yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-29707: Cross Site Scripting (XSS) vulnerability in GBCOM LAC WEB Control Center version lac-1.3.x, allows attackers to create an arbitrary device.
Key phrases: create an arbitrary device, cross site scripting (xss)
CVE-2023-29708: An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload.
Key phrases: force a factory reset via crafted payload
CVE-2023-29709: An issue was discovered in /cgi-bin/login_rj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication.
Key phrases: bypass authentication
CVE-2023-2971: Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.
Key phrases: access local files and exfiltrate them to remote, improper path handling
CVE-2023-29711: An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.
Key phrases: execute arbitrary code, execute arbitrary code via crafted GET request, incorrect access control issue
CVE-2023-29712: Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the X-Rewrite-URL parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting
CVE-2023-29713: Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the GET request after the /css/ directory.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting
CVE-2023-29714: Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via the username, password, and language cookies parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the username, cross site scripting
CVE-2023-2972: Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
Key phrases: prototype pollution
CVE-2023-29720: SofaWiki <=3.8.9 is vulnerable to Cross Site Scripting (XSS) via index.php.
Key phrases: cross site scripting (xss)
CVE-2023-29721: SofaWiki <= 3.8.9 has a file upload vulnerability that leads to command execution.
Key phrases: file upload, command execution
CVE-2023-29722: The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with this data to cause an escalation of privilege attack.
Key phrases: actively request permission to modify data in the, escalation of privilege, escalation privilege
CVE-2023-29723: The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting data, the attacker can force the application to load malicious image URLs and display them in the UI. As the amount of data increases, it will eventually cause the application to trigger an OOM error and crash, resulting in a persistent denial of service attack.
Key phrases: actively request permission to insert data into the, malicious image urls, persistent denial of service, crash
CVE-2023-29724: The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with this data to cause an escalation of privilege attack.
Key phrases: actively request permission to modify data in the, escalation of privilege, escalation privilege
CVE-2023-29725: The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting data, the attacker can force the application to load malicious image URLs and display them in the UI. As the amount of data increases, it will eventually cause the application to trigger an OOM error and crash, resulting in a persistent denial of service attack.
Key phrases: actively request permission to insert data into the, malicious image urls, persistent denial of service, crash
CVE-2023-29726: The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty data into the application's database. When the application starts, it loads the data from the database into memory. Once the attacker injects too much data, the application triggers an OOM error and crashes, resulting in a persistent denial of service.
Key phrases: key component, dirty data, denial of service, crash
CVE-2023-29727: The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related to user privacy settings and affects the implementation of the normal functionality of the application. An attacker can use this to cause an escalation of privilege attack.
Key phrases: use exposed components to delete data stored in, implementation of the normal functionality of the application, escalation of privilege, escalation privilege
CVE-2023-29728: The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack.
Key phrases: tamper with feature-related data, severe elevation of privilege, elevation privilege
CVE-2023-2973: A vulnerability, which was classified as problematic, has been found in SourceCodester Students Online Internship Timesheet Syste 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_company. The manipulation of the argument name with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230204.
Key phrases: cross site scripting
CVE-2023-29731: SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into memory when the application is opened. When an attacker injects too much data, the application will trigger an OOM error and crash at startup, resulting in a persistent denial of service.
Key phrases: exposed component, persistent denial of service, crash
CVE-2023-29732: SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.
Key phrases: exposed component, attack consequences
CVE-2023-29733: The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files. These files hold data that affects many app functions. Malicious modifications by unauthorized apps can cause security issues, such as functionality manipulation, resulting in a severe escalation of privilege attack.
Key phrases: modify the values in its SharedPreference files, functionality manipulation, severe escalation of privilege, escalation privilege
CVE-2023-29734: An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the database.
Key phrases: cause escalation of privilege attacks by manipulating the, escalation privilege
CVE-2023-29735: An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files.
Key phrases: cause a denial of service via the database, database files
CVE-2023-29736: Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its internal storage and achieve arbitrary code execution.
