stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-24835 (severity: HIGH, weakness: CWE-94)
Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker with administrator privilege can exploit this vulnerability to execute arbitrary system command to perform arbitrary system operation or disrupt service.
CVE-2023-24836 (severity: HIGH, weakness: CWE-22)
SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operation or disrupt service.
CVE-2023-24837 (severity: HIGH, weakness: CWE-78)
HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service.
CVE-2023-24838 (severity: CRITICAL, weakness: CWE-200)
HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain the administrator's credential. This credential can then be used to login PowerStation or Secure Shell to achieve remote code execution.
CVE-2023-24839 (severity: MEDIUM, weakness: CWE-79)
HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript, conducting a reflected XSS attack.
CVE-2023-2484 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2023-24840 (severity: HIGH, weakness: CWE-89)
HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject SQL commands to read, modify, and delete the database.
CVE-2023-24841 (severity: HIGH, weakness: CWE-78)
HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service.
CVE-2023-24842 (severity: MEDIUM, weakness: CWE-639)
HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access partial content of another user’s mail by changing user ID and mail ID within URL.
CVE-2023-24843 (severity: HIGH, weakness: CWE-617)
Transient DOS in Modem while triggering a camping on an 5G cell.
CVE-2023-24844 (severity: HIGH, weakness: CWE-284)
Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.
CVE-2023-24847 (severity: HIGH, weakness: CWE-476)
Transient DOS in Modem while allocating DSM items.
CVE-2023-24848 (severity: HIGH, weakness: CWE-126)
Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
CVE-2023-24849 (severity: HIGH, weakness: CWE-126)
Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
CVE-2023-2485 (severity: MEDIUM, weakness: CWE-266)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.
CVE-2023-24850 (severity: HIGH, weakness: CWE-129)
Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.
CVE-2023-24851 (severity: HIGH, weakness: CWE-120)
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
CVE-2023-24852 (severity: HIGH, weakness: CWE-287)
Memory Corruption in Core due to secure memory access by user while loading modem image.
CVE-2023-24853 (severity: HIGH, weakness: CWE-20)
Memory Corruption in HLOS while registering for key provisioning notify.
CVE-2023-24854 (severity: HIGH, weakness: CWE-121)
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
CVE-2023-24855 (severity: CRITICAL, weakness: CWE-823)
Memory corruption in Modem while processing security related configuration before AS Security Exchange.
CVE-2023-24856 (severity: HIGH, weakness: CWE-20)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-24857 (severity: MEDIUM, weakness: CWE-126)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-24858 (severity: HIGH, weakness: CWE-126)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-24859 (severity: HIGH, weakness: CWE-476)
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
CVE-2023-24860 (severity: HIGH, weakness: CWE-400)
Microsoft Defender Denial of Service Vulnerability
CVE-2023-24861 (severity: HIGH, weakness: CWE-367)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2023-24862 (severity: MEDIUM, weakness: CWE-125)
Windows Secure Channel Denial of Service Vulnerability
CVE-2023-24863 (severity: MEDIUM, weakness: CWE-190)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-24864 (severity: HIGH, weakness: CWE-191)
Microsoft PostScript and PCL6 Class Printer Driver Elevation of Privilege Vulnerability
CVE-2023-24865 (severity: MEDIUM, weakness: CWE-20)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-24866 (severity: MEDIUM, weakness: CWE-20)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-24867 (severity: HIGH, weakness: CWE-122)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24868 (severity: HIGH, weakness: CWE-122)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24869 (severity: HIGH, weakness: CWE-190)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2023-2487 (severity: HIGH, weakness: CWE-200)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
CVE-2023-24870 (severity: MEDIUM, weakness: CWE-126)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-24871 (severity: HIGH, weakness: CWE-190)
Windows Bluetooth Service Remote Code Execution Vulnerability
CVE-2023-24872 (severity: HIGH, weakness: CWE-125)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24876 (severity: HIGH, weakness: CWE-122)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24879 (severity: MEDIUM, weakness: CWE-79)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-2488 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2023-24880 (severity: MEDIUM, weakness: CWE-863)
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2023-24881 (severity: MEDIUM, weakness: CWE-200)
Microsoft Teams Information Disclosure Vulnerability
CVE-2023-24882 (severity: MEDIUM, weakness: CWE-200)
Microsoft OneDrive for Android Information Disclosure Vulnerability
CVE-2023-24883 (severity: MEDIUM, weakness: CWE-126)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-24884 (severity: HIGH, weakness: CWE-681)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24885 (severity: HIGH, weakness: CWE-843)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24886 (severity: HIGH, weakness: CWE-908)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24887 (severity: HIGH, weakness: CWE-191)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-2489 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-24890 (severity: MEDIUM, weakness: CWE-1390)
Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
CVE-2023-24891 (severity: MEDIUM, weakness: CWE-79)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24892 (severity: HIGH, weakness: CWE-601)
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
CVE-2023-24893 (severity: HIGH, weakness: CWE-20)
Visual Studio Code Remote Code Execution Vulnerability
CVE-2023-24895 (severity: HIGH, weakness: NVD-CWE-Other)
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2023-24896 (severity: MEDIUM, weakness: CWE-79)
Dynamics 365 Finance Spoofing Vulnerability
CVE-2023-24897 (severity: HIGH, weakness: CWE-122)
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2023-24898 (severity: HIGH, weakness: NVD-CWE-Other)
Windows SMB Denial of Service Vulnerability
CVE-2023-24899 (severity: HIGH, weakness: CWE-591)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2023-2490 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fernando Briano UserAgent-Spy plugin <= 1.3.1 versions.
