yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-32434: An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
Key phrases: execute arbitrary code, integer overflow
CVE-2023-32435: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
Key phrases: memory corruption issue, arbitrary code execution
CVE-2023-32436: The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system termination or write kernel memory.
Key phrases: unexpected system termination, write kernel memory
CVE-2023-32437: The issue was addressed with improvements to the file handling protocol. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to break out of its sandbox.
Key phrases: break out of its sandbox
CVE-2023-32438: This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in tvOS 16.3, macOS Ventura 13.2, watchOS 9.3, iOS 16.3 and iPadOS 16.3. An app may be able to bypass Privacy preferences.
Key phrases: bypass Privacy preferences, privacy preferences
CVE-2023-32439: A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Key phrases: type confusion issue, arbitrary code execution
CVE-2023-3244: The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to reset the plugin's settings. NOTE: After attempting to contact the developer with no response, and reporting this to the WordPress plugin's team 30 days ago we are disclosing this issue as it still is not updated.
Key phrases: unauthorized modification of data, missing capability check
CVE-2023-32441: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2023-32442: An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.5, macOS Monterey 12.6.8. A shortcut may be able to modify sensitive Shortcuts app settings.
Key phrases: access issue
CVE-2023-32443: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. Processing a file may lead to a denial-of-service or potentially disclose memory contents.
Key phrases: out-of-bounds read, denial-of-service, out of bounds read, denial of service
CVE-2023-32444: A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. A sandboxed process may be able to circumvent sandbox restrictions.
Key phrases: circumvent sandbox restrictions
CVE-2023-32445: This issue was addressed with improved checks. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. Processing a document may lead to a cross site scripting attack.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-32446: Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the log files.
Key phrases: sensitive information disclosure
CVE-2023-32447: Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability. A malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the log files.
Key phrases: sensitive information disclosure
CVE-2023-32448: PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext vulnerability. A local user with access to the installation directory can retrieve the license key of the product and use it to install and license PowerPath on different systems.
Key phrases: license key stored in cleartext
CVE-2023-32449: Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability. An attacker can trick a high privileged user to install a malicious binary by bypassing the existing cryptographic signature checks
Key phrases: cryptographic signature
CVE-2023-3245: The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2023-32450: Dell Power Manager, Versions 3.3 to 3.14 contains an Improper Access Control vulnerability. A low-privileged malicious user may potentially exploit this vulnerability to perform arbitrary code execution with limited access.
Key phrases: perform arbitrary code execution, improper access control
CVE-2023-32451: Dell Display Manager application, version 2.1.1.17, contains a vulnerability that low privilege user can execute malicious code during installation and uninstallation
CVE-2023-32453: Dell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may potentially exploit this vulnerability in order to modify a security-critical UEFI variable without knowledge of the BIOS administrator.
Key phrases: authentication, improper authentication
CVE-2023-32454: DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A local malicious standard user could exploit the vulnerability to create arbitrary files, leading to denial of service
Key phrases: create arbitrary files, windows junction mount point, denial of service
CVE-2023-32455: Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the log files.
Key phrases: sensitive information disclosure
CVE-2023-32457: Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. A remote attacker with low privileges could potentially exploit this vulnerability, leading to escalation of privileges.
Key phrases: privilege management, escalation of privileges, improper privilege management, escalation privilege
CVE-2023-32458: Dell AppSync, versions 4.4.0.0 to 4.6.0.0 including Service Pack releases, contains an improper access control vulnerability in Embedded Service Enabler component. A local malicious user could potentially exploit this vulnerability during installation leading to a privilege escalation.
Key phrases: access control, privilege escalation, improper access control
CVE-2023-3246: An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor.
Key phrases: block Sidekiq job processor
CVE-2023-32460: Dell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
Key phrases: privilege management security, privilege escalation, improper privilege management
CVE-2023-32461: Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability.  A local malicious user with high privileges could potentially exploit this vulnerability, leading to corrupt memory and potentially escalate privileges. 