Key phrases: achieve arbitrary code execution, overwrite arbitrary files in its internal storage and, dictionary traversal
CVE-2023-29737: An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database files.
Key phrases: cause a denial of service via the database, database files
CVE-2023-29738: An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause code execution and escalation of Privileges via the database files.
Key phrases: cause code execution and escalation of Privileges via, escalation of privileges
CVE-2023-29739: An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component.
Key phrases: cause escalation of privilege attacks by manipulating the, escalation privilege
CVE-2023-2974: A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
CVE-2023-29740: An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulating the database.
Key phrases: cause a denial of service attack by manipulating
CVE-2023-29741: An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the database.
Key phrases: cause an escalation of privileges attack by manipulating, escalation privilege
CVE-2023-29742: An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database.
Key phrases: cause a code execution attack by manipulating the
CVE-2023-29743: An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
Key phrases: cause a persistent denial of service attack by
CVE-2023-29745: An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
Key phrases: cause a persistent denial of service attack by
CVE-2023-29746: An issue found in The Thaiger v.1.2 for Android allows unauthorized apps to cause a code execution attack by manipulating the SharedPreference files.
Key phrases: cause a code execution attack by manipulating the
CVE-2023-29747: Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.
Key phrases: exposed component, attack consequences
CVE-2023-29748: Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into memory when the application is opened. When an attacker injects too much data, the application will trigger an OOM error and crash at startup, resulting in a persistent denial of service.
Key phrases: exposed component, denial of service, crash
CVE-2023-29749: An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.
Key phrases: cause escalation of privilege attacks by manipulating the, escalation privilege
CVE-2023-2975: Issue summary: The AES-SIV cipher implementation contains a bug that causesit to ignore empty associated data entries which are unauthenticated asa consequence.Impact summary: Applications that use the AES-SIV algorithm and want toauthenticate empty data entries as associated data can be mislead by removingadding or reordering such empty entries as these are ignored by the OpenSSLimplementation. We are currently unaware of any such applications.The AES-SIV algorithm allows for authentication of multiple associateddata entries along with the encryption. To authenticate empty data theapplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) withNULL pointer as the output buffer and 0 as the input buffer length.The AES-SIV implementation in OpenSSL just returns success for such a callinstead of performing the associated data authentication operation.The empty data thus will not be authenticated.As this issue does not affect non-empty associated data authentication andwe expect it to be rare for an application to use empty associated dataentries this is qualified as Low severity issue.
Key phrases: authenticate empty data theapplication has to call EVP_EncryptUpdate
CVE-2023-29751: An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
Key phrases: cause a persistent denial of service by manipulating, sharedpreference files
CVE-2023-29752: An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component.
Key phrases: cause escalation of privilege attacks by manipulating the, escalation privilege
CVE-2023-29753: An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreference files.
Key phrases: cause a denial of service via the SharedPreference, sharedpreference files
CVE-2023-29755: An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.
Key phrases: cause escalation of privilege attacks by manipulating the, escalation privilege
CVE-2023-29756: An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
Key phrases: cause a persistent denial of service by manipulating
CVE-2023-29757: An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.
Key phrases: cause escalation of privilege attacks by manipulating the, escalation privilege
CVE-2023-29758: An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
Key phrases: cause a persistent denial of service by manipulating
CVE-2023-29759: An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files.
Key phrases: cause a persistent denial of service by manipulating
CVE-2023-2976: Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Key phrases: the default Java temporary directory to be able
CVE-2023-29761: An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
Key phrases: cause a persistent denial of service by manipulating
CVE-2023-29766: An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files.
Key phrases: cause an escalation of Privileges via the database, escalation of privileges
CVE-2023-29767: An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files.
Key phrases: cause a persistent denial of service via the, database files
CVE-2023-2977: A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.
Key phrases: buffer overrun, info leak, damage, crash
CVE-2023-29770: In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering.
Key phrases: upload any file without extension filtering
CVE-2023-29772: A Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC51U wireless router firmware version up to and including 3.0.0.4.380.8591 allows remote attackers to inject arbitrary web script or HTML via a malicious network request.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss), malicious network request
CVE-2023-29774: Dreamer CMS 3.0.1 is vulnerable to stored Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2023-29778: GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.
