yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-50811: An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the computer POST parameter related to the ID of a specific reception by POST HTTP request interception. Iterating that parameter, it has been possible to access to the application and take control of many other receptions in addition the assigned one.
Key phrases: modify the computer POST parameter related to the, post http request interception, control
CVE-2023-5082: The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it.
Key phrases: sql injection
CVE-2023-50822: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Currency.Wiki Currency Converter Widget  Exchange Rates allows Stored XSS.This issue affects Currency Converter Widget  Exchange Rates: from n/a through 3.0.2.
Key phrases: Stored XSS.This issue affects Currency Converter Widget  , improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50823: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wipeout Media CSS & JavaScript Toolbox allows Stored XSS.This issue affects CSS & JavaScript Toolbox: from n/a through 11.7.
Key phrases: Stored XSS.This issue affects CSS & JavaScript Toolbox, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50824: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Batt Insert or Embed Articulate Content into WordPress allows Stored XSS.This issue affects Insert or Embed Articulate Content into WordPress: from n/a through 4.3000000021.
Key phrases: Stored XSS.This issue affects Insert or Embed Articulate, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50825: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terrier Tenacity iframe Shortcode allows Stored XSS.This issue affects iframe Shortcode: from n/a through 2.0.
Key phrases: Stored XSS.This issue affects iframe Shortcode: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50826: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Freshlight Lab Menu Image, Icons made easy allows Stored XSS.This issue affects Menu Image, Icons made easy: from n/a through 3.10.
Key phrases: Stored XSS.This issue affects Menu Image, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50827: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Accredible Accredible Certificates & Open Badges allows Stored XSS.This issue affects Accredible Certificates & Open Badges: from n/a through 1.4.8.
Key phrases: Stored XSS.This issue affects Accredible Certificates & Open, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50828: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Vongries Ultimate Dashboard  Custom WordPress Dashboard allows Stored XSS.This issue affects Ultimate Dashboard  Custom WordPress Dashboard: from n/a through 3.7.11.
Key phrases: Stored XSS.This issue affects Ultimate Dashboard  Custom, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50829: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aerin Loan Repayment Calculator and Application Form allows Stored XSS.This issue affects Loan Repayment Calculator and Application Form: from n/a through 2.9.3.
Key phrases: Stored XSS.This issue affects Loan Repayment Calculator and, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50830: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seosbg Seos Contact Form allows Stored XSS.This issue affects Seos Contact Form: from n/a through 1.8.0.
Key phrases: Stored XSS.This issue affects Seos Contact Form:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50831: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY  Multi Currency for WooCommerce allows Stored XSS.This issue affects CURCY  Multi Currency for WooCommerce: from n/a through 2.2.0.
Key phrases: Stored XSS.This issue affects CURCY  Multi Currency, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50832: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mondula GmbH Multi Step Form allows Stored XSS.This issue affects Multi Step Form: from n/a through 1.7.13.
Key phrases: Stored XSS.This issue affects Multi Step Form:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50833: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.239.
Key phrases: Stored XSS.This issue affects Colibri Page Builder:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50834: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech WooCommerce Menu Extension allows Stored XSS.This issue affects WooCommerce Menu Extension: from n/a through 1.6.2.
Key phrases: Stored XSS.This issue affects WooCommerce Menu Extension:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50835: Cross-Site Request Forgery (CSRF) vulnerability in Praveen Goswami Advanced Category Template.This issue affects Advanced Category Template: from n/a through 0.1.
Key phrases: cross-site request forgery (csrf)
CVE-2023-50836: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28.
Key phrases: Stored XSS.This issue affects HTML Forms: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50837: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebFactory Ltd Login Lockdown  Protect Login Form.This issue affects Login Lockdown  Protect Login Form: from n/a through 2.06.
Key phrases: sql command, sql injection
CVE-2023-50838: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms  Ultimate Form Builder  Contact forms and much more.This issue affects NEX-Forms  Ultimate Form Builder  Contact forms and much more: from n/a through 8.5.5.
Key phrases: sql injection
CVE-2023-50839: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk  Best Help Desk & Support Plugin.This issue affects JS Help Desk  Best Help Desk & Support Plugin: from n/a through 2.8.1.
Key phrases: sql injection
CVE-2023-5084: Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.
Key phrases: cross-site scripting (xss)
CVE-2023-50840: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop, oplugins Booking Manager.This issue affects Booking Manager: from n/a through 2.1.5.
Key phrases: sql command, sql injection
CVE-2023-50841: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems BookingPress  Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress  Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.72.
Key phrases: sql command, sql injection
CVE-2023-50842: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig Calendar: from n/a through 1.2.1.
Key phrases: sql command, sql injection
CVE-2023-50843: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Clockwork Clockwork SMS Notfications.This issue affects Clockwork SMS Notfications: from n/a through 3.0.4.
Key phrases: sql command, sql injection
CVE-2023-50844: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in James Ward Mail logging  WP Mail Catcher.This issue affects Mail logging  WP Mail Catcher: from n/a through 2.1.3.
Key phrases: sql command, sql injection
CVE-2023-50845: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirectory  WordPress Business Directory Plugin, or Classified Directory.This issue affects GeoDirectory  WordPress Business Directory Plugin, or Classified Directory: from n/a through 2.3.28.
