yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-52076: Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
Key phrases: writing arbitrary files, path traversal, arbitrary file write, remote command execution
CVE-2023-52077: Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs.  This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.
Key phrases: call admin APIs, perform operations such as updating server settings
CVE-2023-52079: msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1.  Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.
CVE-2023-52081: ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like U+FE4D (?), which would result in the omitted U+005F (_), for instance. The `lookupPreprocess()` function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability is fixed in 0.2.0. There are no known workarounds.
Key phrases: bypass that validation
CVE-2023-52082: Lychee is a free photo-management tool.  Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe.  The patch is provided on version 5.0.2.  To work around this issue, disable SQL EXPLAIN logging.
Key phrases: sql injection
CVE-2023-52083: Winter is a free, open-source content management system.  Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.
Key phrases: xss
CVE-2023-52084: Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.
Key phrases: for a stored XSS attack, xss
CVE-2023-52085: Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.
Key phrases: local file inclusion
CVE-2023-52086: resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. (File overwrite hasn't been possible with the code available in GitHub in recent years, however.)
Key phrases: allows arbitrary file, upload.php, arbitrary file upload, file overwrite
CVE-2023-5209: The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2023-52090: A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, escalate privileges on affected installations
CVE-2023-52091: An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, escalate privileges on affected installations
CVE-2023-52092: A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, escalate privileges on affected installations
CVE-2023-52093: An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, escalate privileges on affected installations, dangerous function
CVE-2023-52094: An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arbitrary folder, leading for a local privilege escalation on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, abuse the updater to delete an arbitrary folder, updater link, privilege escalation
CVE-2023-52096: SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StartTransaction Open Charge Point Protocol message with a timestamp parameter of 1000000). This may lead to a SQL exception in applications, and may undermine the integrity of transaction records.
Key phrases: invalid timestamps, sql exception, integrity of transaction records
CVE-2023-52097: Vulnerability of foreground service restrictions being bypassed in the NMS module.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: foreground service restrictions, service confidentiality
CVE-2023-52098: Denial of Service (DoS) vulnerability in the DMS module. Successful exploitation of this vulnerability will affect availability.
Key phrases: Denial of Service (DoS), denial of service (dos), availability
CVE-2023-52099: Vulnerability of foreground service restrictions being bypassed in the NMS module. Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: foreground service restrictions, service confidentiality
CVE-2023-5210: The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Key phrases: reflected cross-site scripting
CVE-2023-52100: The Celia Keyboard module has a vulnerability in access control. Successful exploitation of this vulnerability may affect availability.
Key phrases: access control, availability
CVE-2023-52101: Component exposure vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service availability and integrity.
Key phrases: component exposure, service availability, integrity
CVE-2023-52102: Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: vulnerability of parameters, service confidentiality
CVE-2023-52103: Buffer overflow vulnerability in the FLP module. Successful exploitation of this vulnerability may cause out-of-bounds read.
Key phrases: buffer overflow, out-of-bounds read, out of bounds read
CVE-2023-52104: Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: vulnerability of parameters, service confidentiality
CVE-2023-52105: The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect availability.
Key phrases: privilege escalation, availability
CVE-2023-52106: The DownloadProviderMain module has a vulnerability in API permission verification. Successful exploitation of this vulnerability may affect integrity and availability.
Key phrases: api permission verification, integrity, availability, integrity and availability
CVE-2023-52107: Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: vulnerability of permissions, service confidentiality
CVE-2023-52108: Vulnerability of process priorities being raised in the ActivityManagerService module. Successful exploitation of this vulnerability will affect availability.
Key phrases: vulnerability of process priorities, availability
CVE-2023-52109: Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: vulnerability of trust relationships, service confidentiality
CVE-2023-5211: The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability.
Key phrases: cross-site scripting
CVE-2023-52110: The sensor module has an out-of-bounds access vulnerability.Successful exploitation of this vulnerability may affect availability.
Key phrases: out-of-bounds access, availability, out of bounds access
CVE-2023-52111: Authorization vulnerability in the BootLoader module. Successful exploitation of this vulnerability may affect service integrity.
Key phrases: authorization, service integrity
CVE-2023-52112: Unauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to perform abnormally.
Key phrases: unauthorized file access, features to perform abnormally
CVE-2023-52113: launchAnyWhere vulnerability in the ActivityManagerService module. Successful exploitation of this vulnerability will affect availability.
