yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-27649: SQL injection vulnerability found in Trusted Tools Free Music v.2.1.0.47, v.2.0.0.46, v.1.9.1.45, v.1.8.2.43 allows a remote attacker to cause a denial of service via the search history table
Key phrases: cause a denial of service via the search, sql injection
CVE-2023-2765: A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic. This vulnerability affects unknown code of the file /E-mobile/App/System/File/downfile.php. The manipulation of the argument url leads to absolute path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-229270 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: absolute path traversal, disclosure
CVE-2023-27650: An issue found in APUS Group Launcher v.3.10.73 and v.3.10.88 allows a remote attacker to execute arbitrary code via the FONT_FILE parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the FONT_FILE parameter
CVE-2023-27651: An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file.
Key phrases: gain privileges, gain privileges via the update_info field of the
CVE-2023-27652: An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _default_.xml file.
Key phrases: gain privileges, gain privileges cause a denial of service via
CVE-2023-27653: An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a denial of service via the SharedPreference files.
Key phrases: cause a denial of service via the SharedPreference, sharedpreference files
CVE-2023-27654: An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a escalation of privileges via the TTMultiProvider component.
Key phrases: cause a escalation of privileges via the TTMultiProvider, escalation privilege
CVE-2023-2766: A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: disclosure
CVE-2023-27666: Auto Dealer Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the name parameter at /classes/SystemSettings.php?f=update_settings.
Key phrases: cross-site scripting (xss)
CVE-2023-27667: Auto Dealer Management System v1.0 was discovered to contain a SQL injection vulnerability.
Key phrases: sql injection
CVE-2023-2767: The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-2768: A vulnerability was found in Sucms 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin_ads.php?action=add. The manipulation of the argument intro leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-229274 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-2769: A vulnerability classified as critical has been found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file /classes/Master.php?f=delete_service. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229275.
Key phrases: sql injection
CVE-2023-2770: A vulnerability classified as critical was found in SourceCodester Online Exam System 1.0. This vulnerability affects unknown code of the file /kelasdosen/data. The manipulation of the argument columns[1][data] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229276.
Key phrases: sql injection
CVE-2023-27700: MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /accessory/picdel.html.
Key phrases: arbitrary file deletion
CVE-2023-27701: MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /database/sqldel.html.
Key phrases: arbitrary file deletion
CVE-2023-27703: The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface.
Key phrases: information leak
CVE-2023-27704: Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service (ReDoS).
Key phrases: Denial of Service (ReDoS), regular expression denial of service (redos)
CVE-2023-27705: APNG_Optimizer v1.4 was discovered to contain a buffer overflow via the component /apngopt/ubuntu.png.
Key phrases: buffer overflow
CVE-2023-27706: Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes.
Key phrases: local unprivileged processes
CVE-2023-27707: SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dede/group_store.php endpoint.
Key phrases: execute arbitrary code, execute arbitrary code via the rank_*, sql injection
CVE-2023-27709: SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dedestory_catalog.php endpoint.
Key phrases: execute arbitrary code, execute arbitrary code via the rank_*, sql injection
CVE-2023-2771: A vulnerability, which was classified as critical, has been found in SourceCodester Online Exam System 1.0. This issue affects some unknown processing of the file /jurusanmatkul/data. The manipulation of the argument columns[1][data] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229277 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-27711: Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component.
Key phrases: execute arbitrary code, execute arbitrary code via the Comment Manager /admin, cross site scripting
CVE-2023-27716: An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes running on it.
Key phrases: gain escalated privileges, gain escalated privileges for the nodes running on, escalate privilege
CVE-2023-27718: D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_498308 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-27719: D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_478360 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-2772: A vulnerability, which was classified as critical, was found in SourceCodester Budget and Expense Tracker System 1.0. Affected is an unknown function of the file /admin/budget/manage_budget.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-229278 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-27720: D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_48d630 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-27727: Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_function.h.
Key phrases: segmentation violation
CVE-2023-27728: Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_dump_is_recursive at src/njs_vmcode.c.
Key phrases: segmentation violation
CVE-2023-27729: Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njs_vmcode_return at src/njs_vmcode.c.
Key phrases: illegal memcpy
CVE-2023-2773: A vulnerability has been found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file view_admin.php. The manipulation of the argument adminid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229279.
Key phrases: sql injection
CVE-2023-27730: Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh.c.
Key phrases: segmentation violation
CVE-2023-27733: DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php.