CVE-2023-24900 (severity: MEDIUM, weakness: CWE-125)
Windows NTLM Security Support Provider Information Disclosure Vulnerability
CVE-2023-24901 (severity: HIGH, weakness: CWE-126)
Windows NFS Portmapper Information Disclosure Vulnerability
CVE-2023-24902 (severity: HIGH, weakness: CWE-125)
Win32k Elevation of Privilege Vulnerability
CVE-2023-24903 (severity: HIGH, weakness: CWE-415)
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2023-24904 (severity: HIGH, weakness: CWE-59)
Windows Installer Elevation of Privilege Vulnerability
CVE-2023-24905 (severity: HIGH, weakness: CWE-284)
Remote Desktop Client Remote Code Execution Vulnerability
CVE-2023-24906 (severity: MEDIUM, weakness: CWE-190)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-24907 (severity: HIGH, weakness: CWE-122)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24908 (severity: HIGH, weakness: CWE-190)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2023-24909 (severity: HIGH, weakness: CWE-190)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-2491 (severity: HIGH, weakness: CWE-77)
A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
CVE-2023-24910 (severity: HIGH, weakness: CWE-476)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2023-24911 (severity: MEDIUM, weakness: CWE-191)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-24912 (severity: HIGH, weakness: CWE-122)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2023-24913 (severity: HIGH, weakness: CWE-122)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24914 (severity: HIGH, weakness: CWE-416)
Win32k Elevation of Privilege Vulnerability
CVE-2023-24919 (severity: MEDIUM, weakness: CWE-79)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-2492 (severity: HIGH, weakness: NVD-CWE-Other)
The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVE-2023-24920 (severity: MEDIUM, weakness: CWE-352)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24921 (severity: MEDIUM, weakness: CWE-79)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24922 (severity: MEDIUM, weakness: CWE-643)
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2023-24923 (severity: MEDIUM, weakness: CWE-200)
Microsoft OneDrive for Android Information Disclosure Vulnerability
CVE-2023-24924 (severity: HIGH, weakness: CWE-125)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24925 (severity: HIGH, weakness: CWE-416)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24926 (severity: HIGH, weakness: CWE-122)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24927 (severity: HIGH, weakness: CWE-843)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24928 (severity: HIGH, weakness: CWE-122)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-24929 (severity: HIGH, weakness: CWE-843)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-2493 (severity: HIGH, weakness: NVD-CWE-Other)
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVE-2023-24930 (severity: HIGH, weakness: CWE-59)
Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
CVE-2023-24931 (severity: HIGH, weakness: CWE-125)
Windows Secure Channel Denial of Service Vulnerability
CVE-2023-24932 (severity: MEDIUM, weakness: CWE-863)
Secure Boot Security Feature Bypass Vulnerability
CVE-2023-24934 (severity: MEDIUM, weakness: CWE-306)
Microsoft Defender Security Feature Bypass Vulnerability
CVE-2023-24935 (severity: MEDIUM, weakness: CWE-601)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2023-24936 (severity: HIGH, weakness: NVD-CWE-Other)
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-24937 (severity: MEDIUM, weakness: CWE-20)
Windows CryptoAPI Denial of Service Vulnerability
CVE-2023-24938 (severity: MEDIUM, weakness: CWE-476)
Windows CryptoAPI Denial of Service Vulnerability
CVE-2023-24939 (severity: HIGH, weakness: NVD-CWE-Other)
Server for NFS Denial of Service Vulnerability
CVE-2023-2494 (severity: HIGH, weakness: CWE-862)
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to modify access to the plugin when it should only be the administrator's privilege.