Key phrases: launchanywhere, availability
CVE-2023-52114: Data confidentiality vulnerability in the ScreenReader module. Successful exploitation of this vulnerability may affect service integrity.
Key phrases: data confidentiality, service integrity
CVE-2023-52115: The iaware module has a Use-After-Free (UAF) vulnerability. Successful exploitation of this vulnerability may affect the system functions.
Key phrases: use-after-free (uaf), system functions
CVE-2023-52116: Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.
Key phrases: permission management, service exceptions
CVE-2023-52118: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS.This issue affects WP User Profile Avatar: from n/a through 1.0.
Key phrases: Stored XSS.This issue affects WP User Profile Avatar, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52119: Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage  WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage  WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.18.
Key phrases: cross-site request forgery (csrf)
CVE-2023-5212: The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosting account. Version 4.9.1 originally addressed the issue, but it was reintroduced in 4.9.2 and fixed again in 4.9.3.
Key phrases: delete arbitrary files, arbitrary file deletion
CVE-2023-52120: Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms  Ultimate Form Builder  Contact forms and much more.This issue affects NEX-Forms  Ultimate Form Builder  Contact forms and much more: from n/a through 8.5.2.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52121: Cross-Site Request Forgery (CSRF) vulnerability in NitroPack Inc. NitroPack  Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images.This issue affects NitroPack  Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: from n/a through 1.10.2.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52122: Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52123: Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52124: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs  Responsive Tabs Plugin for WordPress allows Stored XSS.This issue affects WP Tabs  Responsive Tabs Plugin for WordPress: from n/a through 2.2.0.
Key phrases: Stored XSS.This issue affects WP Tabs  Responsive, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52125: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8.
Key phrases: Stored XSS.This issue affects iframe: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52126: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Suman Bhattarai Send Users Email.This issue affects Send Users Email: from n/a through 1.4.3.
Key phrases: exposure of sensitive information
CVE-2023-52127: Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/a through 7.3.1.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52128: Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label  WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label  WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52129: Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52130: Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52131: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Zinc Page Generator.This issue affects Page Generator: from n/a through 1.7.1.
Key phrases: sql command, sql injection
CVE-2023-52132: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.
Key phrases: sql command, sql injection
CVE-2023-52133: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue affects Most And Least Read Posts Widget: from n/a through 2.5.16.
Key phrases: sql injection
CVE-2023-52134: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO my WordPress.This issue affects GEO my WordPress: from n/a through 4.0.2.
Key phrases: sql command, sql injection
CVE-2023-52135: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WS Form WS Form LITE  Drag & Drop Contact Form Builder for WordPress.This issue affects WS Form LITE  Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170.
Key phrases: sql injection
CVE-2023-52136: Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds  A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds  A Tweets Widget or X Feed Widget: from n/a through 2.1.2.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52137: The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands, an attacker may be able to steal secrets such as `GITHUB_TOKEN` if triggered on other events than `pull_request`.This has been patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://github.com/tj-actions/verify-changed-files/releases/tag/v17.0.0) by enabling `safe_output` by default and returning filename paths escaping special characters for bash environments.
Key phrases: execute arbitrary code, execute arbitrary code and potentially leak secrets, take over the [GitHub Runner](https://docs.github.com/en, command injection
CVE-2023-52138: Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio or ISO archive to achieve RCE on the target system. This vulnerability was fixed in commit 63d5dfa.
Key phrases: path traversal, arbitrary file, arbitrary file write
CVE-2023-52139: Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).
Key phrases: confidential information
CVE-2023-5214: In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.
Key phrases: path to escalate privileges
CVE-2023-52142: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cool Plugins Events Shortcodes For The Events Calendar.This issue affects Events Shortcodes For The Events Calendar: from n/a through 2.3.1.
Key phrases: sql command, sql injection
CVE-2023-52143: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout.This issue affects WP Stripe Checkout: from n/a through 1.2.2.37.
Key phrases: exposure of sensitive information
CVE-2023-52145: Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts.This issue affects Republish Old Posts: from n/a through 1.21.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52146: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.33.0.
Key phrases: exposure of sensitive information
CVE-2023-52148: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.30.
Key phrases: exposure of sensitive information
CVE-2023-52149: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0.
Key phrases: cross-site request forgery (csrf)
CVE-2023-5215: A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.
Key phrases: application crash, unintended behavior
CVE-2023-52150: Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Elementor: from n/a before 2.12.5.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52151: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Uncanny Automator, Uncanny Owl Uncanny Automator  Automate everything with the #1 no-code automation and integration plugin.This issue affects Uncanny Automator  Automate everything with the #1 no-code automation and integration plugin: from n/a through 5.1.0.2.