Key phrases: os command injection
CVE-2023-29779: Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. After receiving the malicious command, the device will keep reporting its status and finally drain its battery after receiving the 'Set_short_poll_interval' command.
Key phrases: denial of service (DOS), send malicious Zigbee messages to a vulnerable device, denial of service (dos), crashes
CVE-2023-2978: A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifier assigned to this vulnerability.
Key phrases: authorization bypass
CVE-2023-29780: Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes.
Key phrases: send malicious Zigbee messages to a vulnerable device, denial-of-service, crashes, denial of service
CVE-2023-2979: A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230211.
Key phrases: improper access control
CVE-2023-29790: kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue.
Key phrases: sensitive information leakage
CVE-2023-29791: kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.
Key phrases: cross site scripting (xss)
CVE-2023-29798: TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
Key phrases: command injection
CVE-2023-29799: TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
Key phrases: command injection
CVE-2023-2980: A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.
CVE-2023-29800: TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
Key phrases: command injection
CVE-2023-29801: TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function.
Key phrases: command injection
CVE-2023-29802: TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
Key phrases: command injection
CVE-2023-29803: TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function.
Key phrases: command injection
CVE-2023-29804: WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the sys_smb_pwdmod function.
Key phrases: command injection
CVE-2023-29805: WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the pro_stor_canceltrans_handler_part_19 function.
Key phrases: command injection
CVE-2023-29808: Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, cross site scripting (xss)
CVE-2023-29809: SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbitrary code via a crafted script in the request.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script in, sql injection
CVE-2023-2981: A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component Chat. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230213 was assigned to this vulnerability.
CVE-2023-29815: mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).
Key phrases: cross site request forgery (csrf)
CVE-2023-29818: An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via the default allowlist feature being stored as non-admin.
Key phrases: bypass protections, bypass protections via the default allowlist feature being
CVE-2023-29819: An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload.
Key phrases: bypass protections, bypass protections via a crafted payload
CVE-2023-2982: The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
Key phrases: bypass in versions up to, authentication bypass
CVE-2023-29820: An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE installer. NOTE: the vendor's perspective is that this is not a separate vulnerability relative to CVE-2023-29818 and CVE-2023-29819.
Key phrases: access sensitive information via the EXE installer
CVE-2023-29824: A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor and discoverer indicate that this is not a security issue.
Key phrases: use-after-free issue, use after free
CVE-2023-29827: ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.
Key phrases: server-side template injection, server side template injection
CVE-2023-2983: Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
Key phrases: privilege defined with unsafe actions
CVE-2023-29835: Insecure Permission vulnerability found in Wondershare Dr.Fone v.12.9.6 allows a remote attacker to escalate privileges via the service permission function.
Key phrases: escalate privileges via the service permission function, insecure permission
CVE-2023-29836: Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form.
Key phrases: execute arbitrary code, execute arbitrary code via the Username parameter of, cross site scripting
CVE-2023-29837: Cross Site Scripting vulnerability found in Exelysis Unified Communication Solution (EUCS) v.1.0 allows a remote attacker to gain privileges via the URL path of the eucsAdmin login web page.
Key phrases: gain privileges, gain privileges via the URL path of the, cross site scripting
CVE-2023-29838: Insecure Permission vulnerability found in Botkind/Siber Systems SyncApp v.19.0.3.0 allows a local attacker toe escalate privileges via the SyncService.exe file.
Key phrases: a local attacker toe escalate privileges via the, insecure permission
CVE-2023-29839: A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function.
Key phrases: allows arbitrary execution, arbitrary execution of commands, stored cross site scripting (xss)
CVE-2023-2984: Path Traversal: '\\\\..\\\\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
Key phrases: path traversal
CVE-2023-29842: ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.
Key phrases: blind sql injection (time-based)
CVE-2023-29847: AeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the comment_author and comment_content parameters at /post.php. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-29848: Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php Add New Menu function.
