yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-3004: A vulnerability, which was classified as critical, has been found in SourceCodester Simple Chat System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=read_msg of the component POST Parameter Handler. The manipulation of the argument convo_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230348.
Key phrases: sql injection
CVE-2023-3005: A vulnerability, which was classified as problematic, was found in SourceCodester Local Service Search Engine Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=save_area of the component POST Parameter Handler. The manipulation of the argument area with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230349 was assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-30053: TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.
Key phrases: command injection
CVE-2023-30054: TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
Key phrases: obtain a stable root shell through a specially constructed payload, command injection
CVE-2023-30056: A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie.
Key phrases: session takeover
CVE-2023-30057: Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-30058: novel-plus 3.6.2 is vulnerable to SQL Injection.
Key phrases: sql injection
CVE-2023-3006: A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.
Key phrases: branch history injection (bhi), spectre-bhb
CVE-2023-30061: D-Link DIR-879 v105A1 is vulnerable to Authentication Bypass via phpcgi.
Key phrases: Bypass via phpcgi, Authentication Bypass, authentication bypass
CVE-2023-30063: D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass.
Key phrases: Authentication bypass, authentication bypass
CVE-2023-30065: MitraStar GPT-2741GNAC-N2 with firmware BR_g5.9_1.11(WVK.0)b32 was discovered to contain a remote code execution (RCE) vulnerability in the ping function.
Key phrases: remote code execution (rce)
CVE-2023-3007: A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument sid leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230354 is the identifier assigned to this vulnerability.
CVE-2023-30076: Sourcecodester Judging Management System v1.0 is vulnerable to SQL Injection via /php-jms/print_judges.php?print_judges.php=&se_name=&sub_event_id=.
Key phrases: sql injection
CVE-2023-30077: Judging Management System v1.0 by oretnom23 was discovered to vulnerable to SQL injection via /php-jms/review_result.php?mainevent_id=, mainevent_id.
Key phrases: sql injection
CVE-2023-3008: A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument user/pass leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230355.
Key phrases: sql injection
CVE-2023-30082: A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory.
Key phrases: lengthy password, go down, stop responding, long password, denial of service
CVE-2023-30083: Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the newVar_N in util/decompile.c.
Key phrases: cause a denial of service via the newVar_N, buffer overflow
CVE-2023-30084: An issue found in libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the stackVal function in util/decompile.c.
Key phrases: cause a denial of service via the stackVal
CVE-2023-30085: Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the cws2fws function in util/decompile.c.
Key phrases: cause a denial of service via the cws2fws, buffer overflow
CVE-2023-30086: Buffer Overflow vulnerability found in Libtiff V.4.0.7 allows a local attacker to cause a denial of service via the tiffcp function in tiffcp.c.
Key phrases: cause a denial of service via the tiffcp, buffer overflow
CVE-2023-30087: Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c.
Key phrases: cause a denial of service via the mjs_mk_string, buffer overflow
CVE-2023-30088: An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c.
Key phrases: cause a denial of service via the mjs_execute
CVE-2023-3009: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Key phrases: cross-site scripting (xss)
CVE-2023-30090: Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability allows attackers to execute arbitrary code via uploading a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted PHP, arbitrary file uplaod
CVE-2023-30092: SourceCodester Online Pizza Ordering System v1.0 is vulnerable to SQL Injection via the QTY parameter.
Key phrases: sql injection
CVE-2023-30093: A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-30094: A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-30095: A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-30096: A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user information field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-30097: A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the private task field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-3010: Grafana is an open-source platform for monitoring and observability. The WorldMap panel plugin, versions before 1.0.4 contains a DOM XSS vulnerability.
Key phrases: dom xss
CVE-2023-30106: Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.
Key phrases: cross site scripting (xss)
CVE-2023-3011: The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missing or incorrect nonce validation on the arm_check_user_cap function. This makes it possible for unauthenticated attackers to perform multiple unauthorized actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery, unauthorized actions
CVE-2023-30111: Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2023-30112: Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection.