CVE-2023-24940 (severity: HIGH, weakness: CWE-476)
Windows Pragmatic General Multicast (PGM) Denial of Service Vulnerability
CVE-2023-24941 (severity: CRITICAL, weakness: CWE-908)
Windows Network File System Remote Code Execution Vulnerability
CVE-2023-24942 (severity: HIGH, weakness: CWE-126)
Remote Procedure Call Runtime Denial of Service Vulnerability
CVE-2023-24943 (severity: CRITICAL, weakness: CWE-122)
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVE-2023-24944 (severity: MEDIUM, weakness: CWE-843)
Windows Bluetooth Driver Information Disclosure Vulnerability
CVE-2023-24945 (severity: MEDIUM, weakness: CWE-190)
Windows iSCSI Target Service Information Disclosure Vulnerability
CVE-2023-24946 (severity: HIGH, weakness: CWE-591)
Windows Backup Service Elevation of Privilege Vulnerability
CVE-2023-24947 (severity: HIGH, weakness: CWE-416)
Windows Bluetooth Driver Remote Code Execution Vulnerability
CVE-2023-24948 (severity: HIGH, weakness: CWE-122)
Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVE-2023-24949 (severity: HIGH, weakness: CWE-190)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-2495 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.
CVE-2023-24950 (severity: MEDIUM, weakness: CWE-20)
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2023-24953 (severity: HIGH, weakness: CWE-416)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2023-24954 (severity: MEDIUM, weakness: CWE-918)
Microsoft SharePoint Server Information Disclosure Vulnerability
CVE-2023-24955 (severity: HIGH, weakness: CWE-94)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2023-24956 (severity: HIGH, weakness: CWE-89)
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php.
CVE-2023-24957 (severity: MEDIUM, weakness: CWE-79)
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246115.
CVE-2023-24958 (severity: HIGH, weakness: CWE-78)
A vulnerability in the IBM TS7700 Management Interface 8.51.2.12, 8.52.200.111, 8.52.102.13, and 8.53.0.63 could allow an authenticated user to submit a specially crafted URL leading to privilege escalation and remote code execution. IBM X-Force ID: 246320.
CVE-2023-24959 (severity: HIGH, weakness: CWE-200)
IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332.
CVE-2023-2496 (severity: HIGH, weakness: NVD-CWE-Other)
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability check on the 'validate_upload' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2023-24960 (severity: HIGH, weakness: CWE-22)
IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 246333
CVE-2023-24964 (severity: MEDIUM, weakness: CWE-312)
IBM InfoSphere Information Server 11.7 could allow a local user to obtain sensitive information from a log files. IBM X-Force ID: 246463.
CVE-2023-24965 (severity: MEDIUM, weakness: CWE-668)
IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. IBM X-Force ID: 246713.
CVE-2023-24966 (severity: MEDIUM, weakness: CWE-79)
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246904.
CVE-2023-2497 (severity: HIGH, weakness: CWE-352)
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers to exploit PHP Object Injection due to the use of unserialize() on the user supplied parameter via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2023-24971 (severity: MEDIUM, weakness: CWE-502)
IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 could allow a user to cause a denial of service due to the deserializing of untrusted serialized Java objects. IBM X-Force ID: 246976.
CVE-2023-24975 (severity: MEDIUM, weakness: CWE-20)
IBM Spectrum Symphony 7.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 247030.
CVE-2023-24977 (severity: HIGH, weakness: CWE-125)
Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7214 https://github.com/apache/inlong/pull/7214 to solve it.
CVE-2023-24978 (severity: HIGH, weakness: CWE-824)
A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted SPP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19788)
CVE-2023-24979 (severity: HIGH, weakness: CWE-787)
A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19789)
CVE-2023-2498 (severity: MEDIUM, weakness: CWE-79)
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.19 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2023-24980 (severity: HIGH, weakness: CWE-787)
A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19790)