stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-3011 (severity: HIGH, weakness: NVD-CWE-Other)
The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missing or incorrect nonce validation on the arm_check_user_cap function. This makes it possible for unauthenticated attackers to perform multiple unauthorized actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2023-30111 (severity: MEDIUM, weakness: CWE-79)
Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-30112 (severity: HIGH, weakness: CWE-89)
Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection.
CVE-2023-3012 (severity: MEDIUM, weakness: CWE-476)
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.
CVE-2023-30122 (severity: CRITICAL, weakness: CWE-434)
An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2023-30123 (severity: MEDIUM, weakness: CWE-79)
wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.
CVE-2023-30124 (severity: MEDIUM, weakness: CWE-79)
LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-30125 (severity: MEDIUM, weakness: CWE-79)
EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-3013 (severity: MEDIUM, weakness: CWE-252)
Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.
CVE-2023-30130 (severity: HIGH, weakness: CWE-94)
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
CVE-2023-30131 (severity: CRITICAL, weakness: CWE-94)
An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls.
CVE-2023-30132 (severity: HIGH, weakness: CWE-326)
An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptographic Key.
CVE-2023-30135 (severity: CRITICAL, weakness: CWE-77)
Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function.
CVE-2023-3014 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6. Affected is an unknown function of the file admin/admincore.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230358 is the identifier assigned to this vulnerability.
CVE-2023-30145 (severity: CRITICAL, weakness: CWE-94)
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.
CVE-2023-30146 (severity: HIGH, weakness: CWE-312)
Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the administrator credentials.
CVE-2023-30148 (severity: MEDIUM, weakness: CWE-79)
Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allows remote authenticated users to inject arbitrary web script or HTML via the body_text or body_text_rude field in /sourcefiles/BlockhtmlClass.php and /sourcefiles/blockhtml.php.
CVE-2023-30149 (severity: CRITICAL, weakness: CWE-89)
SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type, input_name. or q parameter in the autocompletion.php front controller.
CVE-2023-3015 (severity: CRITICAL, weakness: CWE-918)
A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359.
CVE-2023-30150 (severity: CRITICAL, weakness: CWE-89)
PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
CVE-2023-30151 (severity: CRITICAL, weakness: CWE-89)
A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the `key` GET parameter.
CVE-2023-30153 (severity: CRITICAL, weakness: CWE-89)
An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front controller.
CVE-2023-30154 (severity: CRITICAL, weakness: CWE-89)
Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the 'id_product' parameter in hooks DisplayRightColumnProduct and DisplayProductButtons.
CVE-2023-3016 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/admincore.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230360.
CVE-2023-3017 (severity: MEDIUM, weakness: CWE-80)
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as problematic. This affects an unknown part of the file admin/?page=user/manage_user of the component Manage User Page. The manipulation of the argument First Name/Middle Name/Last Name leads to basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230361 was assigned to this vulnerability.
CVE-2023-30172 (severity: HIGH, weakness: CWE-22)
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
CVE-2023-30177 (severity: MEDIUM, weakness: CWE-79)
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
CVE-2023-30179 (severity: HIGH, weakness: CWE-94)
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.
CVE-2023-3018 (severity: HIGH, weakness: CWE-284)
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/?page=user/list. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230362 is the identifier assigned to this vulnerability.
CVE-2023-30184 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter at /index.php/archives/1/comment.
CVE-2023-30185 (severity: CRITICAL, weakness: CWE-434)
CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.
CVE-2023-30186 (severity: CRITICAL, weakness: CWE-416)
A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
CVE-2023-30187 (severity: CRITICAL, weakness: CWE-787)
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
CVE-2023-30188 (severity: HIGH, weakness: CWE-835)
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.
CVE-2023-30189 (severity: CRITICAL, weakness: CWE-89)
Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook().
CVE-2023-3019 (severity: MEDIUM, weakness: CWE-416)
A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
CVE-2023-30191 (severity: CRITICAL, weakness: CWE-89)
PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent().
CVE-2023-30192 (severity: CRITICAL, weakness: CWE-89)
Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().
CVE-2023-30194 (severity: CRITICAL, weakness: CWE-89)
Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
CVE-2023-30195 (severity: HIGH, weakness: CWE-862)
In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without restriction formatted in json.
