stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-2170 (severity: MEDIUM, weakness: NVD-CWE-Other)
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2023-21700 (severity: HIGH, weakness: CWE-476)
Windows iSCSI Discovery Service Denial of Service Vulnerability
CVE-2023-21701 (severity: HIGH, weakness: CWE-126)
Microsoft Protected Extensible Authentication Protocol (PEAP) Denial of Service Vulnerability
CVE-2023-21702 (severity: HIGH, weakness: CWE-125)
Windows iSCSI Service Denial of Service Vulnerability
CVE-2023-21703 (severity: HIGH, weakness: CWE-502)
Azure Data Box Gateway Remote Code Execution Vulnerability
CVE-2023-21704 (severity: HIGH, weakness: CWE-190)
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2023-21705 (severity: HIGH, weakness: CWE-321)
Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2023-21706 (severity: HIGH, weakness: CWE-502)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-21707 (severity: HIGH, weakness: CWE-502)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-21708 (severity: CRITICAL, weakness: CWE-191)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2023-21709 (severity: CRITICAL, weakness: CWE-307)
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2023-2171 (severity: MEDIUM, weakness: NVD-CWE-Other)
The BadgeOS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.7.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2023-21710 (severity: HIGH, weakness: CWE-502)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-21712 (severity: HIGH, weakness: CWE-362)
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVE-2023-21713 (severity: HIGH, weakness: CWE-502)
Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2023-21714 (severity: MEDIUM, weakness: CWE-125)
Microsoft Office Information Disclosure Vulnerability
CVE-2023-21715 (severity: HIGH, weakness: CWE-863)
Microsoft Publisher Security Feature Bypass Vulnerability
CVE-2023-21716 (severity: CRITICAL, weakness: CWE-190)
Microsoft Word Remote Code Execution Vulnerability
CVE-2023-21717 (severity: HIGH, weakness: CWE-284)
Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVE-2023-21718 (severity: HIGH, weakness: CWE-191)
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2023-21719 (severity: MEDIUM, weakness: CWE-863)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2023-2172 (severity: MEDIUM, weakness: NVD-CWE-Other)
The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeos_update_steps_ajax_handler, badgeos_update_award_steps_ajax_handler, badgeos_update_deduct_steps_ajax_handler, and badgeos_update_ranks_req_steps_ajax_handler functions. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to overwrite arbitrary post titles.
CVE-2023-21720 (severity: MEDIUM, weakness: CWE-126)
Microsoft Edge (Chromium-based) Tampering Vulnerability
CVE-2023-21721 (severity: MEDIUM, weakness: CWE-287)
Microsoft OneNote Elevation of Privilege Vulnerability
CVE-2023-21722 (severity: MEDIUM, weakness: CWE-59)
.NET Framework Denial of Service Vulnerability
CVE-2023-21724 (severity: HIGH, weakness: CWE-416)
Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVE-2023-21725 (severity: MEDIUM, weakness: CWE-59)
Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability
CVE-2023-21726 (severity: HIGH, weakness: CWE-257)
Windows Credential Manager User Interface Elevation of Privilege Vulnerability
CVE-2023-21727 (severity: HIGH, weakness: CWE-122)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2023-21728 (severity: HIGH, weakness: CWE-400)
Windows Netlogon Denial of Service Vulnerability
CVE-2023-21729 (severity: MEDIUM, weakness: CWE-125)
Remote Procedure Call Runtime Information Disclosure Vulnerability
CVE-2023-2173 (severity: MEDIUM, weakness: NVD-CWE-Other)
The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeos_delete_step_ajax_handler, badgeos_delete_award_step_ajax_handler, badgeos_delete_deduct_step_ajax_handler, and badgeos_delete_rank_req_step_ajax_handler functions. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts.