Key phrases: buffer overflow, corrupt memory, escalate privileges
CVE-2023-32462: Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authentication. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands and possible system takeover. This is a critical vulnerability as it allows an attacker to cause severe damage. Dell recommends customers to upgrade at the earliest opportunity.
Key phrases: cause severe damage, os command injection, arbitrary os command
CVE-2023-32463: Dell VxRail, version(s) 8.0.100 and earlier contain a denial-of-service vulnerability in the upgrade functionality. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to degraded performance and system malfunction.
Key phrases: denial-of-service, degraded performance, system malfunction, denial of service
CVE-2023-32464: Dell VxRail, versions prior to 7.0.450, contain an improper certificate validation vulnerability. A high privileged remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and intercepting the victim's traffic to view or modify a victims data in transit.
Key phrases: improper certificate validation, man-in-the-middle, victims traffic, man in the middle
CVE-2023-32465: Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. An attacker could potentially exploit this vulnerability, leading to unauthorized admin access to the Cyber Recovery application. Exploitation may lead to complete system takeover by an attacker.
Key phrases: Authentication Bypass, authentication bypass, system takeover
CVE-2023-32468: Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability. A remote malicious high-privileged user could potentially exploit this vulnerability leading to exposure of this sensitive data.
Key phrases: insertion of sensitive information in log files, sensitive information log file
CVE-2023-32469: Dell Precision Tower BIOS contains an Improper Input Validation vulnerability. A locally authenticated malicious user with admin privileges could potentially exploit this vulnerability to perform arbitrary code execution.
Key phrases: perform arbitrary code execution, improper input validation
CVE-2023-3247: In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.
Key phrases: disclosure, uninitialized memory
CVE-2023-32470: Dell Digital Delivery versions prior to 5.0.82.0 contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious user could potentially exploit this vulnerability to create arbitrary folder leading to permanent Denial of Service (DOS).
Key phrases: create arbitrary folder, Denial of Service (DOS), insecure operation on windows junction mount point, denial of service (dos)
CVE-2023-32474: Dell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on windows junction/mount point. A local malicious user could potentially exploit this vulnerability during installation leading to arbitrary folder or file deletion
Key phrases: insecure operation, windows junction mount point, file deletion
CVE-2023-32476: Dell Hybrid Client version 2.0 contains a Sensitive Data Exposure vulnerability. An unauthenticated malicious user on the device can access hard coded secrets in javascript files.
Key phrases: sensitive data exposure
CVE-2023-32477: Dell Common Event Enabler 8.9.8.2 for Windows and prior, contain an improper access control vulnerability. A local low-privileged malicious user may potentially exploit this vulnerability to gain elevated privileges.
Key phrases: gain elevated privileges, access control, improper access control
CVE-2023-32478: Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability. A high privileged malicious user could potentially exploit this vulnerability, leading to sensitive information disclosure.
Key phrases: insertion of sensitive information into log file, sensitive information disclosure, sensitive information log file
CVE-2023-32479: Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by replacing binaries in installed directory and taking reverse shell of the system leading to Privilege Escalation.
Key phrases: privilege escalation
CVE-2023-3248: The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2023-32480: Dell BIOS contains an Improper Input Validation vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability to perform arbitrary code execution.
Key phrases: perform arbitrary code execution, improper input validation
CVE-2023-32481: Wyse Management Suite versions prior to 4.0 contain a denial-of-service vulnerability. An authenticated malicious user can flood the configured SMTP server with numerous requests in order to deny access to the system.
Key phrases: denial-of-service, deny access, denial of service
CVE-2023-32482: Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An authenticated malicious user with privileged access can push policies to unauthorized tenant group.
Key phrases: improper authorization
CVE-2023-32483: Wyse Management Suite versions prior to 4.0 contain a sensitive information disclosure vulnerability. An authenticated malicious user having local access to the system running the application could exploit this vulnerability to read sensitive information written to log files.
