stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-35377 (severity: MEDIUM, weakness: CWE-20)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2023-35378 (severity: HIGH, weakness: CWE-367)
Windows Projected File System Elevation of Privilege Vulnerability
CVE-2023-35379 (severity: HIGH, weakness: CWE-59)
Reliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege Vulnerability
CVE-2023-3538 (severity: MEDIUM, weakness: CWE-79)
A vulnerability classified as problematic was found in SimplePHPscripts Photo Gallery PHP 2.0. This vulnerability affects unknown code of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-233290 is the identifier assigned to this vulnerability.
CVE-2023-35380 (severity: HIGH, weakness: CWE-416)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35381 (severity: HIGH, weakness: CWE-190)
Windows Fax Service Remote Code Execution Vulnerability
CVE-2023-35382 (severity: HIGH, weakness: CWE-416)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35383 (severity: HIGH, weakness: CWE-190)
Microsoft Message Queuing Information Disclosure Vulnerability
CVE-2023-35384 (severity: MEDIUM, weakness: CWE-73)
Windows HTML Platforms Security Feature Bypass Vulnerability
CVE-2023-35385 (severity: CRITICAL, weakness: CWE-190)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-35386 (severity: HIGH, weakness: CWE-125)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35387 (severity: HIGH, weakness: CWE-191)
Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability
CVE-2023-35388 (severity: HIGH, weakness: CWE-502)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-35389 (severity: MEDIUM, weakness: CWE-611)
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2023-3539 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, has been found in SimplePHPscripts Simple Forum PHP 2.7. This issue affects some unknown processing of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-233291.
CVE-2023-35390 (severity: HIGH, weakness: CWE-77)
.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2023-35391 (severity: HIGH, weakness: NVD-CWE-Other)
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
CVE-2023-35392 (severity: MEDIUM, weakness: CWE-290)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2023-35393 (severity: MEDIUM, weakness: CWE-79)
Azure Apache Hive Spoofing Vulnerability
CVE-2023-35394 (severity: MEDIUM, weakness: CWE-79)
Azure HDInsight Jupyter Notebook Spoofing Vulnerability
CVE-2023-3540 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in SimplePHPscripts NewsLetter Script PHP 2.4. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233292.
CVE-2023-3541 (severity: MEDIUM, weakness: CWE-79)
A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /author_posts.php. The manipulation of the argument author with the input g6g12<script>alert(1)</script>o8sdm leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233293 was assigned to this vulnerability.
CVE-2023-3542 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument name/body leads to cross site scripting. The attack may be launched remotely. VDB-233294 is the identifier assigned to this vulnerability.
CVE-2023-3543 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file load.php of the component HTTP POST Request Handler. The manipulation of the argument cid/first_name/second_name/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233295. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-3544 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-3545 (severity: CRITICAL, weakness: CWE-178)
Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of `.htaccess` file. This vulnerability may be exploited by privileged attackers or chained with unauthenticated arbitrary file write vulnerabilities, such as CVE-2023-3533, to achieve remote code execution.
CVE-2023-3547 (severity: HIGH, weakness: NVD-CWE-Other)
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks.
CVE-2023-3548 (severity: CRITICAL, weakness: CWE-307)
An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack.
CVE-2023-3550 (severity: CRITICAL, weakness: CWE-79)
Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator.
CVE-2023-3551 (severity: CRITICAL, weakness: CWE-94)
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVE-2023-3552 (severity: HIGH, weakness: CWE-116)
Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVE-2023-3553 (severity: MEDIUM, weakness: CWE-200)
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVE-2023-3554 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in GZ Scripts GZ Forum Script 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /preview.php. The manipulation of the argument catid/topicid/topic/topic_message/free_name leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233348. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-3555 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in GZ Scripts PHP Vacation Rental Script 1.8. It has been classified as problematic. This affects an unknown part of the file /preview.php. The manipulation of the argument page/layout/sort_by/property_id leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-233349 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-3556 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in GZ Scripts Car Listing Script PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /preview.php. The manipulation of the argument page/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-233350 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-3557 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in GZ Scripts Property Listing Script 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /preview.php. The manipulation of the argument page/layout/sort_by leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-233351. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-3558 (severity: MEDIUM, weakness: CWE-79)
A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8. Affected is an unknown function of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233352. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-3559 (severity: MEDIUM, weakness: CWE-79)
A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability is an unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233353 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-3560 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is some unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack may be launched remotely. VDB-233354 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-3561 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in GZ Scripts PHP GZ Hotel Booking Script 1.8. This affects an unknown part of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233355. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-35618 (severity: CRITICAL, weakness: CWE-416)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-35619 (severity: MEDIUM, weakness: CWE-20)
Microsoft Outlook for Mac Spoofing Vulnerability
CVE-2023-3562 (severity: MEDIUM, weakness: CWE-79)
A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 and classified as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument action leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233356. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-35621 (severity: HIGH, weakness: CWE-799)
Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
CVE-2023-35622 (severity: HIGH, weakness: CWE-290)
Windows DNS Spoofing Vulnerability
CVE-2023-35624 (severity: HIGH, weakness: CWE-59)
Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVE-2023-35625 (severity: MEDIUM, weakness: CWE-200)
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability
CVE-2023-35628 (severity: HIGH, weakness: CWE-416)
Windows MSHTML Platform Remote Code Execution Vulnerability
CVE-2023-35629 (severity: MEDIUM, weakness: CWE-125)
Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability
CVE-2023-3563 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in GZ Scripts GZ E Learning Platform 1.8 and classified as problematic. This issue affects some unknown processing of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-233357 was assigned to this vulnerability.