Key phrases: exposure of sensitive information
CVE-2023-52152: mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain host length recalculation.
Key phrases: out-of-bounds read, application crash, out of bounds read
CVE-2023-52153: A SQL Injection vulnerability in /pmb/opac_css/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to inject arbitrary SQL commands via the PmbOpac-LOGIN cookie value.
Key phrases: inject arbitrary SQL commands, inject arbitrary SQL commands via the PmbOpac-, sql injection
CVE-2023-52154: File Upload vulnerability in pmb/camera_upload.php in PMB 7.4.7 and earlier allows attackers to run arbitrary code via upload of crafted PHTML files.
Key phrases: run arbitrary code, run arbitrary code via upload of crafted PHTML, file upload
CVE-2023-52155: A SQL Injection vulnerability in /admin/sauvegarde/run.php in PMB 7.4.7 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via the sauvegardes variable through the /admin/sauvegarde/run.php endpoint.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the sauvegardes variable, sql injection
CVE-2023-52159: A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.
Key phrases: execute arbitrary code, denial of service (grossd daemon crash), trigger a denial of service (grossd daemon, stack-based buffer overflow, stack based buffer overflow
CVE-2023-52160: The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.
Key phrases: authentication bypass, not verify the network's TLS certificate during, impersonate Enterprise Wi-Fi networks, eap_peap_decrypt, attack vector
CVE-2023-52161: The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key.
Key phrases: gain unauthorized access, gain unauthorized access to a protected Wi-, all-zero key
CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: heap buffer overflow, heap corruption
CVE-2023-52173: XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3ADBD0.
Key phrases: write access violation
CVE-2023-52174: XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3125D6.
Key phrases: write access violation
CVE-2023-52175: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Uno (miunosoft) Auto Amazon Links  Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links  Amazon Associates Affiliate Plugin: from n/a through 5.1.1.
Key phrases: Stored XSS.This issue affects Auto Amazon Links  , improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52178: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MojofyWP WP Affiliate Disclosure allows Stored XSS.This issue affects WP Affiliate Disclosure: from n/a through 1.2.7.
Key phrases: Stored XSS.This issue affects WP Affiliate Disclosure:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-5218: Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Key phrases: use after free, heap corruption
CVE-2023-52180: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes.This issue affects Recipe Maker For Your Food Blog from Zip Recipes: from n/a through 8.1.0.
Key phrases: sql command, sql injection
CVE-2023-52181: Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1.
Key phrases: deserialization of untrusted data
CVE-2023-52182: Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz  WordPress Quizzes Builder.This issue affects ARI Stream Quiz  WordPress Quizzes Builder: from n/a through 1.3.0.
Key phrases: deserialization of untrusted data
CVE-2023-52184: Cross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal  A Complete Job Board.This issue affects WP Job Portal  A Complete Job Board: from n/a through 2.0.6.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52185: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup  WordPress Cloud Backup, Migration, Restore & Cloning Plugin.This issue affects Everest Backup  WordPress Cloud Backup, Migration, Restore & Cloning Plugin: from n/a through 2.1.9.
Key phrases: exposure of sensitive information
CVE-2023-52187: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Thomas Maier Image Source Control Lite  Show Image Credits and Captions.This issue affects Image Source Control Lite  Show Image Credits and Captions: from n/a through 2.17.0.
Key phrases: exposure of sensitive information
CVE-2023-52188: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter allows Stored XSS.This issue affects Footer Putter: from n/a through 1.17.
Key phrases: Stored XSS.This issue affects Footer Putter: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52189: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jhayghost Ideal Interactive Map allows Stored XSS.This issue affects Ideal Interactive Map: from n/a through 1.2.4.
Key phrases: Stored XSS.This issue affects Ideal Interactive Map:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52190: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Swings Coupon Referral Program.This issue affects Coupon Referral Program: from n/a through 1.7.2.
Key phrases: exposure of sensitive information
CVE-2023-52191: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Torbjon Infogram  Add charts, maps and infographics allows Stored XSS.This issue affects Infogram  Add charts, maps and infographics: from n/a through 1.6.1.
Key phrases: Stored XSS.This issue affects Infogram  Add charts, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52192: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through 1.0.11.
Key phrases: Stored XSS.This issue affects Keap Official Opt-, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52193: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 1.5.23.
