stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-35166 (severity: HIGH, weakness: CWE-863)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.
CVE-2023-35167 (severity: MEDIUM, weakness: CWE-284)
Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.
CVE-2023-35168 (severity: MEDIUM, weakness: CWE-732)
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability.
CVE-2023-35169 (severity: CRITICAL, weakness: CWE-22)
PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, which results in a remote code execution vulnerability. Every application that stores attachments with `Attachment::save()` without providing a `$filename` or passing unsanitized user input is affected by this attack. An attacker can send an email with a malicious attachment to the inbox, which gets crawled with `webklex/php-imap` or `webklex/laravel-imap`. Prerequisite for the vulnerability is that the script stores the attachments without providing a `$filename`, or providing an unsanitized `$filename`, in `src/Attachment::save(string $path, string $filename = null)`. In this case, where no `$filename` gets passed into the `Attachment::save()` method, the package would use a series of unsanitized and insecure input values from the mail as fallback. Even if a developer passes a `$filename` into the `Attachment::save()` method, e.g. by passing the name or filename of the mail attachment itself (from email headers), the input values never get sanitized by the package. There is also no restriction about the file extension (e.g. ".php") or the contents of a file. This allows an attacker to upload malicious code of any type and content at any location where the underlying user has write permissions. The attacker can also overwrite existing files and inject malicious code into files that, e.g. get executed by the system via cron or requests. Version 5.3.0 contains a patch for this issue.
CVE-2023-3517 (severity: HIGH, weakness: CWE-99)
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.
CVE-2023-35171 (severity: MEDIUM, weakness: CWE-601)
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available.
CVE-2023-35172 (severity: CRITICAL, weakness: CWE-307)
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can bruteforce the password reset links. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. No known workarounds are available.
CVE-2023-35173 (severity: MEDIUM, weakness: CWE-284)
Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix.
CVE-2023-35174 (severity: CRITICAL, weakness: CWE-78)
Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.
CVE-2023-35175 (severity: CRITICAL, weakness: CWE-918)
Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.
CVE-2023-35176 (severity: HIGH, weakness: CWE-120)
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restore feature through the embedded web service on the device.
CVE-2023-35177 (severity: HIGH, weakness: CWE-787)
Certain HP LaserJet Pro print products are potentially vulnerable to a stack-based buffer overflow related to the compact font format parser.
CVE-2023-35178 (severity: HIGH, weakness: CWE-120)
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow when performing a GET request to scan jobs.
CVE-2023-35179 (severity: HIGH, weakness: CWE-284)
A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.
CVE-2023-3518 (severity: HIGH, weakness: CWE-266)
HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.
CVE-2023-35180 (severity: HIGH, weakness: CWE-502)
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds ARM API.
CVE-2023-35181 (severity: HIGH, weakness: CWE-276)
The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation.
CVE-2023-35182 (severity: CRITICAL, weakness: CWE-502)
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server.
CVE-2023-35183 (severity: HIGH, weakness: CWE-276)
The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation.
CVE-2023-35184 (severity: CRITICAL, weakness: CWE-502)
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a SolarWinds service resulting in a remote code execution.
CVE-2023-35185 (severity: MEDIUM, weakness: CWE-22)
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges.
CVE-2023-35186 (severity: HIGH, weakness: CWE-502)
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution.
CVE-2023-35187 (severity: CRITICAL, weakness: CWE-22)
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to achieve the Remote Code Execution.
CVE-2023-35188 (severity: HIGH, weakness: CWE-89)
SQL Injection Remote Code Execution Vulnerability was found using a create statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited.
CVE-2023-35189 (severity: CRITICAL, weakness: CWE-434)
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.
CVE-2023-3519 (severity: CRITICAL, weakness: CWE-94)
Unauthenticated remote code execution
CVE-2023-35191 (severity: MEDIUM, weakness: CWE-400)
Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of service via network access.
CVE-2023-35192 (severity: HIGH, weakness: CWE-427)
Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-35193 (severity: HIGH, weakness: CWE-78)
An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset 0x4bddb8.
CVE-2023-35194 (severity: HIGH, weakness: CWE-78)
An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset `0x4bde44`.
CVE-2023-3520 (severity: MEDIUM, weakness: CWE-614)
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.
CVE-2023-3521 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.
CVE-2023-3522 (severity: CRITICAL, weakness: CWE-89)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection.This issue affects License Portal System: before 1.48.
