stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-36624 (severity: HIGH, weakness: CWE-862)
Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration. This allows the elevated execution of binaries without a password requirement.
CVE-2023-36627 (severity: LOW, weakness: NVD-CWE-Other)
A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot schedules can configure a timezone to prevent the schedule from functioning properly.
CVE-2023-36628 (severity: HIGH, weakness: CWE-269)
A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.
CVE-2023-36629 (severity: MEDIUM, weakness: CWE-125)
The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read.
CVE-2023-3663 (severity: HIGH, weakness: CWE-940)
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
CVE-2023-36630 (severity: HIGH, weakness: CWE-434)
In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.
CVE-2023-36631 (severity: HIGH, weakness: NVD-CWE-Other)
Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Windows Firewall restrictions via the user interface's rules tab. NOTE: the vendor's perspective is "this is intended behavior as the application can be locked using a password."
CVE-2023-36632 (severity: HIGH, weakness: CWE-674)
The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.
CVE-2023-36633 (severity: MEDIUM, weakness: CWE-285)
An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests.
CVE-2023-36634 (severity: HIGH, weakness: CWE-73)
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to list and delete arbitrary files and directory via specially crafted command arguments.
CVE-2023-36635 (severity: MEDIUM, weakness: CWE-284)
An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2 7.0.0 through 7.0.1 may allow a remote authenticated read-only user to modify the interface settings via the API.
CVE-2023-36637 (severity: MEDIUM, weakness: CWE-79)
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to inject HTML tags in FortiMail's calendar via input fields.
CVE-2023-36638 (severity: MEDIUM, weakness: CWE-284)
An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions API may allow a remote and authenticated API admin user to access some system settings such as the mail server settings through the API via a stolen GUI session ID.
CVE-2023-36639 (severity: HIGH, weakness: CWE-134)
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests.
CVE-2023-3664 (severity: HIGH, weakness: NVD-CWE-Other)
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.
CVE-2023-36640 (severity: MEDIUM, weakness: CWE-134)
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM versions 1.0.0 through 1.0.3, FortiOS versions 7.2.0, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.16 allows attacker to execute unauthorized code or commands via specially crafted commands
CVE-2023-36641 (severity: MEDIUM, weakness: CWE-197)
A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1, all versions, FortiProxy 1.0 all versions, FortiOS version 7.4.0, FortiOS version 7.2.0 through 7.2.5, FortiOS version 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions allows attacker to denial of service via specifically crafted HTTP requests.
CVE-2023-36642 (severity: HIGH, weakness: CWE-77)
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
CVE-2023-36643 (severity: MEDIUM, weakness: CWE-284)
Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer function.
CVE-2023-36644 (severity: MEDIUM, weakness: CWE-284)
Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin.
CVE-2023-36645 (severity: CRITICAL, weakness: CWE-94)
SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function.
CVE-2023-36646 (severity: HIGH, weakness: CWE-863)
Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to execute privileged functions and achieve privilege escalation via REST API endpoint invocation.
CVE-2023-36647 (severity: HIGH, weakness: CWE-798)
A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens.
CVE-2023-36648 (severity: HIGH, weakness: CWE-287)
Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive information and deny service to users by directly reading and writing data in Apache Kafka (as consumer and producer).
CVE-2023-36649 (severity: CRITICAL, weakness: CWE-532)
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate other users in web management and the REST API by reading JWT tokens from logs (as a Granafa authenticated user) or from the Loki REST API without authentication.
CVE-2023-3665 (severity: HIGH, weakness: CWE-74)
A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code.
CVE-2023-36650 (severity: HIGH, weakness: CWE-354)
A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host system via forged update packages.
CVE-2023-36651 (severity: HIGH, weakness: CWE-798)
Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privileged REST API endpoints via these credentials.
CVE-2023-36652 (severity: MEDIUM, weakness: CWE-89)
A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to read database data via SQL commands injected in the search parameter.
CVE-2023-36654 (severity: MEDIUM, weakness: CWE-22)
Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download host server SSH private keys (associated with a Linux root user) by injecting paths inside REST API endpoint parameters.
CVE-2023-36655 (severity: CRITICAL, weakness: CWE-287)
The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user to login and obtain an authentication token by specifying a username with different uppercase/lowercase character combination.