CVE-2023-21730 (severity: HIGH, weakness: CWE-190)
Microsoft Cryptographic Services Elevation of Privilege Vulnerability
CVE-2023-21732 (severity: HIGH, weakness: CWE-121)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2023-21733 (severity: HIGH, weakness: CWE-122)
Windows Bind Filter Driver Elevation of Privilege Vulnerability
CVE-2023-21734 (severity: HIGH, weakness: CWE-416)
Microsoft Office Remote Code Execution Vulnerability
CVE-2023-21735 (severity: HIGH, weakness: CWE-416)
Microsoft Office Remote Code Execution Vulnerability
CVE-2023-21736 (severity: HIGH, weakness: CWE-681)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2023-21737 (severity: HIGH, weakness: CWE-122)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2023-21738 (severity: HIGH, weakness: CWE-122)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2023-21739 (severity: HIGH, weakness: CWE-591)
Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVE-2023-2174 (severity: MEDIUM, weakness: CWE-862)
The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_log_entries function in versions up to, and including, 3.7.1.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the plugin's log entries.
CVE-2023-21740 (severity: HIGH, weakness: CWE-122)
Windows Media Remote Code Execution Vulnerability
CVE-2023-21741 (severity: HIGH, weakness: CWE-125)
Microsoft Office Visio Information Disclosure Vulnerability
CVE-2023-21742 (severity: HIGH, weakness: CWE-284)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2023-21743 (severity: MEDIUM, weakness: CWE-306)
Microsoft SharePoint Server Security Feature Bypass Vulnerability
CVE-2023-21744 (severity: HIGH, weakness: CWE-502)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2023-21745 (severity: HIGH, weakness: CWE-502)
Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-21746 (severity: HIGH, weakness: NVD-CWE-Other)
Windows NTLM Elevation of Privilege Vulnerability
CVE-2023-21747 (severity: HIGH, weakness: CWE-416)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-21748 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-21749 (severity: HIGH, weakness: CWE-20)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-21750 (severity: HIGH, weakness: CWE-284)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-21751 (severity: MEDIUM, weakness: CWE-284)
Azure DevOps Server Spoofing Vulnerability
CVE-2023-21752 (severity: HIGH, weakness: CWE-284)
Windows Backup Service Elevation of Privilege Vulnerability
CVE-2023-21753 (severity: MEDIUM, weakness: CWE-908)
Event Tracing for Windows Information Disclosure Vulnerability
CVE-2023-21754 (severity: HIGH, weakness: CWE-190)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-21755 (severity: HIGH, weakness: CWE-416)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-21756 (severity: HIGH, weakness: CWE-416)
Windows Win32k Elevation of Privilege Vulnerability
CVE-2023-21757 (severity: HIGH, weakness: CWE-476)
Windows Layer 2 Tunneling Protocol (L2TP) Denial of Service Vulnerability
CVE-2023-21758 (severity: HIGH, weakness: CWE-476)
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
CVE-2023-21759 (severity: LOW, weakness: NVD-CWE-Other)
Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
CVE-2023-2176 (severity: HIGH, weakness: CWE-125)
A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege.
CVE-2023-21760 (severity: HIGH, weakness: CWE-59)
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2023-21761 (severity: HIGH, weakness: CWE-918)
Microsoft Exchange Server Information Disclosure Vulnerability
CVE-2023-21762 (severity: HIGH, weakness: CWE-502)
Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-21763 (severity: HIGH, weakness: CWE-426)
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2023-21764 (severity: HIGH, weakness: CWE-426)
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2023-21765 (severity: HIGH, weakness: CWE-190)
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2023-21766 (severity: MEDIUM, weakness: CWE-591)
Windows Overlay Filter Information Disclosure Vulnerability
CVE-2023-21767 (severity: HIGH, weakness: CWE-20)
Windows Overlay Filter Elevation of Privilege Vulnerability
CVE-2023-21768 (severity: HIGH, weakness: CWE-822)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2023-21769 (severity: HIGH, weakness: CWE-125)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2023-2177 (severity: MEDIUM, weakness: CWE-476)
A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service.
