yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-49085: Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.
Key phrases: execute arbitrary SQL code, arbitrary sql code, code execution
CVE-2023-49086: Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). Bypassing an earlier fix (CVE-2023-39360) that leads to a DOM XSS attack.Exploitation of the vulnerability is possible for an authorized user. The vulnerable component isthe `graphs_new.php`. Impact of the vulnerability - execution of arbitrary javascript code inthe attacked user's browser. This issue has been patched in version 1.2.26.
Key phrases: dom xss, execution of arbitrary javascript code
CVE-2023-49087: xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13.
CVE-2023-49088: Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.
Key phrases: cross-site scripting
CVE-2023-49089: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.
Key phrases: path traversal
CVE-2023-4909: Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
CVE-2023-49090: CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.
Key phrases: bypass, content-type allowlist bypass, xss, file upload
CVE-2023-49091: Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an attacker to use the token to gain unauthorized access to the application/system even after the user has logged out. This issue has been patched in version 0.13.0.
Key phrases: gain unauthorized access, use the token to gain unauthorized access to
CVE-2023-49092: RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is currently no fix available. As a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer.
Key phrases: non-constant-time implementation, timing information
CVE-2023-49093: HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attackers webpage. This vulnerability has been patched in version 3.9.0
Key phrases: remote code execution (rce)
CVE-2023-49094: Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if they have an account on Sentry instance. The issue has been fixed in the release 23.11.2.
Key phrases: send arbitrary GET HTTP requests
CVE-2023-49095: nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.
Key phrases: impersonate another user in certain circumstances, insufficient validation
CVE-2023-49096: Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifically the `/Videos/<itemId>/stream` and `/Videos/<itemId>/stream.<container>` endpoints which are present in the current Jellyfin version. Additional endpoints in the AudioController might also be vulnerable, as they differ only slightly in execution. Those endpoints are reachable by an unauthenticated user. In order to exploit this vulnerability an unauthenticated attacker has to guess an itemId, which is a completely random GUID. Its a very unlikely case even for a large media database with lots of items. Without an additional information leak, this vulnerability shouldnt be directly exploitable, even if the instance is reachable from the Internet. There are a lot of query parameters that get accepted by the method. At least two of those, videoCodec and audioCodec are vulnerable to the argument injection. The values can be traced through a lot of code and might be changed in the process. However, the fallback is to always use them as-is, which means we can inject our own arguments. Those arguments land in the command line of FFmpeg. Because UseShellExecute is always set to false, we cant simply terminate the FFmpeg command and execute our own. It should only be possible to add additional arguments to FFmpeg, which is powerful enough as it stands. There is probably a way of overwriting an arbitrary file with malicious content. This vulnerability has been addressed in version 10.8.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: argument injection, information leak, overwrite arbitrary files
CVE-2023-49097: ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwordless enabled can not be taken over by this attack. This issue has been patched in versions 2.41.6, 2.40.10 and 2.39.9.
CVE-2023-49098: Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.
Key phrases: add their reactions to the post
CVE-2023-49099: Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.
Key phrases: secure upload urls
CVE-2023-4910: A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.
CVE-2023-49100: Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0 through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is possible. An attacker can still crash TF-A, however.
Key phrases: issue arbitrary SMC calls, read out-of-bounds, leak, crash
CVE-2023-49101: WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewing the usage of SSL certificates.
Key phrases: XSS attacks against admins because of mishandling of, xss
CVE-2023-49102: NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions. An attacker with the Control capability can execute a file by setting the value of SevenZipCommand or UnrarCmd. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: authenticated remote code execution because the unarchive programs, affects products
CVE-2023-49103: An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
Key phrases: credential disclosure, credentials disclosure
CVE-2023-49104: An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker.
Key phrases: pass in a crafted redirect-url that, redirect callbacks to a Top Level Domain controlled
CVE-2023-49105: An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
Key phrases: pre-signed urls
CVE-2023-49106: Missing Password Field Masking vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent component).This issue affects Hitachi Device Manager: before 8.8.5-04.
