yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-35987: PiiGAB M-Bus contains hard-coded credentials which it uses for authentication.
Key phrases: hard-coded credentials, hard coded credentials
CVE-2023-35989: An integer overflow vulnerability exists in the LXT2 zlib block allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
Key phrases: integer overflow, arbitrary code execution
CVE-2023-3599: A vulnerability was found in SourceCodester Best Fee Management System 1.0. It has been rated as critical. Affected by this issue is the function save_user of the file admin_class.php of the component Add User Handler. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-233450 is the identifier assigned to this vulnerability.
Key phrases: improper access control
CVE-2023-35990: The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. An app may be able to identify what other apps a user has installed.
CVE-2023-35991: Hidden functionality vulnerability in LOGITEC wireless LAN routers allows an unauthenticated attacker to log in to the product's certain management console and execute arbitrary OS commands. Affected products and versions are as follows: LAN-W300N/DR all versions, LAN-WH300N/DR all versions, LAN-W300N/P all versions, LAN-WH450N/GP all versions, LAN-WH300AN/DGP all versions, LAN-WH300N/DGP all versions, and LAN-WH300ANDGPE all versions.
Key phrases: execute arbitrary OS commands, log in to the product's certain management, hidden functionality, arbitrary os command
CVE-2023-35992: An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.
Key phrases: integer overflow, memory corruption
CVE-2023-35993: A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code, use-after-free issue, use after free
CVE-2023-35994: Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta initialization part.
Key phrases: improper array index validation, arbitrary code execution
CVE-2023-35995: Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 1.
Key phrases: improper array index validation, arbitrary code execution
CVE-2023-35996: Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 0.
Key phrases: improper array index validation, arbitrary code execution
CVE-2023-35997: Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 2 or more.
Key phrases: improper array index validation, arbitrary code execution
CVE-2023-35998: A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
Key phrases: obtain a valid agent authentication token. All versions, missing authorization
CVE-2023-3600: During the worker lifecycle, a use-after-free condition could have occured, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.
Key phrases: use-after-free condition, exploitable crash, use after free
CVE-2023-36000: A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to obtain sensitive information. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
Key phrases: obtain sensitive information, obtain a valid agent authentication token. All versions, missing authorization
CVE-2023-36002: A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.
Key phrases: authorization check, missing authorization
CVE-2023-36003: XAML Diagnostics Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36004: Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-36005: Windows Telephony Server Elevation of Privilege Vulnerability
Key phrases: windows telephony server elevation of privilege
CVE-2023-36006: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36007: Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
Key phrases: dynamics spoofing
CVE-2023-36008: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36009: Microsoft Word Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-3601: The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.
Key phrases: arbitrary user information disclosure
CVE-2023-36010: Microsoft Defender Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-36011: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36012: DHCP Server Service Information Disclosure Vulnerability
Key phrases: dhcp server service information disclosure
CVE-2023-36013: PowerShell Information Disclosure Vulnerability
Key phrases: powershell information disclosure
CVE-2023-36014: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36016: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-36017: Windows Scripting Engine Memory Corruption Vulnerability
Key phrases: windows scripting engine memory corruption
CVE-2023-36018: Visual Studio Code Jupyter Extension Spoofing Vulnerability
Key phrases: visual studio code jupyter extension spoofing
CVE-2023-36019: Microsoft Power Platform Connector Spoofing Vulnerability
Key phrases: connector spoofing
CVE-2023-36020: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-36021: Microsoft On-Prem Data Gateway Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-36022: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36024: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36025: Windows SmartScreen Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows smartscreen security feature bypass
CVE-2023-36026: Microsoft Edge (Chromium-based) Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-36027: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36028: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36029: Microsoft Edge (Chromium-based) Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-3603: A missing allocation check in sftp server processing read requests may cause a NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which was not being checked for failure. This will likely crash the authenticated user's sftp server connection (if implemented as forking as recommended). For thread-based servers, this might also cause DoS for legitimate users.Given this code is not in any released versions, no security releases have been issued.