CVE-2023-36656 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via the KeyValuesTable component.
CVE-2023-36657 (severity: CRITICAL, weakness: CWE-269)
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.
CVE-2023-36658 (severity: HIGH, weakness: CWE-428)
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally.
CVE-2023-36659 (severity: CRITICAL, weakness: CWE-120)
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication).
CVE-2023-36660 (severity: CRITICAL, weakness: CWE-787)
The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.
CVE-2023-36661 (severity: HIGH, weakness: CWE-918)
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
CVE-2023-36662 (severity: MEDIUM, weakness: CWE-79)
The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24.
CVE-2023-36663 (severity: HIGH, weakness: CWE-89)
it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the sort parameter of the API interface.
CVE-2023-36664 (severity: HIGH, weakness: CWE-552)
Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
CVE-2023-36665 (severity: CRITICAL, weakness: CWE-1321)
"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.
CVE-2023-36666 (severity: MEDIUM, weakness: CWE-79)
INEX IXP-Manager before 6.3.1 allows XSS. list-preamble.foil.php, page-header-preamble.foil.php, edit-form.foil.php, page-header-preamble.foil.php, overview.foil.php, cust.foil.php, and view.foil.php may be affected.
CVE-2023-36667 (severity: HIGH, weakness: CWE-22)
Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.
CVE-2023-36669 (severity: CRITICAL, weakness: CWE-306)
Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitrary control of the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) within the IDU by sending crafted TCP requests to the IDU.
CVE-2023-3667 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Bit Assist WordPress plugin before 1.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-36670 (severity: CRITICAL, weakness: CWE-78)
A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sending crafted TCP requests to the device.
CVE-2023-36671 (severity: MEDIUM, weakness: CWE-319)
An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel even if this traffic is not generated by the VPN client. This allows an adversary to trick the victim into sending plaintext traffic to the VPN server's IP address and thereby deanonymize the victim. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "ServerIP attack for only traffic to the real IP address of the VPN server" rather than to only Clario.
CVE-2023-36672 (severity: MEDIUM, weakness: CWE-319)
An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that traffic to the local network is sent in plaintext outside the VPN tunnel even if the local network is using a non-RFC1918 IP subnet. This allows an adversary to trick the victim into sending arbitrary IP traffic in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in leakage of traffic in plaintext" rather than to only Clario.
CVE-2023-36673 (severity: HIGH, weakness: CWE-319)
An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel, even if this traffic is not generated by the VPN client, while simultaneously using plaintext DNS to look up the VPN server's IP address. This allows an adversary to trick the victim into sending traffic to arbitrary IP addresses in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "ServerIP attack, combined with DNS spoofing, that can leak traffic to an arbitrary IP address" rather than to only Avira Phantom VPN.
CVE-2023-36674 (severity: MEDIUM, weakness: CWE-20)
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
CVE-2023-36675 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
CVE-2023-36676 (severity: HIGH, weakness: CWE-862)
Missing Authorization vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6.
CVE-2023-36677 (severity: HIGH, weakness: CWE-89)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Injection.This issue affects SP Project & Document Manager: from n/a through 4.67.
CVE-2023-36678 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions.
CVE-2023-36679 (severity: MEDIUM, weakness: CWE-918)
Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6.
CVE-2023-3668 (severity: CRITICAL, weakness: CWE-116)
Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.
CVE-2023-36680 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Iulia Cazan Image Regenerate & Select Crop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Regenerate & Select Crop: from n/a through 7.1.0.
CVE-2023-36681 (severity: CRITICAL, weakness: CWE-862)
Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets – Price Ticker & Coins List: from n/a through 2.6.2.
CVE-2023-36682 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC Schema Pro allows Cross Site Request Forgery.This issue affects Schema Pro: from n/a through 2.7.7.
CVE-2023-36683 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in WP SCHEMA PRO Schema Pro.This issue affects Schema Pro: from n/a through 2.7.8.
CVE-2023-36684 (severity: CRITICAL, weakness: CWE-862)
Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5.
CVE-2023-36685 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC CartFlows Pro allows Cross Site Request Forgery.This issue affects CartFlows Pro: from n/a through 1.11.12.
CVE-2023-36686 (severity: MEDIUM, weakness: CWE-79)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CartFlows Pro plugin <= 1.11.11 versions.