Key phrases: sql injection
CVE-2023-27734: An issue found in Eteran edb-debugger v.1.3.0 allows a local attacker to causea denial of service via the collect_symbols function in plugins/BinaryInfo/symbols.cpp.
Key phrases: causea denial of service via the collect_symbols function
CVE-2023-27739: easyXDM 2.5 allows XSS via the xdm_e parameter.
Key phrases: XSS via the xdm_e parameter, xss
CVE-2023-2774: A vulnerability was found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file view_branch.php. The manipulation of the argument branchid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229280.
Key phrases: sql injection
CVE-2023-27742: IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.
Key phrases: sql injection
CVE-2023-27744: An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remote code execution.
Key phrases: remote code execution, vertical privilege escalation
CVE-2023-27745: An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending requests to the user server.
Key phrases: perform Administrative actions by sending requests to the
CVE-2023-27746: BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is intercepted.
Key phrases: default passphrase, brute force
CVE-2023-27747: BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authentication in its web server. This vulnerability allows attackers to access sensitive information such as configurations and recordings.
Key phrases: access sensitive information such as configurations and recordings
CVE-2023-27748: BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware. This can allow attackers to upload crafted firmware which contains backdoors and enables arbitrary code execution.
Key phrases: enables arbitrary code execution, upload crafted firmware which contains backdoors and enables
CVE-2023-2775: A vulnerability was found in code-projects Bus Dispatch and Information System 1.0. It has been classified as critical. This affects an unknown part of the file adminHome.php. The manipulation of the argument reach_city leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229281 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-27754: vox2mesh 1.0 has stack-overflow in main.cpp, this is stack-overflow caused by incorrect use of memcpy() funciton. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
Key phrases: denial of service (abort), cause a denial of service (abort), stack-overflow, stack overflow
CVE-2023-27755: go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download.
Key phrases: arbitrary file download
CVE-2023-27757: An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted JPG file, arbitrary file upload
CVE-2023-27759: An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsCodescs.dll file.
Key phrases: executea arbitrary commands, executea arbitrary commands via the WindowsCodescs.dll file
CVE-2023-2776: A vulnerability was found in code-projects Simple Photo Gallery 1.0. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to unrestricted upload. The attack can be initiated remotely. VDB-229282 is the identifier assigned to this vulnerability.
Key phrases: unrestricted upload
CVE-2023-27760: An issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to execute arbitrary commands via the filmora_setup_full846.exe.
Key phrases: execute arbitrary commands, execute arbitrary commands via the filmora_setup_full846.exe
CVE-2023-27761: An issue found in Wondershare Technology Co., Ltd UniConverter v.14.0.0 allows a remote attacker to execute arbitrary commands via the uniconverter14_64bit_setup_full14204.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the uniconverter14_64bit_setup_full14204.exe file
CVE-2023-27762: An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreator_setup_full7743.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the democreator_setup_full7743.exe file
CVE-2023-27763: An issue found in Wondershare Technology Co.,Ltd MobileTrans v.4.0.2 allows a remote attacker to execute arbitrary commands via the mobiletrans_setup_full5793.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the mobiletrans_setup_full5793.exe file
CVE-2023-27764: An issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairit_setup_full5913.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the repairit_setup_full5913.exe file
CVE-2023-27765: An issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoverit_setup_full4134.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the recoverit_setup_full4134.exe file
CVE-2023-27766: An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the anireel_setup_full9589.exe file
CVE-2023-27767: An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setup_full3360.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the drfone_setup_full3360.exe file
CVE-2023-27768: An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-pro_setup_full5239.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the pdfelement-pro_setup_full5239.exe file
CVE-2023-27769: An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader_setup_full13143.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the pdfreader_setup_full13143.exe file
CVE-2023-27770: An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max_setup_full5371.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the edraw-max_setup_full5371.exe file
CVE-2023-27771: An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCC_setup_full10819.exe file.
Key phrases: execute arbitrary commands, execute arbitrary commands via the wondershareCC_setup_full10819.exe file
CVE-2023-27772: libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at /client/client_control.c.
Key phrases: segmentation violation
CVE-2023-27775: A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload, html injection
CVE-2023-27776: A stored cross-site scripting (XSS) vulnerability in /index.php?page=category_list of Online Jewelry Shop v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-27777: Cross-site scripting (XSS) vulnerability was discovered in Online Jewelry Shop v1.0 that allows attackers to execute arbitrary script via a crafted URL.
Key phrases: execute arbitrary script, execute arbitrary script via a crafted URL, cross-site scripting (xss)
CVE-2023-27779: AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form.
Key phrases: sql injection
CVE-2023-2778: A denial-of-service vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager. This vulnerability can be exploited by sending a modified packet to port 400. If exploited, the application could potentially crash or experience a high CPU or memory usage condition, causing intermittent application functionality issues. The application would need to be restarted to recover from the DoS.
Key phrases: denial-of-service, intermittent application functionality issues, denial of service, crash
CVE-2023-27781: jpegoptim v1.5.2 was discovered to contain a heap overflow in the optimize function at jpegoptim.c.
Key phrases: heap overflow
CVE-2023-27783: An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugins.c.
Key phrases: cause a denial of service via the tcpedit_dlt_cleanup
CVE-2023-27784: An issue found in TCPReplay v.4.4.3 allows a remote attacker to cause a denial of service via the read_hexstring function at the utils.c:309 endpoint.
Key phrases: cause a denial of service via the read_hexstring
CVE-2023-27785: An issue found in TCPreplay TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the parse endpoints function.
Key phrases: cause a denial of service via the parse
CVE-2023-27786: An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the macinstring function.
Key phrases: cause a denial of service via the macinstring
CVE-2023-27787: An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the parse_list function at the list.c:81 endpoint.
Key phrases: cause a denial of service via the parse_list
CVE-2023-27788: An issue found in TCPrewrite v.4.4.3 allows a remote attacker to cause a denial of service via the ports2PORT function at the portmap.c:69 endpoint.
Key phrases: cause a denial of service via the ports2PORT
CVE-2023-27789: An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the cidr2cidr function at the cidr.c:178 endpoint.
Key phrases: cause a denial of service via the cidr2cidr
CVE-2023-2779: The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Key phrases: reflected cross-site scripting
CVE-2023-27791: An issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate privileges via insecure PRNG.
Key phrases: escalate privileges via insecure PRNG, insecure prng
CVE-2023-27792: An issue found in IXP Data Easy Install v.6.6.14884.0 allows an attacker to escalate privileges via lack of permissions applied to sub directories.
Key phrases: escalate privileges via lack of permissions applied to
CVE-2023-27793: An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak encoding of sensitive information.
Key phrases: gain escalated privileges, gain escalated privileges via weak encoding of sensitive, escalate privilege, sensitive information
CVE-2023-27795: An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key.
Key phrases: gain privileges, gain privileges via a static XOR key, static xor key
CVE-2023-27796: RG-EW1200G PRO Wireless Routers EW_3.0(1)B11P204, RG-EW1800GX PRO Wireless Routers EW_3.0(1)B11P204, and RG-EW3200GX PRO Wireless Routers EW_3.0(1)B11P204 were discovered to contain multiple command injection vulnerabilities via the data.ip, data.protocal, data.iface and data.package parameters in the runPackDiagnose function of diagnose.lua.
Key phrases: command injection
CVE-2023-2780: Path Traversal: '\\\\..\\\\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.
Key phrases: path traversal
CVE-2023-27801: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-27802: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EditvsList parameter at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-27803: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-27804: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-27805: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-27806: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos_lanip_dellist interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-27807: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-27808: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-2781: The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resend_verification_email function. This allows unauthenticated attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Allow Automatic Login After Successful Verification setting to be enabled, which it is not by default.
Key phrases: bypass via authenticate_user_by_email in versions up to, authentication bypass, impersonate users and trigger an email address verification, be enabled, random token generation weakness
CVE-2023-27810: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-27812: bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function.
Key phrases: arbitrary file deletion
CVE-2023-2782: Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38.
Key phrases: sensitive information disclosure, improper authorization
CVE-2023-27821: Databasir v1.0.7 was discovered to contain a remote code execution (RCE) vulnerability via the mockDataScript parameter.
Key phrases: remote code execution (rce)
CVE-2023-27823: An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.
Key phrases: bypass in Optoma 1080PSTX C02 allows an attacker, authentication bypass, access the administration console without valid credentials
CVE-2023-27826: SeowonIntech SWC 5100W WIMAX Bootloader 1.18.19.0, HW 0.0.7.0, and FW 1.11.0.1, 1.9.9.4 are vulnerable to OS Command Injection. which allows attackers to take over the system with root privilege by abusing doSystem() function.
Key phrases: take over the system with root privilege by, os command injection
CVE-2023-2783: Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker tomodify the contents of the post sent by the Apps.
Key phrases: an attacker tomodify the contents of the post
CVE-2023-27830: TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted files when executing a file transfer. This is due to the fact that TightVNC runs in the backend as a high-privileges account.
Key phrases: escalate privileges on the host operating system via
CVE-2023-27836: TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the devicePwd parameter in the function sub_ 40A80C.
Key phrases: command injection
CVE-2023-27837: TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the key parameter in the function sub_ 40A774.
Key phrases: command injection
CVE-2023-2784: Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests to the Apps. 
Key phrases: the Apps allowing a regular user send install
CVE-2023-27842: Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via the index.php compenent
Key phrases: execute arbitrary code, execute arbitrary code via the index.php compenent, insecure permissions
CVE-2023-27843: SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct component.
Key phrases: gain privileges, gain privileges via the QuotesProduct::deleteProduct component, sql injection
CVE-2023-27844: SQL injection vulnerability found in PrestaShopleurlrewrite v.1.0 and before allow a remote attacker to gain privileges via the Dispatcher::getController component.
Key phrases: gain privileges, gain privileges via the Dispatcher::getController component, sql injection
CVE-2023-27845: SQL injection vulnerability found in PrestaShop lekerawen_ocs before v.1.4.1 allow a remote attacker to gain privileges via the KerawenHelper::setCartOperationInfo, and KerawenHelper::resetCheckoutSessionData components.
Key phrases: gain privileges, gain privileges via the KerawenHelper::setCartOperationInfo, sql injection
CVE-2023-27846: SQL injection vulnerability found in PrestaShop themevolty v.4.0.8 and before allow a remote attacker to gain privileges via the tvcmsblog, tvcmsvideotab, tvcmswishlist, tvcmsbrandlist, tvcmscategorychainslider, tvcmscategoryproduct, tvcmscategoryslider, tvcmspaymenticon, tvcmstestimonial components.
Key phrases: gain privileges, gain privileges via the tvcmsblog, sql injection
CVE-2023-27847: SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components.
Key phrases: gain privileges, gain privileges via the xipcategoryclass and xippostsclass components, sql injection
CVE-2023-27848: broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
Key phrases: remote code execution (rce)
CVE-2023-27849: rails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
Key phrases: remote code execution (rce)
CVE-2023-2785: Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation oflarge log fileswhich can result in Denial of Service
Key phrases: cause the creation oflarge log fileswhich can result, denial of service
CVE-2023-27850: NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to this feature to access arbitrary files on the device.
Key phrases: access arbitrary files, this feature to access arbitrary files on the, file sharing mechanism
CVE-2023-27851: NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that unintentionally allows users with upload permissions to execute arbitrary code on the device.
Key phrases: execute arbitrary code, execute arbitrary code on the device, file sharing mechanism
CVE-2023-27852: NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a buffer overflow vulnerability in various CGI mechanisms that could allow an attacker to execute arbitrary code on the device.
Key phrases: execute arbitrary code, execute arbitrary code on the device, buffer overflow
CVE-2023-27853: NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary code on the device.
Key phrases: execute arbitrary code, execute arbitrary code on the device, format string
CVE-2023-27854: An arbitrary code execution vulnerability was reported to Rockwell Automation in Arena Simulation that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow. The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product. The user would need to open a malicious file provided to them by the attacker for the code to execute.
Key phrases: commit unauthorized arbitrary code to the software by, arbitrary code execution, memory buffer overflow, confidentiality, confidentiality and integrity, integrity and availability
CVE-2023-27855: In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. The attacker could overwrite existing executable files with attacker-controlled, malicious contents, potentially causing remote code execution. 
Key phrases: upload arbitrary files, path traversal, remote code execution
CVE-2023-27856: In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed. 
Key phrases: download arbitrary files, path traversal
CVE-2023-27857:  In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field in Rockwell Automation's ThinManager ThinServer.An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation. 
Key phrases: heap-based buffer over-read condition, read access violation, buffer over read, crash
CVE-2023-27858: Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using anuninitialized pointer in the application. The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product. The user would need to open a malicious file provided to them by the attacker for the code to execute.
Key phrases: commit unauthorized code to the software by using, arbitrary code execution, confidentiality, confidentiality and integrity, integrity and availability
CVE-2023-27859: IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases.  A user could exploit this by installing a malicious jar file that overwrites the existing like named jar file in another database.  IBM X-Force ID:  249205.
Key phrases: execute arbitrary code, execute arbitrary code caused by installing like named
CVE-2023-2786: Mattermost fails to properly check thepermissions when executing commands allowing a member with no permissionsto post a message in a channel to actually post it by executing channel commands.
Key phrases: actually post it by executing channel commands, execute commands
CVE-2023-27860: IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message.  This information could be used in further attacks against the system.  IBM X-Force ID:  249207.
Key phrases: sensitive information
CVE-2023-27861: IBM Maximo Application Suite - Manage Component 8.8.0 and 8.9.0 transmits sensitive information in cleartext that could be intercepted by an attacker using man in the middle techniques.  IBM X-Force ID:  249208.
Key phrases: cleartext, sensitive information, man in the middle
CVE-2023-27863: IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be used to access vSnap data stores.  IBM X-Force ID:  249325.
Key phrases: obtain SMB credentials, obtain SMB credentials that may be used to, smb credentials
CVE-2023-27864: IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.  IBM X-Force ID:  249327.
Key phrases: html injection
CVE-2023-27866: IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String.  IBM X-Force ID:  249511.
Key phrases: remote code execution, jndi injection
CVE-2023-27867: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  249514.
Key phrases: execute arbitrary code, execute arbitrary code via JNDI Injection, jndi injection
CVE-2023-27868: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially crafted request using the named pluginClassName class, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  249516.
Key phrases: execute arbitrary code, execute arbitrary code on the system, unchecked class instantiation
CVE-2023-27869: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted request using the named traceFile property, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  249517.
Key phrases: execute arbitrary code, execute arbitrary code on the system, logger injection
CVE-2023-2787: Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.
Key phrases: access arbitrary posts, access arbitrary posts by using the message threads, channel membership
CVE-2023-27870: IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518.
CVE-2023-27871: IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query.  IBM X-Force ID:  249613.
Key phrases: obtain sensitive credential information, obtain sensitive credential information for an external user
CVE-2023-27873: IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654.
Key phrases: obtain sensitive credential information, obtain sensitive credential information using specially crafted XML
CVE-2023-27874: IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands.  IBM X-Force ID:  249845.
Key phrases: execute arbitrary commands, xml external entity injection (xxe)
CVE-2023-27875: IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls.  IBM X-Force ID:  249847.
Key phrases: change other user's credentials due to improper, improper access controls
CVE-2023-27876: IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  249975.
Key phrases: xml external entity injection (xxe), consume memory resources, sensitive information
CVE-2023-27877: IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database.  IBM X-Force ID:  247905.
Key phrases: insecure password policy, sensitive information
CVE-2023-27879: Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access.
Key phrases: potentially enable information disclosure via physical access, improper access control
CVE-2023-2788: Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.
Key phrases: retain persistent access to Mattermost by obtaining an
CVE-2023-27881: A user could use the Upload Resource functionality to upload files to any location on the disk.
CVE-2023-27882: A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.
Key phrases: heap-based buffer overflow, code execution, malicious packet, heap based buffer overflow
CVE-2023-27886: Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP POST parameter called by index.php script.
Key phrases: execute arbitrary shell commands, unauthenticated os command injection
CVE-2023-27887: Improper initialization in BIOS firmware for some Intel(R) NUCs may allow a privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper initialization
CVE-2023-27888: Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script via Message Memo function of the affected product.
Key phrases: inject an arbitrary script via Message Memo function, cross-site scripting
CVE-2023-27889: Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of a user and to perform unintended operations by having a user view a malicious page.
Key phrases: hijack the authentication of a user and to, cross-site request forgery (csrf), unintended operations, cross site request forgery
CVE-2023-2789: A vulnerability was found in GNU cflow 1.7. It has been rated as problematic. This issue affects the function func_body/parse_variable_declaration of the file parser.c. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier VDB-229373 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: denial of service, disclosure
CVE-2023-27890: The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: XSS during the process of an admin generating, xss
CVE-2023-27891: rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
Key phrases: OAuth application authorization from a logged-out, logged-out session
CVE-2023-27892: Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the hardware wallet.
Key phrases: reveal arbitrary microcontroller memory, reveal arbitrary microcontroller memory on the device screen, global buffer overflow, physical access, crash
CVE-2023-27893: An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions 2088_1_700, 2008_1_710, 740, can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can read or modify any user or application data and can make the application unavailable.
Key phrases: vulnerable interface, unavailable
CVE-2023-27894: SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data.
Key phrases: inject arbitrary values, bypass firewall and force the vulnerable server to execute malicious requests, inject arbitrary values as CMS parameters to perform, remote file inclusion, sensitive information disclosure, limited impact on confidentiality of data
CVE-2023-27895: SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data.
Key phrases: be captured, exploitation, sensitive information
CVE-2023-27896: In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.
Key phrases: malicious boe server, availability