Key phrases: stored cross-site scripting (xss)
CVE-2023-29849: Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty parameter.
Key phrases: sql injection
CVE-2023-2985: A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem.
Key phrases: cause a denial of service problem, use after free flaw
CVE-2023-29850: SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information.
Key phrases: obtain information, obtain information such as the user's geolocation, exif data
CVE-2023-29854: DirCMS 6.0.0 has a Cross Site Scripting (XSS) vulnerability in the foreground.
Key phrases: cross site scripting (xss)
CVE-2023-29855: WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.
Key phrases: command execution
CVE-2023-29856: D-Link DIR-868L Hardware version A1, firmware version 1.12 is vulnerable to Buffer Overflow. The vulnerability is in scandir.sgi binary.
Key phrases: buffer overflow
CVE-2023-29857: An issue in Teslamate v1.27.1 allows attackers to obtain sensitive information via directly accessing the teslamate link.
Key phrases: obtain sensitive information, obtain sensitive information via directly accessing the teslamate
CVE-2023-2986: The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
Key phrases: bypass in versions up to, authentication bypass, log in as users who have abandoned the, historical check-out links
CVE-2023-29860: An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via the getCookie method.
Key phrases: view sensitive information via the getCookie method, insecure permissions
CVE-2023-29861: An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the device.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted request to
CVE-2023-29862: An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel parameters.
Key phrases: execute arbitrary code, execute arbitrary code via the check and authLevel
CVE-2023-29863: Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter in the WSDL files.
Key phrases: sql injection
CVE-2023-29867: Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API.
Key phrases: gain information, incorrect access control
CVE-2023-29868: Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized changes on articles where they only have customer permissions.
Key phrases: incorrect access control, unauthorized changes
CVE-2023-2987: The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation.
Key phrases: bypass due to an use of insufficiently unique cryptographic signature, authorization bypass, privilege escalation
CVE-2023-29887: A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter.
Key phrases: include arbitrary files, include arbitrary files via the File parameter, local file inclusion
CVE-2023-2989: Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited
Key phrases: bypass authentication, crash the service or bypass authentication if successfully, out of bounds memory read
CVE-2023-2990: Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service
Key phrases: denial of service, crash
CVE-2023-29905: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29906: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29907: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29908: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29909: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-2991: Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape is installed on can be remotely determined via a "trial extension request" message
Key phrases: information disclosure
CVE-2023-29910: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29911: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29912: H3C Magic R200 R200V100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29913: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29914: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29915: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29916: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29917: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm.
Key phrases: stack overflow
CVE-2023-29918: RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
Key phrases: csv injection
CVE-2023-29919: SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted.
Key phrases: insecure permissions
CVE-2023-2992: An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions.  Rebooting SMM or FPC will restore access to the management web server.
Key phrases: unauthenticated denial of service, reboot
CVE-2023-29921: PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.
Key phrases: incorrect access control
CVE-2023-29922: PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
Key phrases: incorrect access control
CVE-2023-29923: PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
Key phrases: insecure permissions
CVE-2023-29924: PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.
Key phrases: for remote code execution, incorrect access control
CVE-2023-29926: PowerJob V4.3.2 has unauthorized interface that causes remote code execution.
Key phrases: unauthorized interface, remote code execution
CVE-2023-29927: Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the programs role-based access controls.
Key phrases: sql connection strings
CVE-2023-2993: A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
CVE-2023-29930: An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetials to the TFTP server configuration page.
Key phrases: execute arbitrary code, execute arbitrary code via the login crednetials to
CVE-2023-29931: laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.
Key phrases: local file inclusion
CVE-2023-29932: llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpOperand.
Key phrases: segmentation fault
CVE-2023-29933: llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.
Key phrases: segmentation fault
CVE-2023-29934: llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect().
Key phrases: segmentation fault
CVE-2023-29935: llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.
Key phrases: assertion failure
CVE-2023-29939: llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv::TargetEnvAttr).
Key phrases: segmentation fault
CVE-2023-29941: llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mlir::sparse_tensor::SortOp>(mlir::sparse_tensor::SortOp.