Key phrases: sql injection
CVE-2023-3012: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.
Key phrases: null pointer dereference
CVE-2023-30122: An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted PHP, arbitrary file upload
CVE-2023-30123: wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.
Key phrases: cross site scripting (xss)
CVE-2023-30124: LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2023-30125: EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2023-3013: Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.
Key phrases: unchecked return value
CVE-2023-30130: An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to
CVE-2023-30131: An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls.
Key phrases: run arbitrary commands, gain escalated privilege, unspecified impacts, unauthenticated api calls, escalate privilege
CVE-2023-30132: An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptographic Key.
Key phrases: gain escalated privileges, gain escalated privileges via static Cryptographic Key, static cryptographic key, escalate privilege
CVE-2023-30135: Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function.
Key phrases: command injection
CVE-2023-3014: A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6. Affected is an unknown function of the file admin/admincore.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230358 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-30145: Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.
Key phrases: server-side template injection (ssti)
CVE-2023-30146: Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the administrator credentials.
Key phrases: download a copy of the camera's settings
CVE-2023-30148: Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allows remote authenticated users to inject arbitrary web script or HTML via the body_text or body_text_rude field in /sourcefiles/BlockhtmlClass.php and /sourcefiles/blockhtml.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, stored cross site scripting (xss)
CVE-2023-30149: SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type, input_name. or q parameter in the autocompletion.php front controller.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the type, sql injection
CVE-2023-3015: A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359.
Key phrases: server side request forgery
CVE-2023-30150: PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
Key phrases: sql injection
CVE-2023-30151: A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the `key` GET parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the `key, sql injection
CVE-2023-30153: An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front controller.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the ajax.php front, sql injection, arbitrary sql commands
CVE-2023-30154: Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the 'id_product' parameter in hooks DisplayRightColumnProduct and DisplayProductButtons.
Key phrases: perform SQL injection attacks via `id_customer`, sql injection
CVE-2023-3016: A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/admincore.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230360.
Key phrases: cross site scripting
CVE-2023-3017: A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as problematic. This affects an unknown part of the file admin/?page=user/manage_user of the component Manage User Page. The manipulation of the argument First Name/Middle Name/Last Name leads to basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230361 was assigned to this vulnerability.
Key phrases: cross-site scripting
CVE-2023-30172: A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
Key phrases: read arbitrary files, read arbitrary files on the server via the, directory traversal
CVE-2023-30177: CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
Key phrases: cross site scripting (xss)
CVE-2023-30179: CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.
Key phrases: server-side template injection (ssti), remote code execution
CVE-2023-3018: A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/?page=user/list. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230362 is the identifier assigned to this vulnerability.
Key phrases: improper access control
CVE-2023-30184: A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter at /index.php/archives/1/comment.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-30185: CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \\\\attachment\\\\SystemAttachmentServices.php.
Key phrases: arbitrary file upload
CVE-2023-30186: A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
Key phrases: run arbitrary code, run arbitrary code via crafted JavaScript file, use after free issue
CVE-2023-30187: An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
Key phrases: run arbitrary code, run arbitrary code via crafted JavaScript file, out of bounds memory access
CVE-2023-30188: Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.
Key phrases: cause a denial of service via crafted JavaScript, memory exhaustion
CVE-2023-30189: Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook().
Key phrases: sql injection
CVE-2023-3019: A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
Key phrases: crash the QEMU process on the host, dma reentrancy issue, use-after-free error, denial of service, use after free
CVE-2023-30191: PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent().
Key phrases: sql injection
CVE-2023-30192: Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().
Key phrases: sql injection
CVE-2023-30194: Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
Key phrases: sql injection
CVE-2023-30195: In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without restriction formatted in json.
CVE-2023-30196: Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.