Key phrases: null dereference, dos, crash
CVE-2023-36030: Microsoft Dynamics 365 Sales Spoofing Vulnerability
Key phrases: sales spoofing
CVE-2023-36031: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-36033: Windows DWM Core Library Elevation of Privilege Vulnerability
Key phrases: windows dwm core library elevation of privilege
CVE-2023-36034: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36035: Microsoft Exchange Server Spoofing Vulnerability
Key phrases: microsoft exchange server spoofing
CVE-2023-36036: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows cloud files mini filter driver elevation of privilege
CVE-2023-36037: Microsoft Excel Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, microsoft excel security feature bypass
CVE-2023-36038: ASP.NET Core Denial of Service Vulnerability
Key phrases: asp.net core denial of service
CVE-2023-36039: Microsoft Exchange Server Spoofing Vulnerability
Key phrases: microsoft exchange server spoofing
CVE-2023-3604: The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered.
CVE-2023-36041: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2023-36042: Visual Studio Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-36043: Open Management Infrastructure Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-36045: Microsoft Office Graphics Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36046: Windows Authentication Denial of Service Vulnerability
Key phrases: windows authentication denial of service
CVE-2023-36047: Windows Authentication Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36049: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Key phrases: visual studio elevation of privilege
CVE-2023-3605: A vulnerability was found in PHPGurukul Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Registration Page. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233467.
CVE-2023-36050: Microsoft Exchange Server Spoofing Vulnerability
Key phrases: microsoft exchange server spoofing
CVE-2023-36052: Azure CLI REST Command Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-36053: In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Key phrases:  ReDoS (regular expression denial of service), redos
CVE-2023-36054: lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.
Key phrases: uninitialized pointer, kadmind crash
CVE-2023-3606: A vulnerability was found in TamronOS up to 20230703. It has been classified as critical. This affects an unknown part of the file /api/ping. The manipulation of the argument host leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233475. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: os command injection, disclosure
CVE-2023-3607: A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of the component WebConsole Plug-In. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233476. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: os command injection, disclosure
CVE-2023-36076: SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php.
Key phrases: execute arbitrary code, gain sensitive information, execute arbitrary code and gain sensitive information via, sql injection
CVE-2023-3608: A vulnerability was found in Ruijie BCR810W 2.5.10. It has been rated as critical. This issue affects some unknown processing of the component Tracert Page. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233477 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: os command injection, disclosure
CVE-2023-36081: Cross Site Scripting vulnerability in GatesAIr Flexiva FM Transmitter/Exciter v.FAX 150W allows a remote attacker to execute arbitrary code via a crafted script to the web application dashboard.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-36082: An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials.
Key phrases: gain privileges, gain privileges via the LDAP and SMTP credentials, smtp credentials
CVE-2023-36085: The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to phishing attacks, malware distribution, and unauthorized access to sensitive resources.
Key phrases: host header injection, phishing, malware distribution, unauthorized access to sensitive resources
CVE-2023-36088: Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.
Key phrases: gain sensitive information, server side request forgery (ssrf)
CVE-2023-36089: Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: Authentication Bypass, gain escalated privileges, gain escalated privileges via function phpcgi_main in cgibin, authentication bypass, escalate privilege
CVE-2023-3609: A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
Key phrases: use-after-free, local privilege escalation, use after free
CVE-2023-36090: Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: Authentication Bypass, gain escalated privileges, gain escalated privileges via phpcgi, authentication bypass, affects products, escalate privilege
CVE-2023-36091: Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: Authentication Bypass, gain escalated privileges, gain escalated privileges via via function phpcgi_main in, authentication bypass, escalate privilege
CVE-2023-36092: Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: Authentication Bypass, gain escalated privileges, gain escalated privileges via via phpcgi_main, authentication bypass, escalate privilege
CVE-2023-36093: There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3
Key phrases: storage type cross site scripting (xss)
CVE-2023-36095: An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.
Key phrases: execute arbitrary code, execute arbitrary code via the python exec calls
CVE-2023-36097: funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
Key phrases: insecure file upload
CVE-2023-3610: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered.We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.
Key phrases: use-after-free, local privilege escalation, use after free
CVE-2023-36100: An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser.
Key phrases: gain sensitive information, escalate privileges and gain sensitive information via UserID
CVE-2023-36106: An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list.
Key phrases: obtain sensitive information, obtain sensitive information via the interface for querying, incorrect access control
CVE-2023-36109: Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_raw component at /jerry-core/ecma/base/ecma-helpers-string.c.