CVE-2023-36687 (severity: MEDIUM, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in Andrea Tarantini Menubar plugin <= 5.8.2 versions.
CVE-2023-36688 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Mann Simple Site Verify plugin <= 1.0.7 versions.
CVE-2023-36689 (severity: MEDIUM, weakness: CWE-79)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory WPFactory Helper plugin <= 1.5.2 versions.
CVE-2023-3669 (severity: LOW, weakness: CWE-307)
A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
CVE-2023-36690 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions.
CVE-2023-36691 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in Albert Peschar WebwinkelKeur plugin <= 3.24 versions.
CVE-2023-36692 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Kramer & Hendrik Thole WP-Cirrus plugin <= 0.6.11 versions.
CVE-2023-36693 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez WP RSS Images plugin <= 1.1 versions.
CVE-2023-36694 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Bryan Lee Kingkong Board.This issue affects Kingkong Board: from n/a through 2.1.0.2.
CVE-2023-36695 (severity: HIGH, weakness: CWE-862)
Missing Authorization vulnerability in Maxime Schoeni Sublanguage.This issue affects Sublanguage: from n/a through 2.9.
CVE-2023-36696 (severity: HIGH, weakness: CWE-125)
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2023-36697 (severity: HIGH, weakness: CWE-20)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2023-36698 (severity: MEDIUM, weakness: CWE-362)
Windows Kernel Security Feature Bypass Vulnerability
CVE-2023-3670 (severity: HIGH, weakness: CWE-668)
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
CVE-2023-36701 (severity: HIGH, weakness: CWE-125)
Microsoft Resilient File System (ReFS) Elevation of Privilege Vulnerability
CVE-2023-36702 (severity: HIGH, weakness: CWE-94)
Microsoft DirectMusic Remote Code Execution Vulnerability
CVE-2023-36703 (severity: HIGH, weakness: CWE-400)
DHCP Server Service Denial of Service Vulnerability
CVE-2023-36704 (severity: HIGH, weakness: CWE-908)
Windows Setup Files Cleanup Remote Code Execution Vulnerability
CVE-2023-36705 (severity: HIGH, weakness: CWE-59)
Windows Installer Elevation of Privilege Vulnerability
CVE-2023-36706 (severity: MEDIUM, weakness: CWE-20)
Windows Deployment Services Information Disclosure Vulnerability
CVE-2023-36707 (severity: HIGH, weakness: CWE-20)
Windows Deployment Services Denial of Service Vulnerability
CVE-2023-36709 (severity: HIGH, weakness: CWE-476)
Microsoft AllJoyn API Denial of Service Vulnerability
CVE-2023-3671 (severity: MEDIUM, weakness: NVD-CWE-Other)
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2023-36710 (severity: HIGH, weakness: CWE-197)
Windows Media Foundation Core Remote Code Execution Vulnerability
CVE-2023-36711 (severity: HIGH, weakness: CWE-59)
Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
CVE-2023-36712 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-36713 (severity: MEDIUM, weakness: CWE-908)
Windows Common Log File System Driver Information Disclosure Vulnerability
CVE-2023-36717 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
CVE-2023-36718 (severity: HIGH, weakness: CWE-94)
Microsoft Virtual Trusted Platform Module Remote Code Execution Vulnerability
CVE-2023-36719 (severity: HIGH, weakness: CWE-20)
Microsoft Speech Application Programming Interface (SAPI) Elevation of Privilege Vulnerability
CVE-2023-3672 (severity: HIGH, weakness: CWE-79)
Cross-site Scripting (XSS) - DOM in GitHub repository plaidweb/webmention.js prior to 0.5.5.
CVE-2023-36720 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Mixed Reality Developer Tools Denial of Service Vulnerability
CVE-2023-36721 (severity: HIGH, weakness: CWE-269)
Windows Error Reporting Service Elevation of Privilege Vulnerability
CVE-2023-36722 (severity: MEDIUM, weakness: CWE-284)
Active Directory Domain Services Information Disclosure Vulnerability
CVE-2023-36723 (severity: HIGH, weakness: CWE-59)
Windows Container Manager Service Elevation of Privilege Vulnerability
CVE-2023-36724 (severity: MEDIUM, weakness: CWE-287)
Windows Power Management Service Information Disclosure Vulnerability