Key phrases: sensitive information disclosure
CVE-2023-32484: Dell Networking Switches running Enterprise SONiC versions 4.1.0, 4.0.5, 3.5.4 and below contains an improper input validation vulnerability. A remote unauthenticated malicious user may exploit this vulnerability and escalate privileges up to the highest administrative level. This is a Critical vulnerability affecting certain protocols, Dell recommends customers to upgrade at the earliest opportunity.
Key phrases: input validation, improper input validation, escalate privilege
CVE-2023-32485: Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability and escalate privileges up to the highest administration level. This is a critical severity vulnerability affecting user authentication. Dell recommends customers to upgrade at the earliest opportunity.
Key phrases: improper input validation, critical severity, escalate privilege
CVE-2023-32486: Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. A low privilege local attacker could potentially exploit this vulnerability, leading to escalation of privileges.
Key phrases: privilege escalation, escalation of privileges, escalation privilege
CVE-2023-32487: Dell PowerScale OneFS, 8.2.x - 9.5.0.x, contains an elevation of privilege vulnerability. A low privileged local attacker could potentially exploit this vulnerability, leading to denial of service, code execution and information disclosure. 
Key phrases: elevation of privilege, denial of service, code execution, information disclosure, elevation privilege
CVE-2023-32488: Dell PowerScale OneFS, 8.2.x-9.5.0.x, contains an information disclosure vulnerability in NFS. A low privileged attacker could potentially exploit this vulnerability, leading to information disclosure.
Key phrases: information disclosure
CVE-2023-32489: Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker with high privileges could potentially exploit this vulnerability, to bypass mode protections and gain elevated privileges. 
Key phrases: bypass mode protections, gain elevated privileges, privilege escalation
CVE-2023-3249: The Web3  Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Key phrases: bypass in versions up to, authentication bypass
CVE-2023-32490: Dell PowerScale OneFS 8.2x -9.5x contains an improper privilege management vulnerability. A high privilege local attacker could potentially exploit this vulnerability, leading to system takeover. 
Key phrases: privilege management, system takeover, improper privilege management
CVE-2023-32491: Dell PowerScale OneFS 9.5.0.x, contains an insertion of sensitive information into log file vulnerability in SNMPv3. A low privileges user could potentially exploit this vulnerability, leading to information disclosure.
Key phrases: insertion of sensitive information into log file, information disclosure, sensitive information log file
CVE-2023-32492: Dell PowerScale OneFS 9.5.0.x contains an incorrect default permissions vulnerability. A low-privileged local attacker could potentially exploit this vulnerability, leading to information disclosure or allowing to modify files.
Key phrases: modify files, incorrect default permissions, information disclosure
CVE-2023-32493: Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. An unprivileged, remote attacker could potentially exploit this vulnerability, leading to denial of service, information disclosure and remote execution.
Key phrases: protection mechanism bypass, denial of service, information disclosure, remote execution
CVE-2023-32494: Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient privileges vulnerability. A local  privileged attacker could potentially exploit this vulnerability, leading to elevation of privilege and affect in compliance mode also.
Key phrases: improper handling of insufficient privileges, elevation of privilege, affect in compliance mode, elevation privilege
CVE-2023-32495: Dell PowerScale OneFS, 8.2.x-9.5.x, contains a exposure of sensitive information to an unauthorized Actor vulnerability. An authorized local attacker could potentially exploit this vulnerability, leading to escalation of privileges.
Key phrases: escalation of privileges, exposure of sensitive information, escalation privilege
CVE-2023-32496: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bill Minozzi Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin <=7.31 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32497: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Supersoju Block Referer Spam plugin <=1.1.9.4 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32498: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Easy Form team Easy Form by AYS plugin <=1.2.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32499: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tony Zeoli, Tony Hayes Radio Station by netmix  Manage and play your Show Schedule in WordPress! plugin <=2.4.0.9 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-32500: Cross-Site Request Forgery (CSRF) vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme <=7.1.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32501: Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <=1.6.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32502: Cross-Site Request Forgery (CSRF) vulnerability in Sybre Waaijer Pro Mime Types  Manage file media types plugin <=1.0.7 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32503: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <=0.4.6 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-32504: Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.This issue affects Wise Chat: from n/a through 3.1.3.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32505: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Arshid Easy Hide Login plugin <=1.0.7 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32508: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolf van Gelder Order Your Posts Manually allows SQL Injection.This issue affects Order Your Posts Manually: from n/a through 2.2.5.