Key phrases: missing password field masking
CVE-2023-49107: Generation of Error Message Containing Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent modules).This issue affects Hitachi Device Manager: before 8.8.5-04.
Key phrases: error message containing sensitive information
CVE-2023-49108: Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 (excluding Ver.6.1.1.3a). If this vulnerability is exploited, arbitrary files on the server may be obtained or deleted by a user of the product with specific privileges.
Key phrases: path traversal, arbitrary file
CVE-2023-49109: Exposure of Remote Code Execution in Apache Dolphinscheduler.This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue. 
Key phrases: exposure of remote code execution
CVE-2023-4911: A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Key phrases: use maliciously crafted GLIBC_TUNABLES environment variables when launching, buffer overflow, elevated privileges, execute code, elevate privileges
CVE-2023-49114: A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if somespecific pre-conditions are met.
Key phrases: execute arbitrary code, obtain higher privileges, execute arbitrary code and obtain higher privileges via, dll hijacking
CVE-2023-49115: MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.
Key phrases: unauthenticated mqtt messaging
CVE-2023-49117: PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.
Key phrases: cross-site scripting, arbitrary script
CVE-2023-49118: in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read.
Key phrases: a local attacker causes information leak through out, out-of-bounds read, out of bounds read
CVE-2023-49119: Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Key phrases: cross-site scripting, arbitrary script
CVE-2023-4912: An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input.
Key phrases: client-side denial of service
CVE-2023-49121: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, heap-based buffer overflow, heap based buffer overflow
CVE-2023-49122: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, heap-based buffer overflow, heap based buffer overflow
CVE-2023-49123: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, heap-based buffer overflow, heap based buffer overflow
CVE-2023-49124: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-49125: A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.263), Parasolid V35.1 (All versions < V35.1.252), Parasolid V36.0 (All versions < V36.0.198), Solid Edge (All versions < V223.0.11). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted files containing XT format. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-49126: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-49127: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-49128: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-49129: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, stack overflow
CVE-2023-4913: Cross-site Scripting (XSS) - Reflected in GitHub repository cecilapp/cecil prior to 7.47.1.
Key phrases: cross-site scripting (xss)
CVE-2023-49130: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
Key phrases: uninitialized pointer access, execute code
CVE-2023-49131: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
Key phrases: uninitialized pointer access, execute code
CVE-2023-49132: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
Key phrases: uninitialized pointer access, execute code
CVE-2023-49135: in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer.
Key phrases: a local attacker cause multimedia player crash through, released pointer
CVE-2023-4914: Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1.
Key phrases: relative path traversal
CVE-2023-49140: Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.
Key phrases: denial-of-service (dos), denial of service
CVE-2023-49142: in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia audio crash through modify a released pointer.
Key phrases: a local attacker cause multimedia audio crash through, released pointer
CVE-2023-49143: Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.
Key phrases: denial-of-service (dos), denial of service
CVE-2023-49145: Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitraryJavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.
Key phrases: dom-based cross-site scripting
CVE-2023-49146: DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions.
Key phrases: XSS via an SVG document because of mishandling, xss
CVE-2023-49147: An issue was discovered in PDF24 Creator 11.14.0. The configuration of the msi installer file was found to produce a visible cmd.exe window when using the repair function of msiexec.exe. This allows an unprivileged local attacker to use a chain of actions (e.g., an oplock on faxPrnInst.log) to open a SYSTEM cmd.exe.
Key phrases: use a chain of actions (e.g.
CVE-2023-49148: Cross-Site Request Forgery (CSRF) vulnerability in Kulwant Nagi Affiliate Booster  Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affiliate Booster  Pros & Cons, Notice, and CTA Blocks for Affiliates: from n/a through 3.0.5.
Key phrases: cross-site request forgery (csrf)
CVE-2023-49149: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Currency Converter Calculator allows Stored XSS.This issue affects Currency Converter Calculator: from n/a through 1.3.1.
Key phrases: Stored XSS.This issue affects Currency Converter Calculator:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-4915: The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (in the WP User Control Widget). The function changes the user's password after providing the email. The new password is only sent to the user's email, so the attacker does not have access to the new password.