Key phrases: execute arbitrary code, execute arbitrary code via ecma_stringbuilder_append_raw component at /jerry, buffer overflow
CVE-2023-3611: An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.
Key phrases: packet sizes without bounds checks, out-of-bounds write, local privilege escalation, out of bounds write
CVE-2023-36118: Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the page parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting
CVE-2023-3612: Govee Home app has unprotected access to WebView component which can be opened by any app onthe device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView orsteal sensitive user data by displaying phishing content. 
Key phrases: unprotected access, sensitive user data
CVE-2023-36121: Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project.
Key phrases: execute arbitrary code, execute arbitrary code via the description function in, cross site scripting
CVE-2023-36123: Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code and gain sensitive information.
Key phrases: execute arbitrary code, gain sensitive information, execute arbitrary code and gain sensitive information, directory traversal
CVE-2023-36126: There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0
Key phrases: cross site scripting (xss)
CVE-2023-36127: User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Key phrases: determine if the user is valid or not, user enumeration
CVE-2023-3613: Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowingguest accounts to be added or invited to channels by default.
CVE-2023-36131: PHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation of password parameter.
Key phrases: incorrect access control, improper input validation
CVE-2023-36132: PHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control.
Key phrases: incorrect access control
CVE-2023-36133: PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change.
Key phrases: user account takeover, username password change
CVE-2023-36134: In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
Key phrases: take over accounts, lack of verification
CVE-2023-36135: User enumeration is found in in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Key phrases: determine if the user is valid or not, user enumeration
CVE-2023-36136: PHPJabbers Class Scheduling System 1.0 lacks encryption on the password when editing a user account (update user page) allowing an attacker to capture all user names and passwords in clear text.
Key phrases: capture all user names and passwords in clear, encryption, clear text
CVE-2023-36137: There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0.
Key phrases: cross site scripting (xss)
CVE-2023-36138: PHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.
Key phrases: cross site scripting (xss)
CVE-2023-36139: In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
Key phrases: take over accounts, verification
CVE-2023-3614: Mattermost fails to properly validate a gif image file, allowing an attacker toconsume a significant amount of server resources, making the server unresponsive for an extended period of time bylinking to specially crafted image file.
Key phrases: specially crafted image file, unresponsive
CVE-2023-36140: In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts.
Key phrases: gain access, gain access to all user accounts, encryption
CVE-2023-36141: User enumeration is found in in PHPJabbers Cleaning Business Software 1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Key phrases: determine if the user is valid or not, user enumeration
CVE-2023-36143: Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device.
Key phrases: os command injection
CVE-2023-36144: An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.
Key phrases: bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows, authentication bypass, download the backup file of the device, critical information
CVE-2023-36146: A Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733.
Key phrases: stored cross-site scripting (xss)
CVE-2023-3615: Mattermost iOS app failsto properlyvalidate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection.
Key phrases: intercept the WebSockets connection
CVE-2023-36158: Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on the My Account page.
Key phrases: run arbitrary code, run arbitrary code via the First Name and, cross site scripting (xss)
CVE-2023-36159: Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page.
Key phrases: run arbitrary code, run arbitrary code via the First Name, cross site scripting (xss)
CVE-2023-3616: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mava Software Hotel Management System allows SQL Injection.This issue affects Hotel Management System: before 2.0.
Key phrases: SQL Injection, sql command, sql injection
CVE-2023-36160: An issue was discovered in Qubo Smart Plug10A version HSP02_01_01_14_SYSTEM-10 A, allows local attackers to gain sensitive information and other unspecified impact via UART console.
Key phrases: gain sensitive information, gain sensitive information and other unspecified impact via, uart console
CVE-2023-36161: An issue was discovered in Qubo Smart Plug 10A version HSP02_01_01_14_SYSTEM-10A, allows attackers to cause a denial of service (DoS) via Wi-Fi deauthentication.
Key phrases: denial of service (DoS), cause a denial of service (DoS), denial of service (dos), wi-fi deauthentication
CVE-2023-36162: Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php.
Key phrases: gain privileges, gain privileges via the add function in adminlist.php, cross site request forgery
CVE-2023-36163: Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code via a crafted script to the mc parameter of the URL.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-3617: A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin_class.php of the component Login Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233565 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-36177: An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.