Key phrases: Stored XSS.This issue affects Page Builder: Live, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52194: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takayuki Miyauchi oEmbed Gist allows Stored XSS.This issue affects oEmbed Gist: from n/a through 4.9.1.
Key phrases: Stored XSS.This issue affects oEmbed Gist: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52195: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Posts to Page Kerry James allows Stored XSS.This issue affects Kerry James: from n/a through 1.7.
Key phrases: Stored XSS.This issue affects Kerry James: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52196: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phil Ewels CPT Bootstrap Carousel allows Reflected XSS.This issue affects CPT Bootstrap Carousel: from n/a through 1.12.
Key phrases: Reflected XSS.This issue affects CPT Bootstrap Carousel:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-52197: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Impactpixel Ads Invalid Click Protection allows Stored XSS.This issue affects Ads Invalid Click Protection: from n/a through 1.0.
Key phrases: Stored XSS.This issue affects Ads Invalid Click Protection, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52198: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michiel van Eerd Private Google Calendars allows Stored XSS.This issue affects Private Google Calendars: from n/a through 20231125.
Key phrases: Stored XSS.This issue affects Private Google Calendars:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52200: Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember  Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember  Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.
Key phrases: cross-site request forgery (csrf), deserialization of untrusted data
CVE-2023-52201: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brian D. Goad pTypeConverter.This issue affects pTypeConverter: from n/a through 0.2.8.1.
Key phrases: sql command, sql injection
CVE-2023-52202: Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner Playlist Free.This issue affects HTML5 MP3 Player with Folder Feedburner Playlist Free: from n/a through 2.8.0.
Key phrases: deserialization of untrusted data
CVE-2023-52203: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliver Seidel, Bastian Germann cformsII allows Stored XSS.This issue affects cformsII: from n/a through 15.0.5.
Key phrases: Stored XSS.This issue affects cformsII: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52204: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Javik Randomize.This issue affects Randomize: from n/a through 1.4.3.
Key phrases: sql command, sql injection
CVE-2023-52205: Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free.This issue affects HTML5 SoundCloud Player with Playlist Free: from n/a through 2.8.0.
Key phrases: deserialization of untrusted data
CVE-2023-52206: Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder.This issue affects Page Builder: Live Composer: from n/a through 1.5.25.
Key phrases: deserialization of untrusted data
CVE-2023-52207: Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Playlist Free.This issue affects HTML5 MP3 Player with Playlist Free: from n/a through 3.0.0.
Key phrases: deserialization of untrusted data
CVE-2023-52208: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Constant Contact Constant Contact Forms.This issue affects Constant Contact Forms: from n/a through 2.4.2.
Key phrases: exposure of sensitive information
CVE-2023-5221: A vulnerability classified as critical has been found in ForU CMS. This affects an unknown part of the file /install/index.php. The manipulation of the argument db_name leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-240363. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: code injection, disclosure
CVE-2023-52213: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper Rate Star Review  AJAX Reviews for Content, with Star Ratings allows Reflected XSS.This issue affects Rate Star Review  AJAX Reviews for Content, with Star Ratings: from n/a through 1.5.1.
Key phrases: Reflected XSS.This issue affects Rate Star Review  , improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-52214: Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3.
Key phrases: missing authorization
CVE-2023-52215: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UkrSolution Simple Inventory Management  just scan barcode to manage products and orders. For WooCommerce.This issue affects Simple Inventory Management  just scan barcode to manage products and orders. For WooCommerce: from n/a through 1.5.1.
Key phrases: sql injection
CVE-2023-52216: Cross-Site Request Forgery (CSRF) vulnerability in Yevhen Kotelnytskyi JS & CSS Script Optimizer.This issue affects JS & CSS Script Optimizer: from n/a through 0.3.3.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52218: Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.This issue affects Woocommerce Tranzila Payment Gateway: from n/a through 1.0.8.
Key phrases: deserialization of untrusted data
CVE-2023-52219: Deserialization of Untrusted Data vulnerability in Gecka Gecka Terms Thumbnails.This issue affects Gecka Terms Thumbnails: from n/a through 1.1.
Key phrases: deserialization of untrusted data
CVE-2023-5222: A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240364. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: hard coded password, disclosure
CVE-2023-52221: Unrestricted Upload of File with Dangerous Type vulnerability in UkrSolution Barcode Scanner and Inventory manager.This issue affects Barcode Scanner and Inventory manager: from n/a through 1.5.1.