Key phrases: unauthorized password resets
CVE-2023-49150: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored XSS.This issue affects Crypto Converter Widget: from n/a through 1.8.1.
Key phrases: Stored XSS.This issue affects Crypto Converter Widget:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49151: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Calendar Simple Calendar  Google Calendar Plugin allows Stored XSS.This issue affects Simple Calendar  Google Calendar Plugin: from n/a through 3.2.6.
Key phrases: Stored XSS.This issue affects Simple Calendar  Google, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49152: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labs64 Credit Tracker allows Stored XSS.This issue affects Credit Tracker: from n/a through 1.1.17.
Key phrases: Stored XSS.This issue affects Credit Tracker: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49153: Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon.This issue affects Add to Cart Text Changer and Customize Button, Add Custom Icon: from n/a through 2.0.
Key phrases: cross-site request forgery (csrf)
CVE-2023-49155: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator  easily Button Builder.This issue affects Button Generator  easily Button Builder: from n/a through 2.3.8.
Key phrases: cross-site request forgery (csrf)
CVE-2023-49157: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andreas Mnch Multiple Post Passwords allows Stored XSS.This issue affects Multiple Post Passwords: from n/a through 1.1.1.
Key phrases: Stored XSS.This issue affects Multiple Post Passwords:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49159: Server-Side Request Forgery (SSRF) vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4.
Key phrases: server-side request forgery (ssrf)
CVE-2023-4916: The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthenticated attackers to change user password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-49160: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in formzu Inc. Formzu WP allows Stored XSS.This issue affects Formzu WP: from n/a through 1.6.6.
Key phrases: Stored XSS.This issue affects Formzu WP: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49161: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Guelben Bravo Translate.This issue affects Bravo Translate: from n/a through 1.2.
Key phrases: sql command, sql injection
CVE-2023-49162: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BigCommerce BigCommerce For WordPress.This issue affects BigCommerce For WordPress: from n/a through 5.0.6.
Key phrases: exposure of sensitive information
CVE-2023-49163: Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.5.
Key phrases: cross-site request forgery (csrf)
CVE-2023-49164: Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2.
Key phrases: cross-site request forgery (csrf)
CVE-2023-49165: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Real Big Plugins Client Dash allows Stored XSS.This issue affects Client Dash: from n/a through 2.2.1.
Key phrases: Stored XSS.This issue affects Client Dash: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49166: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0.
Key phrases: sql command, sql injection
CVE-2023-49168: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages  Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss allows Stored XSS.This issue affects Better Messages  Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: from n/a through 2.4.0.
Key phrases: Stored XSS.This issue affects Better Messages  Live, cross-site scripting, stored xss
CVE-2023-49169: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in datafeedr.Com Ads by datafeedr.Com allows Stored XSS.This issue affects Ads by datafeedr.Com: from n/a through 1.2.0.
Key phrases: Stored XSS.This issue affects Ads by datafeedr, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-4917: The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leyka_ajax_get_env_and_options' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more keys and passwords.
Key phrases: extract sensitive data including Sberbank API key and, sensitive information exposure
CVE-2023-49170: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captainform Forms by CaptainForm  Form Builder for WordPress allows Reflected XSS.This issue affects Forms by CaptainForm  Form Builder for WordPress: from n/a through 2.5.3.
Key phrases: Reflected XSS.This issue affects Forms by CaptainForm  , cross-site scripting, reflected xss
CVE-2023-49171: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs Innovs HR  Complete Human Resource Management System for Your Business allows Reflected XSS.This issue affects Innovs HR  Complete Human Resource Management System for Your Business: from n/a through 1.0.3.4.
Key phrases: Reflected XSS.This issue affects Innovs HR  Complete, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-49172: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BrainCert BrainCert  HTML5 Virtual Classroom allows Reflected XSS.This issue affects BrainCert  HTML5 Virtual Classroom: from n/a through 1.30.