Key phrases: SQL Injection, sql command, sql injection
CVE-2023-32509: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rolf van Gelder Order Your Posts Manually plugin <=2.2.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-3251: A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus application.This issue affects Nessus: before 10.6.0.
Key phrases: pass-back
CVE-2023-32510: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rolf van Gelder Order Your Posts Manually plugin <=2.2.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-32511: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Booking Ultra Pro Booking Ultra Pro Appointments Booking Calendar Plugin plugin <=1.1.8 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-32512: Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images  WebP, AVIF, CDN, Image Optimization plugin <=3.7.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32513: Deserialization of Untrusted Data vulnerability in GiveWP GiveWP  Donation Plugin and Fundraising Platform.This issue affects GiveWP  Donation Plugin and Fundraising Platform: from n/a through 2.25.3.
Key phrases: deserialization of untrusted data
CVE-2023-32514: Cross-Site Request Forgery (CSRF) vulnerability in Himanshu Parashar Google Site Verification plugin using Meta Tag.This issue affects Google Site Verification plugin using Meta Tag: from n/a through 1.2.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32515: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Matt Gibbs Custom Field Suite plugin <=2.6.2.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32516: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GloriaFood Restaurant Menu  Food Ordering System  Table Reservation plugin <=2.3.6 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-32517: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder.This issue affects MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: from n/a through 4.0.9.3.
Key phrases: url redirection, open redirect
CVE-2023-32518: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ono Oogami WP Chinese Conversion plugin <=1.1.16 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-3252: An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite arbitrary files on the remote host with log data, which could lead to a denial of service condition.
Key phrases: overwrite arbitrary files, arbitrary file write, denial of service condition
CVE-2023-32521: A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files.
Key phrases: delete arbitrary files, path traversal
CVE-2023-32522: A path traversal exists in a specific dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an authenticated remote attacker to delete arbitrary files.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: delete arbitrary files, obtain the ability to execute low-privileged, path traversal
CVE-2023-32523: Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities.This is similar to, but not identical to CVE-2023-32524.
Key phrases: bypass authentication, obtain the ability to execute low-privileged, bypass authentication and potentially chain with other vulnerabilities
CVE-2023-32524: Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities.This is similar to, but not identical to CVE-2023-32523.
Key phrases: bypass authentication, obtain the ability to execute low-privileged, bypass authentication and potentially chain with other vulnerabilities
CVE-2023-32525: Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations.  Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.This is similar to, but not identical to CVE-2023-32526.
Key phrases: create arbitrary files, obtain the ability to execute low-privileged, create arbitrary files on affected installations, widget
CVE-2023-32526: Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations.  Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.This is similar to, but not identical to CVE-2023-32525.
Key phrases: create arbitrary files, obtain the ability to execute low-privileged, create arbitrary files on affected installations, widget
CVE-2023-32527: Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.This is similar to, but not identical to CVE-2023-32528.
Key phrases: execute arbitrary code, obtain the ability to execute low-privileged, execute arbitrary code on affected installations, vulnerable .php files
CVE-2023-32528: Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.This is similar to, but not identical to CVE-2023-32527.
Key phrases: execute arbitrary code, obtain the ability to execute low-privileged, execute arbitrary code on affected installations, vulnerable .php files
CVE-2023-32529: Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution.Please note: an attacker must first obtain authentication on the target system in order to exploit these vulnerabilities.This is similar to, but not identical to CVE-2023-32530.
Key phrases: obtain authentication on the target system in order, perform a SQL injection that could lead to, vulnerable modules, sql injection, remote code execution
CVE-2023-3253: An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the application.
Key phrases: authorization, improper authorization
CVE-2023-32530: Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution.Please note: an attacker must first obtain authentication on the target system in order to exploit these vulnerabilities.This is similar to, but not identical to CVE-2023-32529.
