yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-4314: The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.
Key phrases: deserialize arbitrary data, deserialize arbitrary data which may lead to remote, remote code execution, impactful, execute arbitrary, execute arbitrary code
CVE-2023-43141: TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.
Key phrases: incorrect access control
CVE-2023-43144: Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php.
Key phrases: sql injection
CVE-2023-43147: PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI.
Key phrases: cross site request forgery (csrf)
CVE-2023-43148: SPA-Cart 1.9.0.3 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to delete all accounts.
Key phrases: delete all accounts, cross site request forgery (csrf)
CVE-2023-43149: SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status.
Key phrases: add an admin user with role status, cross site request forgery (csrf)
CVE-2023-4315: The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the wcemails_edit parameter in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2023-43154: In Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, loose comparison in "isValidLogin()" function during login attempt results in PHP type confusion vulnerability that leads to authentication bypass and takeover of the administrator account.
Key phrases: bypass and takeover of the administrator account, authentication bypass, php type confusion
CVE-2023-4316: Zod in version 3.22.2 allows an attacker to perform a denial of service while validating emails
Key phrases: perform a denial of service while validating emails, zod
CVE-2023-4317: An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch.
Key phrases: unprotected branch
CVE-2023-43176: A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file.
Key phrases: execute arbitrary code, execute arbitrary code via supplying a crafted .sabredav, deserialization
CVE-2023-43177: CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
Key phrases: improperly controlled modification
CVE-2023-4318: The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrary effects via a CSRF attack
Key phrases: delete arbitrary effects, make logged in admins delete arbitrary effects via, csrf
CVE-2023-43183: Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows read-only users to arbitrarily change the password of an admin and hijack their account.
Key phrases: arbitrarily change the password of an admin and, incorrect access control, hijack
CVE-2023-43187: A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.
Key phrases: execute arbitrary code, execute arbitrary code via crafted XML-RPC, remote code execution (rce)
CVE-2023-43191: SpringbootCMS 1.0 foreground message can be embedded malicious code saved in the database. When users browse the comments, these malicious codes embedded in the HTML will be executed, and the user's browser will be controlled by the attacker, so as to achieve the special purpose of the attacker, such as cookie theft
Key phrases: malicious code, cookie theft
CVE-2023-43192: SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL statements. Attackers can use this vulnerability to execute any SQL statement.
Key phrases: sql injection
CVE-2023-43193: Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). An attacker can create a malicious link in the forum that leads to XSS.
Key phrases: cross site scripting (xss)
CVE-2023-43194: Submitty before v22.06.00 is vulnerable to Incorrect Access Control. An attacker can delete any post in the forum by modifying request parameter.
Key phrases: incorrect access control
CVE-2023-43196: D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn_jb parameter in the arp_sys.asp function.
Key phrases: stack overflow
CVE-2023-43197: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.asp function.
Key phrases: stack overflow
CVE-2023-43198: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/hi_block.asp function.
Key phrases: stack overflow
CVE-2023-43199: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the prev parameter in the H5/login.cgi function.
Key phrases: stack overflow
CVE-2023-4320: An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.
Key phrases: create personal access tokens that are valid indefinitely, arithmetic overflow, damage to the systems integrity
CVE-2023-43200: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data function.
Key phrases: stack overflow
CVE-2023-43201: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ext.asp function.
Key phrases: stack overflow
CVE-2023-43202: D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows attackers to execute arbitrary commands via the update.device.packet-capture.tftp-file-name parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the update.device.packet-capture.tftp, command injection
CVE-2023-43203: D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a stack overflow vulnerability in the function update_users.
Key phrases: stack overflow
CVE-2023-43204: D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the manual-time, command injection
CVE-2023-43206: D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability allows attackers to execute arbitrary commands via the certDownload parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the certDownload parameter, command injection
CVE-2023-43207: D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerability allows attackers to execute arbitrary commands via the configRestore parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the configRestore parameter, command injection
CVE-2023-43208: NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
Key phrases: unauthenticated remote code execution
CVE-2023-4321: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.
Key phrases: cross-site scripting (xss)
CVE-2023-43216: SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php.
Key phrases: arbitrary file write
CVE-2023-4322: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
Key phrases: heap-based buffer overflow
CVE-2023-43222: SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file.
Key phrases: arbitrary code writing
CVE-2023-43226: An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted PHP, arbitrary file upload
CVE-2023-4323: Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup
Key phrases: improper session management
CVE-2023-43232: A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-43233: A stored cross-site scripting (XSS) vulnerability in the cms/content/edit component of YZNCMS v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-43234: DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file_manage_control.php via the $activepath and $filename parameters.
Key phrases: remote code execution (rce)
CVE-2023-43235: D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDownSettings.