Key phrases: execute arbitrary code, gain sensitive information, execute arbitrary code and gain sensitive information via
CVE-2023-3618: A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.
Key phrases: buffer overflow, denial of service, segmentation fault
CVE-2023-36183: Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code and obtain sensitive information via, buffer overflow
CVE-2023-36184: CMysten Labs Sui blockchain v1.2.0 was discovered to contain a stack overflow via the component /spec/openrpc.json.
Key phrases: stack overflow
CVE-2023-36187: Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code via crafted URL to httpd.
Key phrases: execute arbitrary code, execute arbitrary code via crafted URL to httpd, buffer overflow
CVE-2023-36188: An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.
Key phrases: execute arbitrary code, execute arbitrary code via the PALChain parameter in
CVE-2023-36189: SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.
Key phrases: obtain sensitive information, obtain sensitive information via the SQLDatabaseChain component, sql injection
CVE-2023-3619: A vulnerability was found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This issue affects some unknown processing of the file Master.php?f=save_service of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The identifier VDB-233573 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-36192: Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_ws_check_packet at /src/capture.c.
Key phrases: heap buffer overflow
CVE-2023-36193: Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.
Key phrases: heap buffer overflow
CVE-2023-36198: Buffer Overflow vulnerability in skalenetwork sgxwallet v.1.9.0 allows an attacker to cause a denial of service via the trustedBlsSignMessage function.
Key phrases: cause a denial of service via the trustedBlsSignMessage, buffer overflow
CVE-2023-36199: An issue in skalenetwork sgxwallet v.1.9.0 and below allows an attacker to cause a denial of service via the trustedGenerateEcdsaKey component.
Key phrases: cause a denial of service via the trustedGenerateEcdsaKey
CVE-2023-3620: Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.
Key phrases: cross-site scripting (xss)
CVE-2023-36201: An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted script to the arrays.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted script to
CVE-2023-3621: A vulnerability was found in IBOS OA 4.5.5. It has been classified as critical. Affected is the function createDeleteCommand of the file ?r=article/default/delete of the component Delete Packet. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-233574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: sql injection, disclosure
CVE-2023-36210: MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keyword parameter.
Key phrases: server-side template injection (ssti)
CVE-2023-36211: The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel.
Key phrases: stored cross-site scripting (xss)
CVE-2023-36212: File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page function.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, file upload
CVE-2023-36213: SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function.
Key phrases: gain privileges, gain privileges via the keyword parameter of the, sql injection
CVE-2023-36217: Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 allows a remote attacker to execute arbitrary code via the category name field of the image manager function.
Key phrases: execute arbitrary code, execute arbitrary code via the category name field, cross site scripting
CVE-2023-3622:  Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource 
Key phrases: read arbitrary resource,  Access Control Bypass, access control bypass
CVE-2023-36220: Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function.
Key phrases: execute arbitrary code, gain access, execute arbitrary code and gain access to sensitive, directory traversal, sensitive information, access sensitive information
CVE-2023-36222: Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting
CVE-2023-36223: Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting
CVE-2023-3623: A vulnerability was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230704. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Duty/AjaxHandle/UploadHandler.ashx of the component Duty Module. The manipulation of the argument Filedata leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233576. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: unrestricted upload, disclosure
CVE-2023-36234: Cross Site Scripting (XSS) vulnerability in Netbox 3.5.1, allows attackers to execute arbitrary code via Name field in device-roles/add function.
Key phrases: execute arbitrary code, execute arbitrary code via Name field in device, cross site scripting (xss)
CVE-2023-36235: An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter.
Key phrases: obtain sensitive information, obtain sensitive information via the id_order parameter
CVE-2023-36236: Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted SVG file, cross site scripting
CVE-2023-36237: Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted HTML script, cross site request forgery
CVE-2023-36238: Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter.
Key phrases: obtain sensitive information, obtain sensitive information via the invoice ID parameter, insecure direct object reference (idor)
CVE-2023-36239: libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c.
