Quickform component for Joomla.
CVE-2023-40657 (severity: MEDIUM, weakness: CWE-79)
A reflected XSS vulnerability was discovered in the Joomdoc component for Joomla.
CVE-2023-40658 (severity: MEDIUM, weakness: CWE-79)
A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla.
CVE-2023-40659 (severity: MEDIUM, weakness: CWE-79)
A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla.
CVE-2023-4066 (severity: MEDIUM, weakness: CWE-313)
A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.
CVE-2023-40660 (severity: MEDIUM, weakness: CWE-287)
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.
CVE-2023-40661 (severity: MEDIUM, weakness: CWE-119)
Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise key generation, certificate loading, and other card management operations during enrollment.
CVE-2023-40662 (severity: HIGH, weakness: CWE-200)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jonk @ Follow me Darling Cookies and Content Security Policy.This issue affects Cookies and Content Security Policy: from n/a through 2.15.
CVE-2023-40663 (severity: MEDIUM, weakness: CWE-79)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rextheme WP VR plugin <= 8.3.4 versions.
CVE-2023-40664 (severity: MEDIUM, weakness: CWE-79)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy – Smart Donations plugin <= 4.0.12 versions.
CVE-2023-40665 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as Image plugin by Pdfcrowd plugin <= 2.16.0 versions.
CVE-2023-40667 (severity: MEDIUM, weakness: CWE-79)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Lasso Simple URLs plugin <= 117 versions.
CVE-2023-40668 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd plugin <= 2.16.0 versions.
CVE-2023-40669 (severity: MEDIUM, weakness: CWE-79)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in twinpictures, baden03 Collapse-O-Matic plugin <= 1.8.5.5 versions.
CVE-2023-4067 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'tab_date_r' parameters in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2023-40670 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in ReviewX Team ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.17.
CVE-2023-40671 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in 大侠wp DX-auto-save-images plugin <= 1.4.0 versions.
CVE-2023-40672 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Hardik Chavada Sticky Social Media Icons.This issue affects Sticky Social Media Icons: from n/a through 2.1.
CVE-2023-40673 (severity: MEDIUM, weakness: CWE-799)
: Improper Control of Interaction Frequency vulnerability in cartpauj Cartpauj Register Captcha allows Functionality Misuse.This issue affects Cartpauj Register Captcha: from n/a through 1.0.02.
CVE-2023-40674 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lasso Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management allows Stored XSS.This issue affects Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management: from n/a through 118.
CVE-2023-40675 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps Landing Page Builder plugin <= 1.5.1.2 versions.
CVE-2023-40676 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.8 versions.
CVE-2023-40677 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Vertical marquee plugin <= 7.1 versions.
CVE-2023-40678 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Lasso Simple URLs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple URLs: from n/a through 117.
CVE-2023-4068 (severity: HIGH, weakness: CWE-843)
Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVE-2023-40680 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects Yoast SEO: from n/a through 21.0.
CVE-2023-40681 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11.10 versions.
CVE-2023-40682 (severity: MEDIUM, weakness: CWE-532)
IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive information from API logs. IBM X-Force ID: 263833.
CVE-2023-40683 (severity: HIGH, weakness: CWE-285)
IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticating as an OpenPages user and using non-public APIs, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrative access to the application. IBM X-Force ID: 264005.
CVE-2023-40684 (severity: MEDIUM, weakness: CWE-79)
IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 264019.
CVE-2023-40685 (severity: HIGH, weakness: CWE-269)
Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privileges to gain root access to the operating system. IBM X-Force ID: 264116.
CVE-2023-40686 (severity: HIGH, weakness: CWE-269)
Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privileges to gain component access to the operating system. IBM X-Force ID: 264114.