Key phrases: Reflected XSS.This issue affects BrainCert  HTML5 Virtual, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-49173: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10to8 Sign In Scheduling Online Appointment Booking System allows Stored XSS.This issue affects Sign In Scheduling Online Appointment Booking System: from n/a through 1.0.9.
Key phrases: Stored XSS.This issue affects Sign In Scheduling Online, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49174: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored XSS.This issue affects Responsive Lightbox & Gallery: from n/a through 2.4.5.
Key phrases: Stored XSS.This issue affects Responsive Lightbox & Gallery, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49175: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreativo Pro KP Fastest Tawk.To Chat allows Stored XSS.This issue affects KP Fastest Tawk.To Chat: from n/a through 1.1.1.
Key phrases: Chat: from n/a through 1.1.1, cross-site scripting, stored xss
CVE-2023-49176: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution WP Pocket URLs allows Reflected XSS.This issue affects WP Pocket URLs: from n/a through 1.0.2.
Key phrases: Reflected XSS.This issue affects WP Pocket URLs:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-49177: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gilles Dumas which template file allows Reflected XSS.This issue affects which template file: from n/a through 4.9.0.
Key phrases: Reflected XSS.This issue affects which template file:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-49178: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr. Hdwplayer HDW Player Plugin (Video Player & Video Gallery) allows Reflected XSS.This issue affects HDW Player Plugin (Video Player & Video Gallery): from n/a through 5.0.
Key phrases: Reflected XSS.This issue affects HDW Player Plugin (, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-49179: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Open Useful and Simple Event post allows Stored XSS.This issue affects Event post: from n/a through 5.8.6.
Key phrases: Stored XSS.This issue affects Event post: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-4918: A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.
Key phrases: retrieve the users passwords in clear text, jeopardizing
CVE-2023-49180: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ternstyle LLC Automatic Youtube Video Posts Plugin allows Stored XSS.This issue affects Automatic Youtube Video Posts Plugin: from n/a through 5.2.2.
Key phrases: Stored XSS.This issue affects Automatic Youtube Video Posts, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49181: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP Event Manager  Events Calendar, Registrations, Sell Tickets with WooCommerce allows Stored XSS.This issue affects WP Event Manager  Events Calendar, Registrations, Sell Tickets with WooCommerce: from n/a through 3.1.40.
Key phrases: Stored XSS.This issue affects WP Event Manager  , cross-site scripting, stored xss
CVE-2023-49182: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Marzocca List all posts by Authors, nested Categories and Titles allows Reflected XSS.This issue affects List all posts by Authors, nested Categories and Titles: from n/a through 2.7.10.
Key phrases: Reflected XSS.This issue affects List all posts by, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-49183: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NextScripts NextScripts: Social Networks Auto-Poster allows Reflected XSS.This issue affects NextScripts: Social Networks Auto-Poster: from n/a through 4.4.2.
Key phrases: Reflected XSS.This issue affects NextScripts: Social Networks, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-49184: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Parallax Slider Block allows Stored XSS.This issue affects Parallax Slider Block: from n/a through 1.2.4.
Key phrases: Stored XSS.This issue affects Parallax Slider Block:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49185: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder WP & WooCommerce Search allows Reflected XSS.This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.1.7.
Key phrases: Reflected XSS.This issue affects Doofinder WP & WooCommerce, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-49187: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allows Reflected XSS.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
Key phrases: Reflected XSS.This issue affects Adifier - Classified Ads, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-49188: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.This issue affects Track Geolocation Of Users Using Contact Form 7: from n/a through 1.4.
Key phrases: Stored XSS.This issue affects Track Geolocation Of Users, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49189: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Getsocial, S.A. Social Share Buttons & Analytics Plugin  GetSocial.Io allows Stored XSS.This issue affects Social Share Buttons & Analytics Plugin  GetSocial.Io: from n/a through 4.3.12.
Key phrases: Stored XSS.This issue affects Social Share Buttons &, cross-site scripting, stored xss
CVE-2023-4919: The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `iframe` shortcode in versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permission and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 4.6 and fully patched in version 4.7.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-49190: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chandra Shekhar Sahu Site Offline Or Coming Soon Or Maintenance Mode allows Stored XSS.This issue affects Site Offline Or Coming Soon Or Maintenance Mode: from n/a through 1.5.6.