Key phrases: incorrect access control
CVE-2023-30197: Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal information without restriction by performing a path traversal attack.
Key phrases: download personal information without restriction by performing a, incorrect access control, path traversal
CVE-2023-30198: Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php.
Key phrases: incorrect access control
CVE-2023-30199: Prestashop customexporter <= 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php.
Key phrases: incorrect access control
CVE-2023-3020: Cross-site Scripting (XSS) - Reflected in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
Key phrases: cross-site scripting (xss)
CVE-2023-30200: In the module Image: WebP, Compress, Zoom, Lazy load, Alt & More (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for PrestaShop, a guest can download personal informations without restriction by performing a path traversal attack.
Key phrases: path traversal
CVE-2023-30203: Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the event_id parameter at /php-jms/result_sheet.php.
Key phrases: sql injection
CVE-2023-30204: Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the judge_id parameter at /php-jms/edit_judge.php.
Key phrases: sql injection
CVE-2023-30205: A stored cross-site scripting (XSS) vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the unique_id parameter in /admin/article.php.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-30207: A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.
Key phrases: cause a denial of service via use of, divide by zero issue
CVE-2023-3021: Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
Key phrases: cross-site scripting (xss)
CVE-2023-30210: OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.
Key phrases: cross site scripting (xss)
CVE-2023-30211: OURPHP <= 7.2.0 is vulnerable to SQL Injection.
Key phrases: sql injection
CVE-2023-30212: OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.
Key phrases: cross site scripting (xss)
CVE-2023-30216: Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information.
Key phrases: obtain user account information, insecure permissions
CVE-2023-3022: A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, sometimes holding rt6_info and other times fib6_info. This was not accounted for in other parts of the code where rt6_info was expected unconditionally, potentially leading to a kernel panic in fib6_rule_suppress.
CVE-2023-30222: An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to retrieve password hashes for all users via eavesdropping.
Key phrases: retrieve password hashes for all users via eavesdropping, information disclosure
CVE-2023-30223: A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packets containing requests to perform arbitrary actions.
Key phrases: perform arbitrary actions, send crafted TCP packets containing requests to perform, broken authentication
CVE-2023-30226: An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to cause a denial of service via crafted elf file.
Key phrases: cause a denial of service via crafted elf, verneed_entry
CVE-2023-3023: The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in versions up to, and including, 5.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with administrator-level or above permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Key phrases: time-based sql injection, sensitive information
CVE-2023-30237: CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe.
Key phrases: dll injection
CVE-2023-3024: Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.
Key phrases: out-of-bounds memory access, out of bounds memory
CVE-2023-30242: NS-ASG v6.3 was discovered to contain a SQL injection vulnerability via the component /admin/add_ikev2.php.
Key phrases: sql injection
CVE-2023-30243: Beijing Netcon NS-ASG Application Security Gateway v6.3 is vulnerable to SQL Injection via TunnelId that allows access to sensitive information.
Key phrases: sensitive information, sql injection, access sensitive information
CVE-2023-30245: SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id parameter of the edit_criteria.php file.
Key phrases: execute arbitrary code, execute arbitrary code via the crit_id parameter of, sql injection
CVE-2023-30246: SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the contestant_id parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the contestant_id parameter, sql injection
CVE-2023-30247: File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code via the update_settings parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the update_settings parameter, file upload
CVE-2023-3025: The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Key phrases: make web requests to arbitrary locations originating from, server-side request forgery
CVE-2023-30253: Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.
Key phrases: remote code execution by an authenticated user via
CVE-2023-30256: Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file.
Key phrases: obtain sensitive information, obtain sensitive information via the back and email_create, cross site scripting
CVE-2023-30257: A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.
Key phrases: escalate privileges to root, buffer overflow
CVE-2023-30258: Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.