Key phrases: stack overflow
CVE-2023-43236: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter statuscheckpppoeuser in dir_setWanWifi.
Key phrases: stack overflow
CVE-2023-43237: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.
Key phrases: stack overflow
CVE-2023-43238: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter nvmacaddr in form2Dhcpip.cgi.
Key phrases: stack overflow
CVE-2023-43239: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter flag_5G in showMACfilterMAC.
Key phrases: stack overflow
CVE-2023-4324: Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy  headers
Key phrases: insecure defaults
CVE-2023-43240: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter.
Key phrases: stack overflow
CVE-2023-43241: D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity.
Key phrases: stack overflow
CVE-2023-43242: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter removeRuleList in form2IPQoSTcDel.
Key phrases: stack overflow
CVE-2023-4325: Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities
Key phrases: known
CVE-2023-43250: XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There is a User Mode Write AV via a crafted image file. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
Key phrases: Denial of Service (DoS), buffer overflow, user mode write av, denial of service (dos), code execution
CVE-2023-43251: XNSoft Nconvert 7.136 has an Exception Handler Chain Corrupted via a crafted image file. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
Key phrases: Denial of Service (DoS), exception handler chain, denial of service (dos), code execution
CVE-2023-43252: XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow via a crafted image file.
Key phrases: buffer overflow
CVE-2023-43256: A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input.
Key phrases: extract sensitive files in the host machine by, path traversal, non-sanitized user input
CVE-2023-4326: Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites
Key phrases: web interface, insecure default tls configuration
CVE-2023-43260: Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin panel.
Key phrases: cross-site scripting (xss)
CVE-2023-43261: An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.
Key phrases: access sensitive router components, information disclosure
CVE-2023-43263: A Cross-site scripting (XSS) vulnerability in Froala Editor v.4.1.1 allows attackers to execute arbitrary code via the Markdown component.
Key phrases: execute arbitrary code, execute arbitrary code via the Markdown component, cross-site scripting (xss)
CVE-2023-43267: A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-43268: Deyue Remote Vehicle Management System v1.1 was discovered to contain a deserialization vulnerability.
Key phrases: deserialization
CVE-2023-43269: pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability.
Key phrases: arbitrary file upload
CVE-2023-4327: Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux
Key phrases: web interface, exposure of sensitive data
CVE-2023-43270: dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate.
Key phrases: remote command execution (rce)
CVE-2023-43271: Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols.
Key phrases: directly access and delete the video files of, incorrect access control
CVE-2023-43274: Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter.
Key phrases: sql injection
CVE-2023-43275: Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form.
Key phrases: create crafted web pages due to a lack, cross-site request forgery (csrf)
CVE-2023-43278: A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.
Key phrases: arbitrarily add an admin account, cross-site request forgery (csrf)
CVE-2023-43279: Null Pointer Dereference in mask_cidr6 component at cidr.c in Tcpreplay 4.4.4 allows attackers to crash the application via crafted tcprewrite command.
Key phrases: crash the application via crafted tcprewrite command, null pointer dereference
CVE-2023-4328: Broadcom RAID Controller web interface is vulnerable  to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows
Key phrases: web interface, exposure of sensitive data
CVE-2023-43281: Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbi_load_gif_main function.
Key phrases: cause a denial of service via a crafted, double free
CVE-2023-43284: D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecified manipulation of the QoS POST parameter.
Key phrases: execute arbitrary code, execute arbitrary code via an unspecified manipulation of, qos post parameter
CVE-2023-4329: Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute
Key phrases: insecure default, http configuration
CVE-2023-43291: Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component.
Key phrases: execute arbitrary code, execute arbitrary code via the cache.php component, deserialization of untrusted data
CVE-2023-43292: Cross Site Scripting vulnerability in My Food Recipe Using PHP with Source Code v.1.0 allows a local attacker to execute arbitrary code via a crafted payload to the Recipe Name, Procedure, and ingredients parameters.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting
CVE-2023-43295: Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted request.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted request, cross site request forgery
CVE-2023-43297: An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
Key phrases: send crafted notifications via leakage of the channel
CVE-2023-43298: An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43299: An issue in DA BUTCHERS mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43300: An issue in urban_project mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43301: An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43302: An issue in sanTas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43303: An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43304: An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43305: An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43309: There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload.
Key phrases: run malicious scripts by injecting a specially crafted, stored cross-site scripting (xss)
CVE-2023-4331: Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols
Key phrases: web interface, insecure default tls configuration, vulnerable tls protocols
CVE-2023-43314: ** UNSUPPORTED WHEN ASSIGNED **The buffer overflow vulnerability in the Zyxel PMG2005-T20B firmware version V1.00(ABNK.2)b11_C0could allow an unauthenticated attacker to cause a denial of service condition via a crafted uid.