CVE-2023-30196 (severity: HIGH, weakness: CWE-22)
Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.
CVE-2023-30197 (severity: HIGH, weakness: CWE-22)
Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal information without restriction by performing a path traversal attack.
CVE-2023-30198 (severity: HIGH, weakness: CWE-22)
Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php.
CVE-2023-30199 (severity: HIGH, weakness: CWE-22)
Prestashop customexporter <= 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php.
CVE-2023-3020 (severity: CRITICAL, weakness: CWE-79)
Cross-site Scripting (XSS) - Reflected in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
CVE-2023-30200 (severity: HIGH, weakness: CWE-22)
In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for PrestaShop, a guest can download personal informations without restriction by performing a path traversal attack.
CVE-2023-30203 (severity: CRITICAL, weakness: CWE-89)
Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the event_id parameter at /php-jms/result_sheet.php.
CVE-2023-30204 (severity: CRITICAL, weakness: CWE-89)
Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the judge_id parameter at /php-jms/edit_judge.php.
CVE-2023-30205 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the unique_id parameter in /admin/article.php.
CVE-2023-30207 (severity: MEDIUM, weakness: CWE-369)
A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.
CVE-2023-3021 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
CVE-2023-30210 (severity: MEDIUM, weakness: CWE-79)
OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.
CVE-2023-30211 (severity: CRITICAL, weakness: CWE-89)
OURPHP <= 7.2.0 is vulnerable to SQL Injection.
CVE-2023-30212 (severity: MEDIUM, weakness: CWE-79)
OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.
CVE-2023-30216 (severity: MEDIUM, weakness: CWE-639)
Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information.
CVE-2023-3022 (severity: MEDIUM, weakness: CWE-843)
A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, sometimes holding rt6_info and other times fib6_info. This was not accounted for in other parts of the code where rt6_info was expected unconditionally, potentially leading to a kernel panic in fib6_rule_suppress.
CVE-2023-30222 (severity: HIGH, weakness: CWE-295)
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to retrieve password hashes for all users via eavesdropping.
CVE-2023-30223 (severity: HIGH, weakness: CWE-287)
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packets containing requests to perform arbitrary actions.
CVE-2023-30226 (severity: MEDIUM, weakness: CWE-834)
An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to cause a denial of service via crafted elf file.
CVE-2023-3023 (severity: HIGH, weakness: NVD-CWE-Other)
The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, 5.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level or above permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2023-30237 (severity: HIGH, weakness: CWE-427)
CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe.
CVE-2023-3024 (severity: MEDIUM, weakness: CWE-787)
Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.
CVE-2023-30242 (severity: CRITICAL, weakness: CWE-89)
NS-ASG v6.3 was discovered to contain a SQL injection vulnerability via the component /admin/add_ikev2.php.
CVE-2023-30243 (severity: HIGH, weakness: CWE-89)
Beijing Netcon NS-ASG Application Security Gateway v6.3 is vulnerable to SQL Injection via TunnelId that allows access to sensitive information.
CVE-2023-30245 (severity: CRITICAL, weakness: CWE-89)
SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id parameter of the edit_criteria.php file.
CVE-2023-30246 (severity: CRITICAL, weakness: CWE-89)
SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the contestant_id parameter.
CVE-2023-30247 (severity: CRITICAL, weakness: CWE-434)
File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code via the update_settings parameter.
CVE-2023-3025 (severity: HIGH, weakness: NVD-CWE-Other)
The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVE-2023-30253 (severity: HIGH, weakness: CWE-78)
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.
CVE-2023-30256 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file.
CVE-2023-30257 (severity: HIGH, weakness: CWE-120)
A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.
CVE-2023-30258 (severity: CRITICAL, weakness: CWE-78)
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.
CVE-2023-30259 (severity: MEDIUM, weakness: CWE-125)
A Buffer Overflow vulnerability in importshp plugin in LibreCAD 2.2.0 allows attackers to obtain sensitive information via a crafted DBF file.
CVE-2023-3026 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.
CVE-2023-30260 (severity: HIGH, weakness: CWE-77)
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.
CVE-2023-30261 (severity: CRITICAL, weakness: CWE-78)
Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request.