Key phrases: run arbitrary commands, run arbitrary commands via unauthenticated HTTP request, command injection
CVE-2023-30259: A Buffer Overflow vulnerability in importshp plugin in LibreCAD 2.2.0 allows attackers to obtain sensitive information via a crafted DBF file.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted DBF file, buffer overflow
CVE-2023-3026: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.
Key phrases: cross-site scripting (xss)
CVE-2023-30260: Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.
Key phrases: run arbitrary commands, run arbitrary commands via crafted POST request to, command injection
CVE-2023-30261: Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request.
Key phrases: run arbitrary commands, run arbitrary commands via crafted GET request, command injection
CVE-2023-30262: An issue found in MIM software Inc MIM License Server and MIMpacs services v.6.9 thru v.7.0 fixed in v.7.0.10 allows a remote unauthenticated attacker to execute arbitrary code via the RMI Registry service.
Key phrases: execute arbitrary code, execute arbitrary code via the RMI Registry service
CVE-2023-30264: CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update.
Key phrases: unrestricted upload of file with dangerous type
CVE-2023-30265: CLTPHP <=6.0 is vulnerable to Directory Traversal.
Key phrases: directory traversal
CVE-2023-30266: CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type.
Key phrases: unrestricted upload
CVE-2023-30267: CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.
Key phrases: cross site scripting (xss)
CVE-2023-30268: CLTPHP <=6.0 is vulnerable to Improper Input Validation.
Key phrases: improper input validation
CVE-2023-30269: CLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php.
Key phrases: improper input validation
CVE-2023-3027: The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.
Key phrases: lookup content from the namespace where the policy, security escalation
CVE-2023-3028: Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too.Multiple vulnerabilities were identified:- The MQTT backend does not require authentication, allowing unauthorized connections from an attacker.- The vehicles publish their telemetry data (e.g. GPS Location, speed, odometer, fuel, etc) as messages in public topics. The backend also sends commands to the vehicles as MQTT posts in public topics. As a result, an attacker can access the confidential data of the entire fleet that is managed by the backend.- The MQTT messages sent by the vehicles or the backend are not encrypted or authenticated. An attacker can create and post messages to impersonate a vehicle or the backend. The attacker could then, for example, send incorrect information to the backend about the vehicle's location.- The backend can inject data into a vehicles CAN bus by sending a specific MQTT message on a public topic. Because these messages are not authenticated or encrypted, an attacker could impersonate the backend, create a fake message and inject CAN data in any vehicle managed by the backend.The confirmed version is201808021036, however further versions have been also identified as potentially impacted.
Key phrases: access and even manipulate the telemetry data of, the vehicles as MQTT posts in public topics, insufficient authentication, unauthorized connections, potentially impacted, confidential data, impersonate
CVE-2023-30280: Buffer Overflow vulnerability found in Netgear R6900 v.1.0.2.26, R6700v3 v.1.0.4.128, R6700 v.1.0.0.26 allows a remote attacker to execute arbitrary code and cause a denial ofservice via the getInputData parameter of the fwSchedule.cgi page.
Key phrases: execute arbitrary code, execute arbitrary code and cause a denial ofservice, buffer overflow
CVE-2023-30281: Insecure permissions vulnerability was discovered, due to a lack of permissionss control in scquickaccounting before v3.7.3 from Store Commander for PrestaShop, a guest can access exports from the module which can lead to leak of personnal informations from ps_customer table sush as name / surname / email
Key phrases: insecure permissions, leak of personnal informations
CVE-2023-30282: PrestaShop scexportcustomers <= 3.6.1 is vulnerable to Incorrect Access Control. Due to a lack of permissions' control, a guest can access exports from the module which can lead to leak of personal information from customer table.
Key phrases: incorrect access control, leak
CVE-2023-30285: An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/synchronizer/1.0/technicalUser.
Key phrases: obtain the login credentials, obtain the login credentials of a user via
CVE-2023-3029: A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. This vulnerability affects unknown code of the file /note/index/delete. The manipulation of the argument id leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230458 is the identifier assigned to this vulnerability.