Key phrases: cause a denial of service condition via a, buffer overflow
CVE-2023-43317: An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component.
Key phrases: escalate privileges via the userPermissionsList parameter in Session
CVE-2023-43318: TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET requests.
Key phrases: escalate privileges via modification of the 'tid
CVE-2023-43319: Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross site scripting (xss)
CVE-2023-4332: Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file
Key phrases: improper permissions
CVE-2023-43320: An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via bypassing the two-factor authentication component.
Key phrases: escalate privileges via bypassing the two-factor
CVE-2023-43321: File Upload vulnerability in Digital China Networks DCFW-1800-SDC v.3.0 allows an authenticated attacker to execute arbitrary code via the wget function in the /sbin/cloudadmin.sh component.
Key phrases: execute arbitrary code, execute arbitrary code via the wget function in, file upload
CVE-2023-43322: ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v5.10.3 was discovered to contain a command injection vulnerability via the endpoint /v1/system/toolkit/files/.
Key phrases: command injection
CVE-2023-43323: mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, data[wall_photo], data[userShareVideo] and data[userShareLink].
Key phrases: external service interaction, parameters effected
CVE-2023-43325: A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
Key phrases: steal user's session cookies and impersonate their, cross-site scripting (xss)
CVE-2023-43326: A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
Key phrases: steal user's session cookies and impersonate their, reflected cross-site scripting (xss)
CVE-2023-4333: Broadcom RAID Controller web interface doesnt enforce SSL cipher ordering by server
Key phrases: web interface, ssl cipher ordering
CVE-2023-43331: A cross-site scripting (XSS) vulnerability in the Add User function of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-43336: Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.
Key phrases: access control issue
CVE-2023-43338: Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr(). This vulnerability allows attackers to execute arbitrary code via a crafted input.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted input, function pointer hijacking
CVE-2023-43339: Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Database Name, DataBase User or Database Port components.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload injected, cross-site scripting (xss)
CVE-2023-4334: Broadcom RAID Controller Web server (nginx) is serving private files without any authentication
Key phrases: private files, authentication
CVE-2023-43340: Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload injected, cross-site scripting (xss)
CVE-2023-43341: Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload injected, cross-site scripting (xss)
CVE-2023-43342: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Languages Menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross-site scripting (xss)
CVE-2023-43343: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Files - Description parameter in the Pages Menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross-site scripting (xss)
CVE-2023-43344: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the SEO - Meta description parameter in the Pages Menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross-site scripting (xss)
CVE-2023-43345: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content - Name parameter in the Pages Menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross-site scripting (xss)
CVE-2023-43346: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Backend - Dashboard parameter in the Languages Menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross-site scripting (xss)
CVE-2023-4335: Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux
Key phrases: private server-side files, authentication
CVE-2023-43352: An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to
CVE-2023-43353: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-43354: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-43355: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences - Add user component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-43356: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-43357: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-43358: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-43359: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-4336: Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute
Key phrases: insecure default, http configuration
CVE-2023-43360: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File Picker Menu component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-43361: Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.
Key phrases: execute arbitrary code, execute arbitrary code and cause a denial of, buffer overflow, denial of service
CVE-2023-43364: main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.
Key phrases: unexpected code execution
CVE-2023-4337: Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation
Key phrases: improper session handling
CVE-2023-43371: Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php.
Key phrases: sql injection
CVE-2023-43373: Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php.
Key phrases: sql injection
CVE-2023-43374: Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.
Key phrases: sql injection
CVE-2023-43375: Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, lingua_cli, mesenascita, and mesescaddoc parameters.
Key phrases: sql injection
CVE-2023-43376: A cross-site scripting (XSS) vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the nometipotariffa1 parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-43377: A cross-site scripting (XSS) vulnerability in /hoteldruid/visualizza_contratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the destinatario_email1 parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-4338: Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers
Key phrases: insecure default
CVE-2023-43381: SQL Injection vulnerability in Tianchoy Blog v.1.8.8 allows a remote attacker to obtain sensitive information via the id parameter in the login.php
Key phrases: obtain sensitive information, obtain sensitive information via the id parameter, sql injection
CVE-2023-43382: Directory Traversal vulnerability in itechyou dreamer CMS v.4.1.3 allows a remote attacker to execute arbitrary code via the themePath in the uploaded template function.