CVE-2023-3523 (severity: MEDIUM, weakness: CWE-125)
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
CVE-2023-3524 (severity: MEDIUM, weakness: NVD-CWE-Other)
The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
CVE-2023-3525 (severity: HIGH, weakness: NVD-CWE-Other)
The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to 'APPROVED' without payment.
CVE-2023-3526 (severity: CRITICAL, weakness: CWE-79)
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.
CVE-2023-3527 (severity: MEDIUM, weakness: CWE-1236)
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.
CVE-2023-3528 (severity: CRITICAL, weakness: CWE-89)
A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument cat_id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-233252.
CVE-2023-3529 (severity: HIGH, weakness: CWE-203)
A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api/otp/send?id=[ID][ampersand]method=sms of the component OTP URI Interface. The manipulation leads to information exposure through discrepancy. It is possible to initiate the attack remotely. The identifier VDB-233253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-35296 (severity: MEDIUM, weakness: CWE-125)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-35297 (severity: HIGH, weakness: CWE-843)
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVE-2023-35298 (severity: HIGH, weakness: CWE-400)
HTTP.sys Denial of Service Vulnerability
CVE-2023-35299 (severity: HIGH, weakness: CWE-125)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2023-35300 (severity: HIGH, weakness: CWE-416)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2023-35302 (severity: HIGH, weakness: CWE-122)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-35303 (severity: HIGH, weakness: CWE-20)
USB Audio Class System Driver Remote Code Execution Vulnerability
CVE-2023-35304 (severity: HIGH, weakness: CWE-122)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35305 (severity: HIGH, weakness: CWE-122)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35306 (severity: MEDIUM, weakness: CWE-20)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-35308 (severity: MEDIUM, weakness: CWE-73)
Windows MSHTML Platform Security Feature Bypass Vulnerability
CVE-2023-35309 (severity: HIGH, weakness: CWE-591)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-3531 (severity: HIGH, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVE-2023-35310 (severity: MEDIUM, weakness: CWE-591)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2023-35311 (severity: HIGH, weakness: CWE-367)
Microsoft Outlook Security Feature Bypass Vulnerability
CVE-2023-35312 (severity: HIGH, weakness: CWE-190)
Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability
CVE-2023-35313 (severity: HIGH, weakness: CWE-416)
Windows Online Certificate Status Protocol (OCSP) SnapIn Remote Code Execution Vulnerability
CVE-2023-35314 (severity: MEDIUM, weakness: CWE-125)
Remote Procedure Call Runtime Denial of Service Vulnerability
CVE-2023-35315 (severity: HIGH, weakness: CWE-190)
Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability
CVE-2023-35316 (severity: MEDIUM, weakness: CWE-125)
Remote Procedure Call Runtime Information Disclosure Vulnerability
CVE-2023-35317 (severity: HIGH, weakness: CWE-502)
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
CVE-2023-35318 (severity: MEDIUM, weakness: CWE-125)
Remote Procedure Call Runtime Denial of Service Vulnerability
CVE-2023-35319 (severity: MEDIUM, weakness: CWE-125)
Remote Procedure Call Runtime Denial of Service Vulnerability
CVE-2023-3532 (severity: HIGH, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.
CVE-2023-35320 (severity: HIGH, weakness: CWE-59)
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
CVE-2023-35321 (severity: MEDIUM, weakness: CWE-170)
Windows Deployment Services Denial of Service Vulnerability
CVE-2023-35322 (severity: HIGH, weakness: CWE-121)
Windows Deployment Services Remote Code Execution Vulnerability
CVE-2023-35323 (severity: HIGH, weakness: CWE-416)
Windows OLE Remote Code Execution Vulnerability
CVE-2023-35324 (severity: MEDIUM, weakness: CWE-126)
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-35325 (severity: HIGH, weakness: CWE-908)
Windows Print Spooler Information Disclosure Vulnerability
CVE-2023-35326 (severity: MEDIUM, weakness: CWE-908)
Windows CDP User Components Information Disclosure Vulnerability
CVE-2023-35328 (severity: HIGH, weakness: CWE-197)
Windows Transaction Manager Elevation of Privilege Vulnerability
CVE-2023-35329 (severity: MEDIUM, weakness: CWE-400)
Windows Authentication Denial of Service Vulnerability
CVE-2023-3533 (severity: CRITICAL, weakness: CWE-22)
Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.