Key phrases: buffer overflow
CVE-2023-3624: A vulnerability classified as critical has been found in Nesote Inout Blockchain FiatExchanger 3.0. This affects an unknown part of the file /index.php/coins/update_marketboxslider of the component POST Parameter Handler. The manipulation of the argument marketcurrency leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-233577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: sql injection, disclosure
CVE-2023-36243: FLVMeta v1.2.1 was discovered to contain a buffer overflow via the xml_on_metadata_tag_only function at dump_xml.c.
Key phrases: buffer overflow
CVE-2023-3625: A vulnerability classified as critical was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This vulnerability affects unknown code of the file /Duty/AjaxHandle/Write/UploadFile.ashx of the component Duty Write-UploadFile. The manipulation of the argument Filedata leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-233578 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: unrestricted upload, disclosure
CVE-2023-36250: CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.
Key phrases: execute arbitrary code, execute arbitrary code via crafted .tsv file when, csv injection
CVE-2023-36252: An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via a the session expiration function.
Key phrases: execute arbitrary code, execute arbitrary code and cause a denial of, denial of service, session expiration function
CVE-2023-36255: An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.
Key phrases: execute arbitrary code, execute arbitrary code via the path parameter in
CVE-2023-36256: The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent. The email of the user to be deleted is passed as a parameter in the URL, which can be manipulated by the attacker. This could result in a loss of data.
Key phrases: cross-site request forgery (csrf), loss of data
CVE-2023-36258: An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.
Key phrases: execute arbitrary code, execute arbitrary code because Python code with os.system
CVE-2023-36259: Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.
Key phrases: execute arbitrary code, execute arbitrary code during user creation, cross site scripting (xss)
CVE-2023-3626: A vulnerability, which was classified as critical, has been found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This issue affects some unknown processing of the file /Duty/AjaxHandle/UpLoadFloodPlanFile.ashx of the component UpLoadFloodPlanFile. The manipulation of the argument Filedata leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233579. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: unrestricted upload, disclosure
CVE-2023-36260: An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security."
Key phrases: denial of service (DoS), cause a denial of service (DoS), denial of service (dos)
CVE-2023-36263: Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Key phrases: sql injection
CVE-2023-36266: An issue was discovered in Keeper Password Manager for Desktop version 16.10.2, and the KeeperFill Browser Extensions version 16.5.4, allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information).
Key phrases: gain sensitive information, gain sensitive information via plaintext password storage in
CVE-2023-3627: Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.
Key phrases: cross-site request forgery (csrf)
CVE-2023-36271: LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_wcs2nlen at bits.c.
Key phrases: heap buffer overflow
CVE-2023-36272: LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_utf8_to_TU at bits.c.
Key phrases: heap buffer overflow
CVE-2023-36273: LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c.
Key phrases: heap buffer overflow
CVE-2023-36274: LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_write_TF at bits.c.
Key phrases: heap buffer overflow
CVE-2023-3628: A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Key phrases: access information outside of their intended permissions
CVE-2023-36281: An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a template.
Key phrases: execute arbitrary code, execute arbitrary code via a JSON file to
CVE-2023-36284: An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database.
Key phrases: bypass a web application's authentication, bypass a web application's authentication and authorization, time-based sql injection
CVE-2023-36287: An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.
Key phrases: obtain a user's session cookie and then impersonate, cross-site scripting (xss)
CVE-2023-36288: An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.
Key phrases: obtain a user's session cookie and then impersonate, cross-site scripting (xss)
CVE-2023-36289: An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter.
Key phrases: obtain a user's session cookie and then impersonate, cross-site scripting (xss)
CVE-2023-3629: A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Key phrases: access information outside of their intended permissions
CVE-2023-36291: Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file.
Key phrases: execute arbitrary code, execute arbitrary code via the f_content parameter in, cross site scripting
CVE-2023-36293: SQL injection vulnerability in wmanager v.1.0.7 and before allows a remote attacker to obtain sensitive information via a crafted script to the company.php component.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted script to, sql injection
CVE-2023-36298: DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE).
Key phrases: file upload, remote code execution (rce)
CVE-2023-36299: A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and options-general parameters in index.php.
Key phrases: execute arbitrary code, execute arbitrary code via the upload and options, file upload
CVE-2023-36301: Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet.
Key phrases: directory traversal
CVE-2023-36306: A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components.
Key phrases: execute arbitrary code, execute arbitrary code via the asktheoracle.php, cross site scripting (xss)