CVE-2023-35630 (severity: HIGH, weakness: CWE-122)
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
CVE-2023-35631 (severity: HIGH, weakness: NVD-CWE-Other)
Win32k Elevation of Privilege Vulnerability
CVE-2023-35632 (severity: HIGH, weakness: CWE-190)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2023-35633 (severity: HIGH, weakness: CWE-59)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35634 (severity: HIGH, weakness: CWE-121)
Windows Bluetooth Driver Remote Code Execution Vulnerability
CVE-2023-35635 (severity: MEDIUM, weakness: CWE-125)
Windows Kernel Denial of Service Vulnerability
CVE-2023-35636 (severity: MEDIUM, weakness: CWE-200)
Microsoft Outlook Information Disclosure Vulnerability
CVE-2023-35638 (severity: HIGH, weakness: CWE-126)
DHCP Server Service Denial of Service Vulnerability
CVE-2023-35639 (severity: HIGH, weakness: CWE-122)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2023-3564 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in GZ Scripts GZ Multi Hotel Booking System 1.8. It has been classified as problematic. Affected is an unknown function of the file /index.php. The manipulation of the argument adults/children/cal_id leads to cross site scripting. It is possible to launch the attack remotely. VDB-233358 is the identifier assigned to this vulnerability.
CVE-2023-35641 (severity: HIGH, weakness: CWE-682)
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
CVE-2023-35642 (severity: MEDIUM, weakness: CWE-682)
Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVE-2023-35643 (severity: HIGH, weakness: CWE-126)
DHCP Server Service Information Disclosure Vulnerability
CVE-2023-35644 (severity: HIGH, weakness: CWE-190)
Windows Sysmain Service Elevation of Privilege Vulnerability
CVE-2023-35645 (severity: MEDIUM, weakness: CWE-362)
In tbd of tbd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35646 (severity: CRITICAL, weakness: CWE-787)
In TBD of TBD, there is a possible stack buffer overflow due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35647 (severity: CRITICAL, weakness: CWE-125)
In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
CVE-2023-35648 (severity: CRITICAL, weakness: CWE-125)
In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
CVE-2023-35649 (severity: HIGH, weakness: CWE-787)
In several functions of Exynos modem files, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-3565 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVE-2023-35652 (severity: HIGH, weakness: CWE-125)
In ProtocolEmergencyCallListIndAdapter::Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
CVE-2023-35653 (severity: MEDIUM, weakness: CWE-863)
In TBD of TBD, there is a possible way to access location information due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35654 (severity: MEDIUM, weakness: CWE-125)
In ctrl_roi of stmvl53l1_module.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35655 (severity: MEDIUM, weakness: CWE-125)
In CanConvertPadV2Op of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35656 (severity: HIGH, weakness: CWE-125)
In multiple functions of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35658 (severity: HIGH, weakness: CWE-416)
In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35659 (severity: HIGH, weakness: NVD-CWE-Other)
In DevmemIntChangeSparse of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-3566 (severity: MEDIUM, weakness: CWE-770)
A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of resources. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233359. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-35660 (severity: MEDIUM, weakness: CWE-416)
In lwis_transaction_client_cleanup of lwis_transaction.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35661 (severity: HIGH, weakness: CWE-125)
In ProfSixDecomTcpSACKoption of RohcPacketCommon.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35662 (severity: CRITICAL, weakness: CWE-787)
there is a possible out of bounds write due to buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35663 (severity: HIGH, weakness: CWE-125)
In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35664 (severity: MEDIUM, weakness: CWE-125)
In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35665 (severity: HIGH, weakness: CWE-862)
In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35666 (severity: HIGH, weakness: CWE-416)
In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35667 (severity: HIGH, weakness: CWE-269)
In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35668 (severity: MEDIUM, weakness: NVD-CWE-Other)
In visitUris of Notification.java, there is a possible way to display images from another user due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35669 (severity: HIGH, weakness: CWE-502)
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activities due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-3567 (severity: HIGH, weakness: CWE-416)
A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.
CVE-2023-35670 (severity: HIGH, weakness: CWE-22)
In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private directories due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35671 (severity: MEDIUM, weakness: CWE-269)
In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked screen mode due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35673 (severity: HIGH, weakness: CWE-190)
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35674 (severity: HIGH, weakness: CWE-269)
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-35675 (severity: MEDIUM, weakness: NVD-CWE-Other)
In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files played by another user on the same device due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.