Key phrases: obtain authentication on the target system in order, perform a SQL injection that could lead to, vulnerable modules, sql injection, remote code execution
CVE-2023-32531: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.This is similar to, but not identical to CVE-2023-32532 through 32535.
Key phrases: achieve remote code execution on affected servers, cross-site scripting (xss)
CVE-2023-32532: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.This is similar to, but not identical to CVE-2023-32531 through 32535.
Key phrases: achieve remote code execution on affected servers, cross-site scripting (xss)
CVE-2023-32533: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.This is similar to, but not identical to CVE-2023-32531 through 32535.
Key phrases: achieve remote code execution on affected servers, cross-site scripting (xss)
CVE-2023-32534: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.This is similar to, but not identical to CVE-2023-32531 through 32535.
Key phrases: achieve remote code execution on affected servers, cross-site scripting (xss)
CVE-2023-32535: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.This is similar to, but not identical to CVE-2023-32531 through 32534.
Key phrases: achieve remote code execution on affected servers, cross-site scripting (xss)
CVE-2023-32536: Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability.This is similar to, but not identical to CVE-2023-32537.
Key phrases: obtain authentication to Apex Central on the target system, authenticated reflected cross-site scripting (xss)
CVE-2023-32537: Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability.This is similar to, but not identical to CVE-2023-32536.
Key phrases: obtain authentication to Apex Central on the target system, authenticated reflected cross-site scripting (xss)
CVE-2023-32538: Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted SIM2 file may lead to information disclosure and/or arbitrary code execution. This vulnerability is different from CVE-2023-32273 and CVE-2023-32201.
Key phrases: stack-based buffer overflow, information disclosure, arbitrary code execution, stack based buffer overflow
CVE-2023-32539: The affected application lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e3c04. An attacker could leverage this vulnerability to potentially execute arbitrary code in the context of the current process.       
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2023-3254: The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery, remove reviews
CVE-2023-32540: In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution.
Key phrases: overwrite any file in the operating system (, arbitrary file overwrite, arbitrary code execution
CVE-2023-32541: A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520. A specially crafted .doc file can lead to a use-after-free. An attacker can trick a user into opening a malformed file to trigger this vulnerability.
Key phrases: use-after-free, use after free
CVE-2023-32542: Out-of-bounds read vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 file may lead to information disclosure and/or arbitrary code execution.
Key phrases: out-of-bounds read, information disclosure, arbitrary code execution, out of bounds read
CVE-2023-32543: Incorrect default permissions in the Intel(R) ITS sofware before version 3.1 may allow authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2023-32544: Improper access control in some Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software installers before version 1.1.45 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper access control
CVE-2023-32545: The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to an out-of-bounds read in Cscape!CANPortMigration. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.   
Key phrases: execute arbitrary code, out-of-bounds read, canportmigration, out of bounds read
CVE-2023-32546: Code injection vulnerability exists in Chatwork Desktop Application (Mac) 2.6.43 and earlier. If this vulnerability is exploited, a non-administrative user of the Mac where the product is installed may store and obtain audio and image data from the product without the user's consent.
Key phrases: obtain audio and image data, code injection
CVE-2023-32547: Incorrect default permissions in the MAVinci Desktop Software for Intel(R) Falcon 8+ before version 6.2 may allow authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2023-32548: OS command injection vulnerability exists in WPS Office version 10.8.0.6186. If a remote attacker who can conduct a man-in-the-middle attack connects the product to a malicious server and sends a specially crafted data, an arbitrary OS command may be executed on the system where the product is installed.
Key phrases: os command injection, arbitrary os command, man in the middle
CVE-2023-32549: Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator.
Key phrases: insecurely generated
CVE-2023-3255: A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service.
Key phrases: send a clipboard to the VNC server to, exit condition, infinite loop, denial of service
CVE-2023-32550: Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.
Key phrases: data leak, leak information
CVE-2023-32551: Landscape allowed URLs which caused open redirection.
