stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-38138 (severity: MEDIUM, weakness: CWE-79)
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2023-38139 (severity: HIGH, weakness: CWE-416)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-3814 (severity: MEDIUM, weakness: CWE-863)
The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.
CVE-2023-38140 (severity: MEDIUM, weakness: CWE-908)
Windows Kernel Information Disclosure Vulnerability
CVE-2023-38141 (severity: HIGH, weakness: CWE-367)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-38142 (severity: HIGH, weakness: CWE-190)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-38143 (severity: HIGH, weakness: CWE-122)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2023-38144 (severity: HIGH, weakness: CWE-126)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2023-38146 (severity: HIGH, weakness: CWE-367)
Windows Themes Remote Code Execution Vulnerability
CVE-2023-38147 (severity: HIGH, weakness: CWE-122)
Windows Miracast Wireless Display Remote Code Execution Vulnerability
CVE-2023-38148 (severity: HIGH, weakness: CWE-121)
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
CVE-2023-38149 (severity: HIGH, weakness: CWE-400)
Windows TCP/IP Denial of Service Vulnerability
CVE-2023-3815 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function uploadFilesPath of the component File Upload. The manipulation of the argument originalFilenames leads to cross site scripting. The attack may be launched remotely. VDB-235118 is the identifier assigned to this vulnerability.
CVE-2023-38150 (severity: HIGH, weakness: CWE-190)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-38151 (severity: HIGH, weakness: CWE-908)
Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability
CVE-2023-38152 (severity: MEDIUM, weakness: CWE-126)
DHCP Server Service Information Disclosure Vulnerability
CVE-2023-38154 (severity: HIGH, weakness: CWE-122)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-38155 (severity: HIGH, weakness: CWE-502)
Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-38156 (severity: HIGH, weakness: CWE-20)
Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability
CVE-2023-38157 (severity: MEDIUM, weakness: CWE-693)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2023-38158 (severity: LOW, weakness: CWE-200)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2023-38159 (severity: HIGH, weakness: CWE-591)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2023-38160 (severity: MEDIUM, weakness: CWE-416)
Windows TCP/IP Information Disclosure Vulnerability
CVE-2023-38161 (severity: HIGH, weakness: CWE-416)
Windows GDI Elevation of Privilege Vulnerability
CVE-2023-38162 (severity: HIGH, weakness: CWE-191)
DHCP Server Service Denial of Service Vulnerability
CVE-2023-38163 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Defender Attack Surface Reduction Security Feature Bypass
CVE-2023-38164 (severity: MEDIUM, weakness: CWE-79)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-38166 (severity: HIGH, weakness: CWE-416)
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
CVE-2023-38167 (severity: HIGH, weakness: CWE-284)
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
CVE-2023-38169 (severity: HIGH, weakness: CWE-416)
Microsoft SQL OLE DB Remote Code Execution Vulnerability
CVE-2023-3817 (severity: MEDIUM, weakness: CWE-606)
Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
CVE-2023-38170 (severity: HIGH, weakness: CWE-122)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2023-38171 (severity: HIGH, weakness: CWE-476)
Microsoft QUIC Denial of Service Vulnerability
CVE-2023-38172 (severity: HIGH, weakness: CWE-126)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2023-38173 (severity: MEDIUM, weakness: CWE-290)
Microsoft Edge for Android Spoofing Vulnerability
CVE-2023-38174 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2023-38175 (severity: HIGH, weakness: CWE-59)
Microsoft Windows Defender Elevation of Privilege Vulnerability
CVE-2023-38176 (severity: HIGH, weakness: CWE-22)
Azure Arc-Enabled Servers Elevation of Privilege Vulnerability
CVE-2023-38177 (severity: MEDIUM, weakness: CWE-502)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2023-38178 (severity: HIGH, weakness: CWE-400)
.NET Core and Visual Studio Denial of Service Vulnerability
CVE-2023-38180 (severity: HIGH, weakness: CWE-400)
.NET and Visual Studio Denial of Service Vulnerability
CVE-2023-38181 (severity: HIGH, weakness: CWE-502)
Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-38182 (severity: HIGH, weakness: CWE-502)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-38184 (severity: HIGH, weakness: CWE-416)
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVE-2023-38185 (severity: HIGH, weakness: CWE-23)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-38186 (severity: CRITICAL, weakness: CWE-306)
Windows Mobile Device Management Elevation of Privilege Vulnerability
CVE-2023-38187 (severity: MEDIUM, weakness: CWE-269)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-38188 (severity: MEDIUM, weakness: CWE-79)
Azure Apache Hadoop Spoofing Vulnerability
CVE-2023-3819 (severity: HIGH, weakness: CWE-200)
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.