CVE-2023-35330 (severity: HIGH, weakness: CWE-126)
Windows Extended Negotiation Denial of Service Vulnerability
CVE-2023-35331 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Local Security Authority (LSA) Denial of Service Vulnerability
CVE-2023-35332 (severity: MEDIUM, weakness: CWE-326)
Windows Remote Desktop Protocol Security Feature Bypass
CVE-2023-35333 (severity: HIGH, weakness: CWE-94)
MediaWiki PandocUpload Extension Remote Code Execution Vulnerability
CVE-2023-35335 (severity: HIGH, weakness: CWE-79)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-35336 (severity: MEDIUM, weakness: CWE-20)
Windows MSHTML Platform Security Feature Bypass Vulnerability
CVE-2023-35337 (severity: HIGH, weakness: CWE-122)
Win32k Elevation of Privilege Vulnerability
CVE-2023-35338 (severity: HIGH, weakness: CWE-476)
Windows Peer Name Resolution Protocol Denial of Service Vulnerability
CVE-2023-35339 (severity: HIGH, weakness: CWE-400)
Windows CryptoAPI Denial of Service Vulnerability
CVE-2023-3534 (severity: HIGH, weakness: CWE-89)
A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file check_availability.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-233286 is the identifier assigned to this vulnerability.
CVE-2023-35340 (severity: HIGH, weakness: CWE-591)
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
CVE-2023-35341 (severity: MEDIUM, weakness: CWE-190)
Microsoft DirectMusic Information Disclosure Vulnerability
CVE-2023-35342 (severity: HIGH, weakness: CWE-59)
Windows Image Acquisition Elevation of Privilege Vulnerability
CVE-2023-35343 (severity: HIGH, weakness: CWE-426)
Windows Geolocation Service Remote Code Execution Vulnerability
CVE-2023-35344 (severity: MEDIUM, weakness: CWE-591)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2023-35345 (severity: MEDIUM, weakness: CWE-591)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2023-35346 (severity: MEDIUM, weakness: CWE-591)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2023-35347 (severity: HIGH, weakness: CWE-59)
Microsoft Install Service Elevation of Privilege Vulnerability
CVE-2023-35348 (severity: MEDIUM, weakness: CWE-522)
Active Directory Federation Service Security Feature Bypass Vulnerability
CVE-2023-35349 (severity: CRITICAL, weakness: CWE-20)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-3535 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in SimplePHPscripts FAQ Script PHP 2.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233287.
CVE-2023-35350 (severity: HIGH, weakness: CWE-122)
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
CVE-2023-35351 (severity: MEDIUM, weakness: CWE-416)
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
CVE-2023-35352 (severity: HIGH, weakness: CWE-693)
Windows Remote Desktop Security Feature Bypass Vulnerability
CVE-2023-35353 (severity: HIGH, weakness: CWE-59)
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
CVE-2023-35355 (severity: HIGH, weakness: CWE-121)
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2023-35356 (severity: HIGH, weakness: CWE-843)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35357 (severity: HIGH, weakness: CWE-125)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35358 (severity: HIGH, weakness: CWE-125)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35359 (severity: HIGH, weakness: CWE-23)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-3536 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in SimplePHPscripts Funeral Script PHP 3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233288.
CVE-2023-35360 (severity: HIGH, weakness: CWE-591)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35361 (severity: HIGH, weakness: CWE-362)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35362 (severity: HIGH, weakness: CWE-591)
Windows Clip Service Elevation of Privilege Vulnerability
CVE-2023-35363 (severity: HIGH, weakness: CWE-122)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35364 (severity: HIGH, weakness: CWE-190)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35365 (severity: CRITICAL, weakness: CWE-20)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2023-35366 (severity: CRITICAL, weakness: CWE-20)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2023-35367 (severity: CRITICAL, weakness: CWE-20)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2023-35368 (severity: HIGH, weakness: CWE-20)
Microsoft Exchange Remote Code Execution Vulnerability
CVE-2023-3537 (severity: MEDIUM, weakness: CWE-79)
A vulnerability classified as problematic has been found in SimplePHPscripts News Script PHP Pro 2.4. This affects an unknown part of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-233289 was assigned to this vulnerability.
CVE-2023-35371 (severity: HIGH, weakness: CWE-415)
Microsoft Office Remote Code Execution Vulnerability
CVE-2023-35372 (severity: HIGH, weakness: CWE-190)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2023-35373 (severity: MEDIUM, weakness: CWE-347)
Mono Authenticode Validation Spoofing Vulnerability
CVE-2023-35374 (severity: HIGH, weakness: CWE-122)
Paint 3D Remote Code Execution Vulnerability
CVE-2023-35376 (severity: MEDIUM, weakness: CWE-20)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability