yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-21500: Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the trustlet memory.
Key phrases: access the trustlet memory, double free validation
CVE-2023-21501: Improper input validation vulnerability in mPOS fiserve trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code.
Key phrases: execute arbitrary code, improper input validation
CVE-2023-21502: Improper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attackers to get privilege escalation via debugging commands.
Key phrases: get privilege escalation via debugging commands, improper input validation
CVE-2023-21503: Potential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.
Key phrases: cause invalid memory access, potential buffer overflow
CVE-2023-21504: Potential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.
Key phrases: cause invalid memory access, potential buffer overflow
CVE-2023-21505: Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in sandbox.
Key phrases: write arbitrary file, write arbitrary file in sandbox, improper access control
CVE-2023-21506: Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2023-21507: Out-of-bounds Read vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory.
Key phrases: read arbitrary memory, out-of-bounds read
CVE-2023-21508: Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA command in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2023-21509: Out-of-bounds Write vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2023-2151: A vulnerability, which was classified as critical, was found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file manage_student.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226272.
Key phrases: sql injection
CVE-2023-21510: Out-of-bounds Read vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory.
Key phrases: read arbitrary memory, out-of-bounds read
CVE-2023-21511: Out-of-bounds Read vulnerability while processing CMD_COLDWALLET_BTC_SET_PRV_UTXO in bc_core trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory.
Key phrases: read arbitrary memory, out-of-bounds read
CVE-2023-21512: Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access permission.
Key phrases: read work profile notifications without proper access permission, improper knox id validation logic
CVE-2023-21513: Improper privilege management vulnerability in CC Mode prior to SMR Jun-2023 Release 1 allows physical attackers to manipulate device to operate in way that results in unexpected behavior in CC Mode under specific condition.
Key phrases: manipulate device to operate in way that results, improper privilege management, unexpected behavior
CVE-2023-21514: Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
Key phrases: execute javascript API to install APK from Galaxy, improper scheme validation
CVE-2023-21515: InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
Key phrases: execute javascript API to install APK from Galaxy, vulnerable script
CVE-2023-21516: XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
Key phrases: execute javascript API to install APK from Galaxy, xss
CVE-2023-21517: Heap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.
Key phrases: execute arbitrary code, heap out-of-bound write, out of bound write
CVE-2023-21518: Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted applications to start arbitrary activity.
Key phrases: start arbitrary activity, improper access control
CVE-2023-2152: A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226273 was assigned to this vulnerability.
Key phrases: file inclusion
CVE-2023-21520: A PII Enumeration via Credential Recovery in the Self Service(Credential Recovery) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially associate a list of contact details with an AtHoc IWS organization.
Key phrases: potentially associate a list of contact details with, pii enumeration, credential recovery
CVE-2023-21521: An SQL Injection vulnerability in the Management Console?(Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database, recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.
Key phrases: potentially read sensitive data from the database, sql injection
CVE-2023-21522: A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially control a script that is executed in the victim's browser then they can execute script commands in the context of the affected user account.
Key phrases: potentially control a script that is executed in, reflected cross-site scripting (xss)
CVE-2023-21523: A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account.
Key phrases: execute script commands in the context of the, stored cross-site scripting (xss)
CVE-2023-21524: Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21525: Remote Procedure Call Runtime Denial of Service Vulnerability
Key phrases: remote procedure call runtime denial of service
CVE-2023-21526: Windows Netlogon Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-21527: Windows iSCSI Service Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21528: Microsoft SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21529: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-2153: A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/assets/plugins/DataTables/examples/examples_support/editable_ajax.php of the component POST Parameter Handler. The manipulation of the argument value with the input 1><script>alert(666)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-226274 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-21531: Azure Service Fabric Container Elevation of Privilege Vulnerability
Key phrases: container elevation of privilege
CVE-2023-21532: Windows GDI Elevation of Privilege Vulnerability
Key phrases: windows gdi elevation of privilege
CVE-2023-21535: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21536: Event Tracing for Windows Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-21537: Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21538: .NET Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21539: Windows Authentication Remote Code Execution Vulnerability
Key phrases: windows authentication remote code execution
CVE-2023-2154: A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/?page=reminders/view_reminder. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226275.
Key phrases: sql injection
CVE-2023-21540: Windows Cryptographic Information Disclosure Vulnerability
Key phrases: windows cryptographic information disclosure
CVE-2023-21541: Windows Task Scheduler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21542: Windows Installer Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21543: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21546: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21547: Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21548: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21549: Windows SMB Witness Service Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-2155: A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file classes/Master.php?f=save_cargo_type. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226276.
Key phrases: cross site scripting
CVE-2023-21550: Windows Cryptographic Information Disclosure Vulnerability
Key phrases: windows cryptographic information disclosure
CVE-2023-21551: Microsoft Cryptographic Services Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21552: Windows GDI Elevation of Privilege Vulnerability
Key phrases: windows gdi elevation of privilege
CVE-2023-21553: Azure DevOps Server Remote Code Execution Vulnerability
Key phrases: azure devops server remote code execution
CVE-2023-21554: Microsoft Message Queuing Remote Code Execution Vulnerability
Key phrases: microsoft message queuing remote code execution
CVE-2023-21555: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21556: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21557: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21558: Windows Error Reporting Service Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21559: Windows Cryptographic Information Disclosure Vulnerability
Key phrases: windows cryptographic information disclosure
CVE-2023-2156: A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system.
Key phrases: create a denial of service condition on the, assertion failure
CVE-2023-21560: Windows Boot Manager Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows boot manager security feature bypass
CVE-2023-21561: Microsoft Cryptographic Services Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21563: BitLocker Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, bitlocker security feature bypass
CVE-2023-21564: Azure DevOps Server Cross-Site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-21565: Azure DevOps Server Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-21566: Visual Studio Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21567: Visual Studio Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21568: Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21569: Azure DevOps Server Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-2157: A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
Key phrases: heap-based buffer overflow, application crashing, heap based buffer overflow
CVE-2023-21570: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-21571: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-21572: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-21573: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-21574: Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: improper input validation, arbitrary code execution
CVE-2023-21575: Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-21576: Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-21577: Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-21578: Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-21579: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: integer overflow, wraparound, arbitrary code execution
CVE-2023-2158: Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user's account by crafting a custom "Remember Me" token. This is possible due to the use of a hard-coded cipher which was used when generating the token. A malicious actor who creates this token can supply it to a separate Code Dx system, provided they know the username they want to impersonate, and impersonate the user.Score6.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C
Key phrases: gain access, user impersonation, impersonate
CVE-2023-21581: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-21582: Adobe Digital Editions version 4.5.11.187303 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-21583: Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, disclosure of sensitive memory, exploitation, out of bounds read
CVE-2023-21584: FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, use after free, disclosure
CVE-2023-21585: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-21587: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: heap-based buffer overflow, arbitrary code execution
CVE-2023-21588: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: improper input validation, arbitrary code execution
CVE-2023-21589: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-2159: The CMP  Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setting) allows users to visit a site placed in maintenance mode thus bypassing the plugin's provided feature.
Key phrases: Bypass in versions up to, Maintenance Mode Bypass, visit a site placed in maintenance mode thus, maintenance mode bypass
CVE-2023-21590: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-21591: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-21592: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-21593: Adobe InDesign versions ID18.1 (and earlier) and ID17.4 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: null pointer dereference, application denial-of-service, denial of service
CVE-2023-21594: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: heap-based buffer overflow, arbitrary code execution
CVE-2023-21595: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-21596: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: improper input validation, arbitrary code execution
CVE-2023-21597: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-21598: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, use after free, disclosure
CVE-2023-21599: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-2160: Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.
Key phrases: weak password requirements
CVE-2023-21601: Adobe Dimension version 3.4.6 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, use after free, disclosure
CVE-2023-21603: Adobe Dimension version 3.4.6 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-21604: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: stack-based buffer overflow, arbitrary code execution
CVE-2023-21605: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: heap-based buffer overflow, arbitrary code execution
CVE-2023-21606: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-21607: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: improper input validation, arbitrary code execution
CVE-2023-21608: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: use after free, arbitrary code execution
CVE-2023-21609: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-2161: A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists thatcould cause unauthorized read access to the file system when a malicious configuration file isloaded on to the software by a local user.
Key phrases: cwe-611: improper restriction of xml external entity reference, unauthorized read access
CVE-2023-21610: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: stack-based buffer overflow, arbitrary code execution
CVE-2023-21611: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: creation of temporary file in directory with incorrect permissions, privilege escalation
CVE-2023-21612: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: creation of temporary file in directory with incorrect permissions, privilege escalation
CVE-2023-21613: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-21614: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-21615: Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2023-21616: Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2023-21618: Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: access of uninitialized pointer, arbitrary code execution
CVE-2023-21619: FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-2162: A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
Key phrases: use-after-free, use after free
CVE-2023-21620: FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-21621: FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: improper input validation, arbitrary code execution
CVE-2023-21622: FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-21624: Information disclosure in DSP Services while loading dynamic module.
Key phrases: information disclosure
CVE-2023-21625: Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2023-21626: Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.
Key phrases: cryptographic issue, improper authentication
CVE-2023-21627: Memory corruption in Trusted Execution Environment while calling service API with invalid address.
Key phrases: memory corruption, invalid address
CVE-2023-21628: Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
Key phrases: memory corruption
CVE-2023-21629: Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
Key phrases: memory corruption, double free
CVE-2023-2163: Incorrect verifier pruningin BPF in Linux Kernel>=5.4leads to unsafecode paths being incorrectly marked as safe, resulting inarbitrary read/write inkernel memory, lateral privilege escalation, and container escape.
Key phrases: unsafecode paths, lateral privilege escalation, container escape
CVE-2023-21630: Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal.
Key phrases: memory corruption, integer overflow
CVE-2023-21631: Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
Key phrases: weak configuration, improper input validation
CVE-2023-21632: Memory corruption in Automotive GPU while querying a gsl memory node.
Key phrases: memory corruption
CVE-2023-21633: Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
Key phrases: memory corruption
CVE-2023-21634: Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
Key phrases: memory corruption
CVE-2023-21635: Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony.
Key phrases: memory corruption
CVE-2023-21636: Memory Corruption due to improper validation of array index in Linux while updating adn record.
Key phrases: memory corruption
CVE-2023-21637: Memory corruption in Linux while calling system configuration APIs.
Key phrases: memory corruption
CVE-2023-21638: Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.
Key phrases: memory corruption
CVE-2023-21639: Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.
Key phrases: memory corruption
CVE-2023-2164: An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.
Key phrases: xss
CVE-2023-21640: Memory corruption in Linux when the file upload API is called with parameters having large buffer.
Key phrases: memory corruption, file upload
CVE-2023-21641: An app with non-privileged access can change global system brightness and cause undesired system behavior.
Key phrases: non-privileged access, global system brightness, undesired system behavior
CVE-2023-21642: Memory corruption in HAB Memory management due to broad system privileges via physical address.
Key phrases: memory corruption
CVE-2023-21643: Memory corruption due to untrusted pointer dereference in automotive during system call.
Key phrases: memory corruption, untrusted pointer dereference
CVE-2023-21644: Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request.
Key phrases: memory corruption, integer overflow
CVE-2023-21646: Transient DOS in Modem while processing invalid System Information Block 1.
Key phrases: transient dos, invalid system information block
CVE-2023-21647: Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.
Key phrases: information disclosure, improper input validation
CVE-2023-21648: Memory corruption in RIL while trying to send apdu packet.
Key phrases: memory corruption
CVE-2023-21649: Memory corruption in WLAN while running doDriverCmd for an unspecific command.
Key phrases: memory corruption
CVE-2023-21650: Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.
Key phrases: memory corruption
CVE-2023-21651: Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.
Key phrases: memory corruption
CVE-2023-21652: Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.
Key phrases: cryptographic issue
CVE-2023-21653: Transient DOS in Modem while processing RRC reconfiguration message.
Key phrases: transient dos
CVE-2023-21654: Memory corruption in Audio during playback session with audio effects enabled.
Key phrases: memory corruption
CVE-2023-21655: Memory corruption in Audio while validating and mapping metadata.
Key phrases: memory corruption
CVE-2023-21656: Memory corruption in WLAN HOST while receiving an WMI event from firmware.
Key phrases: memory corruption
CVE-2023-21657: Memoru corruption in Audio when ADSP sends input during record use case.
Key phrases: memoru corruption
CVE-2023-21658: Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
Key phrases: transient dos
CVE-2023-21659: Transient DOS in WLAN Firmware while processing frames with missing header fields.
Key phrases: transient dos, missing header fields
CVE-2023-2166: A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service.
Key phrases: denial of service, null pointer, null pointer dereference, crash, crash system
CVE-2023-21660: Transient DOS in WLAN Firmware while parsing FT Information Elements.
Key phrases: transient dos
CVE-2023-21661: Transient DOS while parsing WLAN beacon or probe-response frame.
Key phrases: transient dos, wlan beacon, probe-response frame
CVE-2023-21662: Memory corruption in Core Platform while printing the response buffer in log.
Key phrases: memory corruption
CVE-2023-21663: Memory Corruption while accessing metadata in Display.
Key phrases: memory corruption
CVE-2023-21664: Memory Corruption in Core Platform while printing the response buffer in log.
Key phrases: memory corruption
CVE-2023-21665: Memory corruption in Graphics while importing a file.
Key phrases: memory corruption
CVE-2023-21666: Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.
Key phrases: memory corruption
CVE-2023-21667: Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.
Key phrases: transient dos
CVE-2023-21669: Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address.
Key phrases: information disclosure, invalid source address
CVE-2023-21670: Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
Key phrases: memory corruption, arbitrary command execution, arbitrary commands
CVE-2023-21671: Memory Corruption in Core during syscall for Sectools Fuse comparison feature.
Key phrases: memory corruption
CVE-2023-21672: Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
Key phrases: memory corruption
CVE-2023-21673: Improper Access to the VM resource manager can lead to Memory Corruption.
Key phrases: improper access, memory corruption
CVE-2023-21674: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Key phrases: windows advanced local procedure call (alpc) elevation of privilege
CVE-2023-21675: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-21676: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21677: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Key phrases: windows internet key exchange (ike) extension denial of service
CVE-2023-21678: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21679: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-2168: The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-21680: Windows Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21681: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21682: Windows Point-to-Point Protocol (PPP) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-21683: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Key phrases: windows internet key exchange (ike) extension denial of service
CVE-2023-21684: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21685: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21686: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21687: HTTP.sys Information Disclosure Vulnerability
Key phrases: http.sys information disclosure
CVE-2023-21688: NT OS Kernel Elevation of Privilege Vulnerability
Key phrases: nt os kernel elevation of privilege
CVE-2023-21689: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-2169: The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-21690: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21691: Microsoft Protected Extensible Authentication Protocol (PEAP) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-21692: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21693: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-21694: Windows Fax Service Remote Code Execution Vulnerability
Key phrases: windows fax service remote code execution
CVE-2023-21695: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21697: Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability
Key phrases: server information disclosure
CVE-2023-21699: Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability
Key phrases: server information disclosure
CVE-2023-2170: The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-21700: Windows iSCSI Discovery Service Denial of Service Vulnerability
Key phrases: windows iscsi discovery service denial of service