Key phrases: Stored XSS.This issue affects Site Offline Or Coming, cross-site scripting, stored xss
CVE-2023-49191: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored XSS.This issue affects GDPR Cookie Consent by Supsystic: from n/a through 2.1.2.
Key phrases: Stored XSS.This issue affects GDPR Cookie Consent by, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49195: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages allows Stored XSS.This issue affects Nested Pages: from n/a through 3.2.6.
Key phrases: Stored XSS.This issue affects Nested Pages: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-49197: Cross-Site Request Forgery (CSRF) vulnerability in Apasionados, Apasionados del Marketing, NetConsulting DoFollow Case by Case.This issue affects DoFollow Case by Case: from n/a through 3.4.2.
Key phrases: cross-site request forgery (csrf)
CVE-2023-4920: The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_save_options function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additionally, input sanitization and escaping is insufficient resulting in the possibility of malicious script injection.
Key phrases: cross-site request forgery, malicious script injection
CVE-2023-49208: scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration.
Key phrases: buffer overflow
CVE-2023-4921: A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.
Key phrases: use-after-free, local privilege escalation, use after free
CVE-2023-49210: The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: command execution
CVE-2023-49213: The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings. The fixed versions are 3.10.2, 4.1.10, and 4.2.1.
Key phrases: execute arbitrary commands, execute arbitrary commands via crafted HTTP requests if, invalid sanitization
CVE-2023-49214: Usedesk before 1.7.57 allows chat template injection.
Key phrases: chat template injection
CVE-2023-49215: Usedesk before 1.7.57 allows filter reflected XSS.
Key phrases: filter reflected XSS, filter reflected xss
CVE-2023-49216: Usedesk before 1.7.57 allows profile stored XSS.
Key phrases: profile stored XSS, profile stored xss
CVE-2023-4922: The WPB Show Core WordPress plugin through 2.2 is vulnerable to a local file inclusion via the `path` parameter.
Key phrases: local file inclusion
CVE-2023-49225: A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section.
Key phrases: cross-site-scripting, cross-site scripting, arbitrary script
CVE-2023-49226: An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.
Key phrases: execute arbitrary commands, execute arbitrary commands as root, command injection
CVE-2023-49228: An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root.
Key phrases: execute arbitrary commands, execute arbitrary commands as root, hard-coded credentials, hard coded credentials
CVE-2023-49229: An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configuration.
Key phrases: obtain sensitive information, obtain sensitive information about the device configuration, authorization check
CVE-2023-4923: The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_delete function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery, delete products
CVE-2023-49230: An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication.
Key phrases: modify the portals' configurations without prior authentication, missing authorization check
CVE-2023-49231: An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token.
Key phrases: authentication bypass, receive an administrative API token
CVE-2023-49232: An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the password reset PINs of administrative users.
Key phrases: authentication bypass, brute-force the password reset PINs of
CVE-2023-49234: An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server.
Key phrases: access local server files and exfiltrate data to, xml external entity (xxe)
CVE-2023-49235: An issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Filtering of debug information is mishandled during use of popen. Consequently, an attacker can bypass validation and execute a shell command.
Key phrases: bypass validation
CVE-2023-49236: A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. This occurs because of lack of length validation during an sscanf of a user-entered scale field in the RTSP playback function of davinci.
Key phrases: stack-based buffer overflow, stack based buffer overflow, arbitrary commands, arbitrary command execution
CVE-2023-49237: An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to unpack language packs without strict filtering of URL strings.
Key phrases: command injection
CVE-2023-49238: In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.
Key phrases: gain access, non-unique initial system user password
CVE-2023-49239: Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: unauthorized access, service confidentiality
CVE-2023-4924: The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_bulkoperations_delete function. This makes it possible for authenticated attackers, with subscriber access or higher, to delete products.
Key phrases: missing authorization, delete products