Key phrases: execute arbitrary code, execute arbitrary code via the themePath in the, directory traversal
CVE-2023-4339: Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions
Key phrases: insecure file permissions
CVE-2023-4340: Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log file
Key phrases: privilege escalation, session prints
CVE-2023-4341: Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI
Key phrases: privilege escalation, insecure folders
CVE-2023-4342: Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security  policy
Key phrases: insecure defaults
CVE-2023-4343: Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter
CVE-2023-4344: Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection
Key phrases: insufficient randomness
CVE-2023-43449: An issue in HummerRisk HummerRisk v.1.10 thru 1.4.1 allows an authenticated attacker to execute arbitrary code via a crafted request to the service/LicenseService component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted request to
CVE-2023-4345: Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged user
Key phrases: bypass leads to unauthorized data access for low privileged user, control bypass, client-side control bypass
CVE-2023-43453: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the setDiagnosisCfg component.
Key phrases: execute arbitrary code, execute arbitrary code via the IP parameter of
CVE-2023-43454: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of the switchOpMode component.
Key phrases: execute arbitrary code, execute arbitrary code via the hostName parameter of
CVE-2023-43455: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component.
Key phrases: execute arbitrary code, execute arbitrary code via the command parameter of
CVE-2023-43456: Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the firstname, middlename and lastname parameters in the /php-spms/admin/?page=user endpoint.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code and obtain sensitive information via, cross site scripting
CVE-2023-43457: An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint.
Key phrases: gain privileges, gain privileges via the ID parameter in the
CVE-2023-43458: Cross Site Scripting (XSS) vulnerability in Resort Reservation System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the room, name, and description parameters in the manage_room function.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code and obtain sensitive information via, cross site scripting (xss)
CVE-2023-4346: KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way. 
Key phrases: gain access
CVE-2023-43468: SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the login.php component.
Key phrases: execute arbitrary code, execute arbitrary code via the login.php component, sql injection
CVE-2023-43469: SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the ForPass.php component.
Key phrases: execute arbitrary code, execute arbitrary code via the ForPass.php component, sql injection
CVE-2023-4347: Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0.
Key phrases: cross-site scripting (xss)
CVE-2023-43470: SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component.
Key phrases: execute arbitrary code, execute arbitrary code via the checklogin.php component, sql injection
CVE-2023-43472: An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted request to
CVE-2023-43477: The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device.
Key phrases: achieve command injection as root on the device
CVE-2023-43478: fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images and configuration backups, which could allow them to alter the firmware or the configuration on the device, ultimately leading to code execution as root.
Key phrases: upload firmware images and configuration backups, alter the firmware or the configuration on the, code execution as root
CVE-2023-43481: An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript code via the com.tcl.browser.portal.browse.activity.BrowsePageActivity component.
Key phrases: execute arbitrary JavaScript code, execute arbitrary JavaScript code via the com.tcl.browser.portal.browse.activity, arbitrary javascript code
CVE-2023-43482: A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Key phrases: command execution, arbitrary commands, arbitrary command execution
CVE-2023-43484: Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.
Key phrases: inject an arbitrary script, cross-site scripting
CVE-2023-43485: When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: sharedsecret
CVE-2023-43488: The vulnerability allows a low privileged (untrusted) application tomodify a critical system property that should be denied, in order to enable the ADB (Android Debug Bridge) protocol to be exposed on the network, exploiting it to gain a privileged shell on the device without requiring the physical access through USB.
Key phrases: gain a privileged, enable the ADB (Android Debug Bridge)
CVE-2023-4349: Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: use after free, heap corruption
CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, incorrect calculation
CVE-2023-43492: In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.
Key phrases: bypass login authentication, hijack control flow and bypass login authentication, stack-based buffer overflow, stack based buffer overflow
CVE-2023-43493: SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain sensitive information.
Key phrases: obtain sensitive information, sql injection
CVE-2023-43494: Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.
Key phrases: obtain values of sensitive variables used in builds, sensitive build variables
CVE-2023-43495: Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
Key phrases: stored cross-site scripting (xss), exploitable
CVE-2023-43496: Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.
Key phrases: the system temporary directory to replace the file, default permissions, arbitrary code execution
CVE-2023-43497: In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
Key phrases: the Jenkins controller file system to read and, file upload, to write files
CVE-2023-43498: In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
Key phrases: the Jenkins controller file system to read and, file upload, to write files
CVE-2023-43499: Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.
Key phrases: stored cross-site scripting (xss)
CVE-2023-4350: Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
Key phrases: spoofing
CVE-2023-43500: A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.
Key phrases: connect to an attacker-specified hostname and, cross-site request forgery (csrf), cross site request forgery
CVE-2023-43501: A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
Key phrases: connect to an attacker-specified hostname and
CVE-2023-43502: A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.
Key phrases: delete Failure Causes, cross-site request forgery (csrf), failure causes, cross site request forgery
CVE-2023-43503: A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and project information in cleartext via UDP.
Key phrases: sensitive information
CVE-2023-43504: A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affected application is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition.
Key phrases: execute arbitrary code, execute arbitrary code on the target system or, buffer overflow, denial of service condition