CVE-2023-21771 (severity: HIGH, weakness: CWE-591)
Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability
CVE-2023-21772 (severity: HIGH, weakness: CWE-125)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-21773 (severity: HIGH, weakness: CWE-416)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-21774 (severity: HIGH, weakness: CWE-416)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-21775 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2023-21776 (severity: MEDIUM, weakness: CWE-125)
Windows Kernel Information Disclosure Vulnerability
CVE-2023-21777 (severity: HIGH, weakness: CWE-284)
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
CVE-2023-21778 (severity: HIGH, weakness: CWE-77)
Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability
CVE-2023-21779 (severity: HIGH, weakness: CWE-502)
Visual Studio Code Remote Code Execution Vulnerability
CVE-2023-2178 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2023-21780 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21781 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21782 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21783 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21784 (severity: HIGH, weakness: CWE-416)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21785 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21786 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21787 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21788 (severity: HIGH, weakness: NVD-CWE-Other)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21789 (severity: HIGH, weakness: CWE-369)
3D Builder Remote Code Execution Vulnerability
CVE-2023-2179 (severity: MEDIUM, weakness: NVD-CWE-Other)
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
CVE-2023-21790 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21791 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21792 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21793 (severity: HIGH, weakness: CWE-122)
3D Builder Remote Code Execution Vulnerability
CVE-2023-21794 (severity: MEDIUM, weakness: CWE-290)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2023-21795 (severity: HIGH, weakness: CWE-416)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-21796 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-21797 (severity: HIGH, weakness: CWE-190)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2023-21798 (severity: HIGH, weakness: CWE-125)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2023-21799 (severity: HIGH, weakness: CWE-122)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2023-2180 (severity: HIGH, weakness: NVD-CWE-Other)
The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization (assuming they can upload a file on the server)
CVE-2023-21800 (severity: HIGH, weakness: CWE-73)
Windows Installer Elevation of Privilege Vulnerability
CVE-2023-21801 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVE-2023-21802 (severity: HIGH, weakness: CWE-190)
Windows Media Remote Code Execution Vulnerability
CVE-2023-21803 (severity: CRITICAL, weakness: CWE-190)
Windows iSCSI Discovery Service Remote Code Execution Vulnerability
CVE-2023-21804 (severity: HIGH, weakness: CWE-122)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2023-21805 (severity: HIGH, weakness: CWE-77)
Windows MSHTML Platform Remote Code Execution Vulnerability
CVE-2023-21806 (severity: HIGH, weakness: CWE-79)
Power BI Report Server Spoofing Vulnerability
CVE-2023-21807 (severity: MEDIUM, weakness: CWE-79)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-21808 (severity: HIGH, weakness: CWE-416)
.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2023-21809 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
CVE-2023-2181 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI.
CVE-2023-21811 (severity: HIGH, weakness: CWE-126)
Windows iSCSI Service Denial of Service Vulnerability
CVE-2023-21812 (severity: HIGH, weakness: CWE-122)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2023-21813 (severity: HIGH, weakness: CWE-126)
Windows Secure Channel Denial of Service Vulnerability
CVE-2023-21815 (severity: HIGH, weakness: CWE-191)
Visual Studio Remote Code Execution Vulnerability
CVE-2023-21816 (severity: HIGH, weakness: CWE-20)
Windows Active Directory Domain Services API Denial of Service Vulnerability
CVE-2023-21817 (severity: HIGH, weakness: CWE-287)
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2023-21818 (severity: HIGH, weakness: CWE-20)
Windows Secure Channel Denial of Service Vulnerability
CVE-2023-21819 (severity: HIGH, weakness: CWE-125)
Windows Secure Channel Denial of Service Vulnerability
CVE-2023-2182 (severity: HIGH, weakness: NVD-CWE-Other)
An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users.
CVE-2023-21820 (severity: HIGH, weakness: CWE-126)
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
CVE-2023-21822 (severity: HIGH, weakness: CWE-416)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2023-21823 (severity: HIGH, weakness: CWE-190)
Windows Graphics Component Remote Code Execution Vulnerability
CVE-2023-21824 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Customer, Config, Pricing Manager). Supported versions that are affected are 12.0.0.3.0-12.0.0.7.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
CVE-2023-21825 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Supplier Management). Supported versions that are affected are 12.2.6-12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2023-21826 (severity: HIGH, weakness: NVD-CWE-Other)
Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hospitality Reporting and Analytics. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H).
CVE-2023-21827 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database Data Redaction. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Database Data Redaction accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVE-2023-21828 (severity: HIGH, weakness: CWE-284)
Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2023-21829 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Database RDBMS Security accessible data as well as unauthorized read access to a subset of Oracle Database RDBMS Security accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N).
CVE-2023-2183 (severity: MEDIUM, weakness: CWE-284)
Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.