CVE-2023-38190 (severity: HIGH, weakness: CWE-89)
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter.
CVE-2023-38191 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename.
CVE-2023-38192 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwords.
CVE-2023-38193 (severity: HIGH, weakness: CWE-77)
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line.
CVE-2023-38194 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.
CVE-2023-38195 (severity: MEDIUM, weakness: NVD-CWE-Other)
Datalust Seq before 2023.2.9489 allows insertion of sensitive information into an externally accessible file or directory. This is exploitable only when external (SQL Server or PostgreSQL) metadata storage is used. Exploitation can only occur from a high-privileged user account.
CVE-2023-38197 (severity: HIGH, weakness: CWE-835)
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.
CVE-2023-38198 (severity: CRITICAL, weakness: CWE-94)
acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.
CVE-2023-38199 (severity: CRITICAL, weakness: CWE-843)
coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.
CVE-2023-3820 (severity: HIGH, weakness: CWE-89)
SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
CVE-2023-38200 (severity: HIGH, weakness: CWE-400)
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
CVE-2023-38201 (severity: MEDIUM, weakness: CWE-639)
A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
CVE-2023-38203 (severity: CRITICAL, weakness: CWE-502)
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-38204 (severity: CRITICAL, weakness: CWE-502)
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-38205 (severity: HIGH, weakness: CWE-284)
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVE-2023-38206 (severity: MEDIUM, weakness: CWE-284)
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints resulting in a low-confidentiality impact. Exploitation of this issue does not require user interaction.
CVE-2023-38207 (severity: HIGH, weakness: CWE-91)
Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction.
CVE-2023-38208 (severity: HIGH, weakness: CWE-78)
Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.
CVE-2023-38209 (severity: MEDIUM, weakness: CWE-863)
Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.
CVE-2023-3821 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.
CVE-2023-38210 (severity: MEDIUM, weakness: CWE-400)
Adobe XMP Toolkit versions 2022.06 is affected by a Uncontrolled Resource Consumption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38211 (severity: HIGH, weakness: CWE-416)
Adobe Dimension version 3.4.9 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38212 (severity: HIGH, weakness: CWE-122)
Adobe Dimension version 3.4.9 is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38213 (severity: MEDIUM, weakness: CWE-125)
Adobe Dimension version 3.4.9 is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38214 (severity: MEDIUM, weakness: CWE-79)
Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVE-2023-38215 (severity: MEDIUM, weakness: CWE-79)
Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVE-2023-38216 (severity: MEDIUM, weakness: CWE-416)
Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38217 (severity: MEDIUM, weakness: CWE-125)
Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38218 (severity: HIGH, weakness: CWE-863)
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation.
CVE-2023-38219 (severity: HIGH, weakness: CWE-79)
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Payload is stored in an admin area, resulting in high confidentiality and integrity impact.
CVE-2023-3822 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.
CVE-2023-38220 (severity: HIGH, weakness: CWE-285)
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.
CVE-2023-38221 (severity: MEDIUM, weakness: CWE-89)
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.
CVE-2023-38222 (severity: HIGH, weakness: CWE-416)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38223 (severity: HIGH, weakness: CWE-824)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Access of Uninitialized Pointer that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38224 (severity: HIGH, weakness: CWE-416)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38225 (severity: HIGH, weakness: CWE-416)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38226 (severity: HIGH, weakness: CWE-824)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38227 (severity: HIGH, weakness: CWE-416)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38228 (severity: HIGH, weakness: CWE-416)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38229 (severity: HIGH, weakness: CWE-125)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-3823 (severity: HIGH, weakness: CWE-611)
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.
CVE-2023-38230 (severity: MEDIUM, weakness: CWE-416)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use-After-Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38231 (severity: HIGH, weakness: CWE-787)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38232 (severity: MEDIUM, weakness: CWE-125)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38233 (severity: HIGH, weakness: CWE-787)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-38234 (severity: HIGH, weakness: CWE-824)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.