Key phrases: open redirection
CVE-2023-32552: An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents.This is similar to, but not identical to CVE-2023-32553
Key phrases: disclose sensitive information on agents, improper access control
CVE-2023-32553: An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents.This is similar to, but not identical to CVE-2023-32552.
Key phrases: disclose sensitive information on agents, improper access control
CVE-2023-32554: A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations.Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.This is similar to, but not identical to CVE-2023-32555.
Key phrases: obtain the ability to execute low-privileged, escalate privileges on affected installations, time-of-check time-of-use
CVE-2023-32555: A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations.Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.This is similar to, but not identical to CVE-2023-32554.
Key phrases: obtain the ability to execute low-privileged, escalate privileges on affected installations, time-of-check time-of-use
CVE-2023-32556: A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitive information.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, disclose sensitive information
CVE-2023-32557: A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges.
Key phrases: upload an arbitrary file to the Management Server, path traversal, remote code execution, system privileges
CVE-2023-32558: The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x.Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Key phrases: bypass the permission, path traversal
CVE-2023-32559: A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Key phrases: run arbitrary code, bypass the policy, privilege escalation
CVE-2023-3256: Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files.
Key phrases: access and load the content of local files
CVE-2023-32560: An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.Thanks to a Researcher at Tenable for finding and reporting.Fixed in version 6.4.1.
Key phrases: service disruption, arbitrary code execution
CVE-2023-32561: A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed in version 6.4.1.
Key phrases: authentication bypass
CVE-2023-32562: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1.
Key phrases: achieve a remove code execution, dangerous type, unrestricted upload, unrestricted upload of file with dangerous type
CVE-2023-32563: An unauthenticated attacker could achieve the code execution through a RemoteControl server.
Key phrases: code execution, remotecontrol server
CVE-2023-32564: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.
Key phrases: achieve a remove code execution, dangerous type, unrestricted upload, unrestricted upload of file with dangerous type
CVE-2023-32565: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1.
Key phrases: leakage of sensitive data, resource-based dos
CVE-2023-32566: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1.
Key phrases: leakage of sensitive data, resource-based dos
CVE-2023-32567: Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236
CVE-2023-32568: An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level privileges can leverage this to read sensitive data stored on the servers, modify data or server configuration, and delete data or application configuration.
CVE-2023-32569: An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The InfoScale VIOM web application is vulnerable to SQL Injection in some of the areas of the application. This allows attackers (who must have admin credentials) to submit arbitrary SQL commands on the back-end database to create, read, update, or delete any sensitive data stored in the database.
Key phrases: submit arbitrary SQL commands, submit arbitrary SQL commands on the back-, sql injection
CVE-2023-32570: VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.
Key phrases: race condition, application crash
CVE-2023-32571: Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.
Key phrases: execute arbitrary code, execute arbitrary code and commands when untrusted input
CVE-2023-32572: A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.
CVE-2023-32573: In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.
CVE-2023-32575: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <=1.3.25 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32576: Auth. (subscriber+) Stored Cross-Site Scripting') vulnerability in Plainware Locatoraid Store Locator plugin <=3.9.18 versions.
Key phrases: stored cross-site scripting
CVE-2023-32577: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eji Osigwe DevBuddy Twitter Feed plugin <=4.0.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32578: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Twinpictures Column-Matic plugin <=1.3.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32579: Cross-Site Request Forgery (CSRF) vulnerability in Designs & Code Forget About Shortcode Buttons plugin <=2.1.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32580: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPExperts Password Protected plugin <=2.6.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32582: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kyle Maurer Don8 plugin <=0.4 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32583: Cross-Site Request Forgery (CSRF) vulnerability in Prashant Walke WP All Backup plugin <=2.4.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32584: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in John Newcombe eBecas plugin <=3.1.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32587: Cross-Site Request Forgery (CSRF) vulnerability in WP Reactions, LLC WP Reactions Lite plugin <=1.3.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32588: Cross-Site Request Forgery (CSRF) vulnerability in BRANDbrilliance Post State Tags plugin <=2.0.6 versions.
Key phrases: cross-site request forgery (csrf)