CVE-2023-30262 (severity: HIGH, weakness: CWE-502)
An issue found in MIM software Inc MIM License Server and MIMpacs services v.6.9 thru v.7.0 fixed in v.7.0.10 allows a remote unauthenticated attacker to execute arbitrary code via the RMI Registry service.
CVE-2023-30264 (severity: CRITICAL, weakness: CWE-434)
CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update.
CVE-2023-30265 (severity: MEDIUM, weakness: CWE-22)
CLTPHP <=6.0 is vulnerable to Directory Traversal.
CVE-2023-30266 (severity: HIGH, weakness: CWE-434)
CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type.
CVE-2023-30267 (severity: MEDIUM, weakness: CWE-79)
CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.
CVE-2023-30268 (severity: CRITICAL, weakness: CWE-22)
CLTPHP <=6.0 is vulnerable to Improper Input Validation.
CVE-2023-30269 (severity: HIGH, weakness: CWE-20)
CLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php.
CVE-2023-3027 (severity: HIGH, weakness: CWE-269)
The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.
CVE-2023-3028 (severity: CRITICAL, weakness: CWE-287)
Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT backend does not require authentication, allowing unauthorized connections from an attacker. - The vehicles publish their telemetry data (e.g. GPS Location, speed, odometer, fuel, etc) as messages in public topics. The backend also sends commands to the vehicles as MQTT posts in public topics. As a result, an attacker can access the confidential data of the entire fleet that is managed by the backend. - The MQTT messages sent by the vehicles or the backend are not encrypted or authenticated. An attacker can create and post messages to impersonate a vehicle or the backend. The attacker could then, for example, send incorrect information to the backend about the vehicle's location. - The backend can inject data into a vehicle´s CAN bus by sending a specific MQTT message on a public topic. Because these messages are not authenticated or encrypted, an attacker could impersonate the backend, create a fake message and inject CAN data in any vehicle managed by the backend. The confirmed version is 201808021036, however further versions have been also identified as potentially impacted.
CVE-2023-30280 (severity: CRITICAL, weakness: CWE-120)
Buffer Overflow vulnerability found in Netgear R6900 v.1.0.2.26, R6700v3 v.1.0.4.128, R6700 v.1.0.0.26 allows a remote attacker to execute arbitrary code and cause a denial ofservice via the getInputData parameter of the fwSchedule.cgi page.
CVE-2023-30281 (severity: HIGH, weakness: CWE-276)
Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Commander for PrestaShop, a guest can access exports from the module which can lead to leak of personnal informations from ps_customer table sush as name / surname / email
CVE-2023-30282 (severity: HIGH, weakness: NVD-CWE-Other)
PrestaShop scexportcustomers <= 3.6.1 is vulnerable to Incorrect Access Control. Due to a lack of permissions' control, a guest can access exports from the module which can lead to leak of personal information from customer table.
CVE-2023-30285 (severity: HIGH, weakness: NVD-CWE-Other)
An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/synchronizer/1.0/technicalUser.
CVE-2023-3029 (severity: HIGH, weakness: CWE-352)
A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. This vulnerability affects unknown code of the file /note/index/delete. The manipulation of the argument id leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230458 is the identifier assigned to this vulnerability.
CVE-2023-30297 (severity: HIGH, weakness: NVD-CWE-Other)
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server.
CVE-2023-30300 (severity: MEDIUM, weakness: CWE-835)
An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop.
CVE-2023-30305 (severity: HIGH, weakness: NVD-CWE-Other)
An issue discovered in Linksys E5600 routers allows attackers to hijack TCP sessions which could lead to a denial of service.
CVE-2023-30306 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue discovered in Mercury x30g, Mercury YR1800XG routers allows attackers to hijack TCP sessions which could lead to a denial of service.
CVE-2023-30307 (severity: MEDIUM, weakness: CWE-384)
An issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR1200L, and TP-LINK TL-R476G routers allows attackers to hijack TCP sessions which could lead to a denial of service.
CVE-2023-30308 (severity: MEDIUM, weakness: CWE-203)
An issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hijack TCP sessions which could lead to a denial of service.
CVE-2023-30309 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue discovered in D-Link DI-7003GV2 routers allows attackers to hijack TCP sessions which could lead to a denial of service.
CVE-2023-3031 (severity: MEDIUM, weakness: CWE-22)
Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.