Key phrases: cross site request forgery
CVE-2023-30297: An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server.
Key phrases: execute arbitrary code, execute arbitrary code via the monitoring function of
CVE-2023-30300: An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop.
Key phrases: infinite loop
CVE-2023-3031: Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.
Key phrases: read arbitrary local files, path traversal
CVE-2023-30319: Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, cross site scripting (xss)
CVE-2023-3032: Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload a Web Shell to a Web Server.This issue affects Mobatime web application: through 06.7.22.
Key phrases: Upload a Web Shell to a Web Server, unrestricted upload of file with dangerous type
CVE-2023-30320: Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, cross site scripting (xss)
CVE-2023-30321: Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, cross site scripting (xss)
CVE-2023-30322: Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, cross site scripting (xss)
CVE-2023-30323: SQL Injection vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to gain sensitive information.
Key phrases: gain sensitive information, sql injection
CVE-2023-30325: SQL Injection vulnerability in textMessage parameter in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine v.1.0, allows attackers to gain sensitive information.
Key phrases: gain sensitive information, sql injection
CVE-2023-30326: Cross Site Scripting (XSS) vulnerability in username field in /WebContent/WEB-INF/lib/chatbox.jsp in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, cross site scripting (xss)
CVE-2023-30328: An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use.
Key phrases: bypass authentication, bypass authentication via PID re-use, pid re-use
CVE-2023-3033: Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobatime web application: through 06.7.22.
Key phrases: Privilege Escalation, incorrect authorization, privilege escalation
CVE-2023-30330: SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defaultframe/2.0/defaultframe_filter.php.
Key phrases: local file inclusion
CVE-2023-30331: An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.
Key phrases: execute server-side template injection (SSTI, server-side template injection (ssti), server side template injection
CVE-2023-30333: An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted file, arbitrary file upload
CVE-2023-30334: AsmBB v2.9.1 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the MiniMag.asm and bbcode.asm libraries.
Key phrases: cross-site scripting (xss)
CVE-2023-30338: Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-3034: Reflected XSS affects the mode parameter in the /admin functionality of the web application in versions <=2.0.44
Key phrases: reflected xss
CVE-2023-30347: Cross Site Scripting (XSS) vulnerability in Neox Contact Center 2.3.9, via the serach_sms_api_name parameter to the SMA API search.
Key phrases: cross site scripting (xss)
CVE-2023-30349: JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.
Key phrases: remote code execution (rce)
CVE-2023-3035: A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Schedule Handler. The manipulation of the argument description leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230467.
Key phrases: cross site scripting
CVE-2023-30350: FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password.
Key phrases: escalate their privileges and reset the admin password, escalate privilege
CVE-2023-30351: Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service (or UART) by using the exposed credentials.
Key phrases: connect to the TELNET service (or UART, weak encryption, exposed credentials, default password
CVE-2023-30352: Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed.
Key phrases: hard-coded default password
CVE-2023-30353: Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.
Key phrases: unauthenticated remote code execution via an XML document
CVE-2023-30354: Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and the hardcoded boot password can be inserted for console access.
Key phrases: physical access, console access, hardcoded
CVE-2023-30356: Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmware
Key phrases: update the device with crafted firmware, missing support for an integrity check
CVE-2023-3036: An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit  783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71 enabled a remote attacker to trigger a panic by sending an NTSAuthenticator packet with extension length longer than the packet contents.
Key phrases: unchecked read, panic
CVE-2023-30362: Buffer Overflow vulnerability in coap_send function in libcoap library 4.3.1-103-g52cfd56 fixed in 4.3.1-120-ge242200 allows attackers to obtain sensitive information via malformed pdu.
Key phrases: obtain sensitive information, obtain sensitive information via malformed pdu, buffer overflow
CVE-2023-30363: vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.
Key phrases: prototype pollution
CVE-2023-30367: Multi-Remote Next Generation Connection Manager (mRemoteNG) is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on disk. mRemoteNG version <= v1.76.20 and <= 1.77.3-dev loads configuration files in plain text into memory (after decrypting them if necessary) at application start-up, even if no connection has been established yet. This allows attackers to access contents of configuration files in plain text through a memory dump and thus compromise user credentials when no custom password encryption key has been set. This also bypasses the connection configuration file encryption setting by dumping already decrypted configurations from memory.
Key phrases: access contents of configuration files in plain text, memory dump
CVE-2023-30368: Tenda AC5 V15.03.06.28 is vulnerable to Buffer Overflow via the initWebs function.
Key phrases: buffer overflow
CVE-2023-30369: Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow.
Key phrases: buffer overflow
CVE-2023-3037: Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to access the platform without authentication and retrieve personal data via the jsonGrid parameter.
Key phrases: access the platform without authentication and retrieve personal, improper authorization
CVE-2023-30370: In Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerability.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2023-30371: In Tenda AC15 V15.03.05.19, the function "sub_ED14" contains a stack-based buffer overflow vulnerability.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2023-30372: In Tenda AC15 V15.03.05.19, The function "xkjs_ver32" contains a stack-based buffer overflow vulnerability.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2023-30373: In Tenda AC15 V15.03.05.19, the function "xian_pppoe_user" contains a stack-based buffer overflow vulnerability.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2023-30375: In Tenda AC15 V15.03.05.19, the function "getIfIp" contains a stack-based buffer overflow vulnerability.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2023-30376: In Tenda AC15 V15.03.05.19, the function "henan_pppoe_user" contains a stack-based buffer overflow vulnerability.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2023-30378: In Tenda AC15 V15.03.05.19, the function "sub_8EE8" contains a stack-based buffer overflow vulnerability.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2023-3038: SQL injection vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the rows parameter of the jsonGrid route and extract all the information stored in the application.
Key phrases: send a specially crafted SQL query to the, sql injection
CVE-2023-30380: An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal.
Key phrases: execute a directory traversal
CVE-2023-30382: A buffer overflow in the component hl.exe of Valve Half-Life up to 5433873 allows attackers to execute arbitrary code and escalate privileges by supplying crafted parameters.
Key phrases: execute arbitrary code, execute arbitrary code and escalate privileges by supplying, buffer overflow
CVE-2023-30383: TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Archer_C2_US__V1_170228 were discovered to contain a buffer overflow which may lead to a Denial of Service (DoS) when parsing crafted data.
Key phrases: Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-3039: SD ROM Utility, versions prior to 1.0.2.0 contain an Improper Access Control vulnerability. A low-privileged malicious user may potentially exploit this vulnerability to perform arbitrary code execution with limited access.
Key phrases: perform arbitrary code execution, improper access control
CVE-2023-30394: Progress Ipswitch MoveIT 1.1.11 was discovered to contain a cross-site scripting (XSS) vulenrability via the API authentication function.
Key phrases: cross-site scripting (xss)
CVE-2023-30399: Insecure permissions in the settings page of GARO Wallbox GLB/GTB/GTC before v189 allows attackers to redirect users to a crafted update package link via a man-in-the-middle attack.
Key phrases: redirect users to a crafted update package link, insecure permissions, man-in-the-middle, man in the middle
CVE-2023-3040: A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have allowed an attacker to launch a DoS if the function was used to parse untrusted input data. It is important to note that because this debug function was only used in tests and demos, it was not exploitable in a normal environment.
Key phrases: out of bounds access bug, dos, exploitable
CVE-2023-30400: An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network configuration script within the MCU's operating system allows attackers to perform arbitrary command execution via a crafted wifi SSID or password.
Key phrases: perform arbitrary command execution, perform arbitrary command execution via a crafted wifi, command injection, arbitrary commands
CVE-2023-30402: YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re.
Key phrases: heap overflow