Key phrases: dangerous type
CVE-2023-52222: Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52223: Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite  WooCommerce integration.This issue affects MailerLite  WooCommerce integration: from n/a through 2.0.8.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52225: Deserialization of Untrusted Data vulnerability in Tagbox Tagbox  UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox  UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
Key phrases: deserialization of untrusted data
CVE-2023-52226: Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0.
Key phrases: cross-site request forgery (csrf)
CVE-2023-52228: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Kinchin Beds24 Online Booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through 2.0.24.
Key phrases: Stored XSS.This issue affects Beds24 Online Booking:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-52229: Missing Authorization vulnerability in Save as PDF plugin by Pdfcrowd Word Replacer Pro.This issue affects Word Replacer Pro: from n/a through 1.0.
Key phrases: missing authorization
CVE-2023-5223: A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f. This issue affects some unknown processing of the component Topic Handler. The manipulation leads to sandbox issue. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240365 was assigned to this vulnerability.
CVE-2023-52231: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.
Key phrases: exposure of sensitive information
CVE-2023-52234: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Elite for WooCommerce.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.2.
Key phrases: exposure of sensitive information
CVE-2023-52239: The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport.
Key phrases: XXE attacks, xxe
CVE-2023-52240: The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. This affects 4.4.2 through 4.14.8 before 4.14.9, 5.0.0 through 5.11.4 before 5.11.5, and 6.0.0 through 6.19.0 before 6.20.0. The full product names are Kantega SAML SSO OIDC Kerberos Single Sign-on for Jira Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Confluence Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bitbucket Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bamboo Data Center & Server (Kantega SSO Enterprise), and Kantega SAML SSO OIDC Kerberos Single Sign-on for FeCru Server (Kantega SSO Enterprise). (Here, FeCru refers to the Atlassian Fisheye and Crucible products running together.)
Key phrases: the Atlassian Fisheye and Crucible products running together, xss
CVE-2023-52251: An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.
Key phrases: execute arbitrary code, execute arbitrary code via the q parameter of
CVE-2023-52252: Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.
Key phrases: execute arbitrary Lua code, execute arbitrary Lua code because of a wildcarded, -Origin for the Remote upload endpoint, wildcarded access-control-allow-origin
CVE-2023-52257: LogoBee 0.2 allows updates.php?id= XSS.
Key phrases: updates.php?id= XSS, xss
CVE-2023-5226: An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI.
Key phrases: bypass prohibited branch checks, malicious actor bypass
CVE-2023-52262: outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.
Key phrases: execute arbitrary code, execute arbitrary code because the PHP extract function
CVE-2023-52263: Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc and browser/ui/webui/brave_web_ui_controller_factory.cc.
CVE-2023-52264: The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.
Key phrases: Reflected XSS because controllers/front/post.php, reflected xss
CVE-2023-52265: IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.
Key phrases: stored XSS via a PATCH request with a, xss
CVE-2023-52266: ehttp 1.0.6 before 17405b9 has an epoll_socket.cpp read_func use-after-free. An attacker can make many connections over a short time to trigger this.
Key phrases: use-after-free, trigger, use after free
CVE-2023-52267: ehttp 1.0.6 before 17405b9 has a simple_log.cpp _log out-of-bounds-read during error logging for long strings.
Key phrases: out-of-bounds-read, out of bounds read
CVE-2023-52269: MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrators to conduct attacks against global administrators.
Key phrases: conduct attacks against global administrators, xss
CVE-2023-5227: Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
Key phrases: unrestricted upload, dangerous type
CVE-2023-52271: The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via an IOCTL (which will be named at a later time).
Key phrases: kill any (Protected Process Light) process, ioctl
CVE-2023-52274: member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.
Key phrases: XSS via the Referer HTTP header, xss
CVE-2023-52275: Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.encryptfiles and guessing the correct image file extension.
Key phrases: view hidden images by navigating to data/
CVE-2023-52277: Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service (Heap Memory Corruption and application crash) or possibly have unspecified other impact via a long hostname in an RTSZ file, if the victim clicks on Test Connection. This occurs during SecureGatewayHost object processing in RAPortCheck.createNWConnection.
Key phrases: denial of service (Heap Memory Corruption and application crash), cause a denial of service (Heap Memory, heap memory corruption, unspecified other impact, unspecified impact
CVE-2023-5228: The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2023-52284: Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly module because push_pop_frame_ref_offset is mishandled.
Key phrases: corruption, double free