Key phrases: segmentation fault
CVE-2023-29942: llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLVM::LLVMVoidType.
Key phrases: segmentation fault
CVE-2023-29944: Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet function of the metersphere system workbench
Key phrases: remote command execution, system command reverse-shell
CVE-2023-2995: The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2023-29950: swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules/swftools.c
Key phrases: heap buffer overflow
CVE-2023-2996: The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
Key phrases: deleting arbitrary files, manipulate existing files on the site, remote code execution, phar deserialization
CVE-2023-29961: D-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform/formTcpipSetup,
Key phrases: stack overflow
CVE-2023-29962: S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.
Key phrases: arbitrary file read
CVE-2023-29963: S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.
Key phrases: authenticated remote code execution (rce)
CVE-2023-29973: Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall.
Key phrases: no rate limit
CVE-2023-29974: An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.
Key phrases: compromise user accounts via weak password requirements
CVE-2023-29975: An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification.
Key phrases: change the password of any user without verification
CVE-2023-2998: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
Key phrases: cross-site scripting (xss)
CVE-2023-29983: Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog tab in the admin panel.
Key phrases: execute arbitrary code, execute arbitrary code via the auditlog tab in, cross site scripting
CVE-2023-29984: Null pointer dereference vulnerability exists in multiple vendors MFPs and printers which implement Debut web server 1.2 or 1.3. Processing a specially crafted request may lead an affected product to a denial-of-service (DoS) condition. As for the affected products/models/versions, see the detailed information provided by each vendor.
Key phrases: null pointer dereference, denial-of-service (dos) condition, denial of service
CVE-2023-29985: Sourcecodester Student Study Center Desk Management System v1.0 admin\\\\reports\\\\index.php#date_from has a SQL Injection vulnerability.
Key phrases: sql injection
CVE-2023-29986: spring-boot-actuator-logview 0.2.13 allows Directory Traversal to sibling directories via LogViewEndpoint.view.
Key phrases: sibling directories via LogViewEndpoint.view, directory traversal
CVE-2023-2999: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
Key phrases: cross-site scripting (xss)
CVE-2023-29994: In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c.
Key phrases: heap overflow
CVE-2023-29995: In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c
Key phrases: heap overflow
CVE-2023-29996: In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode.
Key phrases: null pointer dereference
CVE-2023-29998: A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTML and gain privileges via the description parameter.
Key phrases: inject arbitrary web script or HTML, gain privileges, inject arbitrary web script or HTML and gain, cross-site scripting (xss)
CVE-2023-3000: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Erikoglu Technology ErMon allows Command Line Execution through SQL Injection, Authentication Bypass.This issue affects ErMon: before 230602.
Key phrases: Authentication Bypass, Command Line Execution through SQL Injection, sql command, sql injection, command line execution, authentication bypass
CVE-2023-3001: A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module thatcould cause an interpretation of malicious payload data, potentially leading to remote codeexecution when an attacker gets the user to open a malicious file. 
Key phrases: cwe-502, remote codeexecution
CVE-2023-30013: TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands through the "command", command insertion
CVE-2023-30014: SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_stat_update.php.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code and obtain sensitive information via, sql injection
CVE-2023-30015: SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via txtsearch parameter in review_search.php.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code and obtain sensitive information via, sql injection
CVE-2023-30016: SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_details_edit.php.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code and obtain sensitive information via, sql injection
CVE-2023-30018: Judging Management System v1.0 is vulnerable to SQL Injection. via /php-jms/review_se_result.php?mainevent_id=.
Key phrases: sql injection
CVE-2023-30019: imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.
Key phrases: server-side request forgery (ssrf)
CVE-2023-30024: The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer. Affected devices have firmware versions prior to magicJack A921 USB Phone Jack Rev 3.0 V1.4.
Key phrases: ransomware deployment on the host computer, hidden nand flash memory partition, unauthorized read write access
CVE-2023-3003: A vulnerability classified as critical was found in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_prices.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230347.
Key phrases: sql injection