Key phrases: sql command, sql injection
CVE-2023-50846: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RegistrationMagic RegistrationMagic  Custom Registration Forms, User Registration, Payment, and User Login.This issue affects RegistrationMagic  Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.5.
Key phrases: sql injection
CVE-2023-50847: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3.
Key phrases: sql command, sql injection
CVE-2023-50848: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.34.0.
Key phrases: sql command, sql injection
CVE-2023-50849: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf  Export To Pdf Tool for WordPress.This issue affects E2Pdf  Export To Pdf Tool for WordPress: from n/a through 1.20.23.
Key phrases: sql command, sql injection
CVE-2023-5085: The Advanced Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'advMenu' shortcode in versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-50851: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar  Simply Schedule Appointments Booking Plugin.This issue affects Appointment Booking Calendar  Simply Schedule Appointments Booking Plugin: from n/a before 1.6.6.1.
Key phrases: sql command, sql injection
CVE-2023-50852: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.This issue affects Booking Calendar | Appointment Booking | BookIt: from n/a through 2.4.3.
Key phrases: sql command, sql injection
CVE-2023-50853: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Advanced Form Integration  Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms.This issue affects Advanced Form Integration  Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: from n/a through 1.75.0.
Key phrases: sql injection
CVE-2023-50854: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly Squirrly SEO - Advanced Pack.This issue affects Squirrly SEO - Advanced Pack: from n/a through 2.3.8.
Key phrases: sql command, sql injection
CVE-2023-50855: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sam Perrow Pre* Party Resource Hints.This issue affects Pre* Party Resource Hints: from n/a through 1.8.18.
Key phrases: sql command, sql injection
CVE-2023-50856: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit  Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits.This issue affects Funnel Builder for WordPress by FunnelKit  Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits: from n/a through 2.14.3.
Key phrases: sql injection
CVE-2023-50857: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.
Key phrases: sql injection
CVE-2023-50858: Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34.
Key phrases: cross-site request forgery (csrf)
CVE-2023-50859: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through 2.1.6.
Key phrases: Stored XSS.This issue affects WP Crowdfunding: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-5086: The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-50860: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Booking for Appointments and Events Calendar  Amelia allows Stored XSS.This issue affects Booking for Appointments and Events Calendar  Amelia: from n/a through 1.0.85.
Key phrases: Stored XSS.This issue affects Booking for Appointments and, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50861: Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY  Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY  Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3.
Key phrases: cross-site request forgery (csrf)
CVE-2023-50862: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the booking.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-50863: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the generateReceipt.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-50864: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelId' parameter of the hotelDetails.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-50865: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'city' parameter of the hotelSearch.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-50866: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginAction.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-50867: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the signupAction.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-50868: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
Key phrases: denial of service (CPU consumption for SHA-1 computations), cause a denial of service (CPU consumption, cpu consumption, random subdomain, certain situations
CVE-2023-5087: The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code.
Key phrases: malicious javascript
CVE-2023-50870: In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible
Key phrases: csrf
CVE-2023-50871: In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed
CVE-2023-50873: Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages.This issue affects Add Any Extension to Pages: from n/a through 1.4.
Key phrases: cross-site request forgery (csrf)
CVE-2023-50874: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll  Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll  Ajax Load More: from n/a through 6.1.0.1.
Key phrases: Stored XSS.This issue affects WordPress Infinite Scroll  , improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50875: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS  Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS  Online Courses, Quizzes, & Learning: from n/a through 4.17.0.
Key phrases: Stored XSS.This issue affects Sensei LMS  Online, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50878: Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API.This issue affects MStore API: from n/a through 4.10.1.
Key phrases: cross-site request forgery (csrf)
CVE-2023-50879: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS.This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784.
Key phrases: Stored XSS.This issue affects WordPress, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-5088: A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
Key phrases: reboot
CVE-2023-50880: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects BuddyPress: from n/a through 11.3.1.
Key phrases: Stored XSS.This issue affects BuddyPress: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50881: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager  Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager  Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.
Key phrases: Stored XSS.This issue affects Advanced Access Manager  , improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50886: Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7.
Key phrases: cross-site request forgery (csrf), incorrect authorization
CVE-2023-50889: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder  WordPress Page Builder allows Stored XSS.This issue affects Beaver Builder  WordPress Page Builder: from n/a through 2.7.2.
Key phrases: Stored XSS.This issue affects Beaver Builder  WordPress, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-5089: The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
Key phrases: access the login page
CVE-2023-50891: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Forms Form plugin for WordPress  Zoho Forms allows Stored XSS.This issue affects Form plugin for WordPress  Zoho Forms: from n/a through 3.0.1.
Key phrases: Stored XSS.This issue affects Form plugin for WordPress, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-50892: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS.This issue affects TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9.1.
Key phrases: Reflected XSS.This issue affects TheGem - Creative Multi, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-50893: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution Impreza  WordPress Website and WooCommerce Builder allows Reflected XSS.This issue affects Impreza  WordPress Website and WooCommerce Builder: from n/a through 8.17.4.
Key phrases: Reflected XSS.This issue affects Impreza  WordPress Website, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-50894: In Janitza GridVis through 9.0.66, use of hard-coded credentials in the de.janitza.pasw.feature.impl.activators.PasswordEncryption password encryption function allows remote authenticated administrative users to discover cleartext database credentials contained in error report information.
Key phrases: discover cleartext database credentials contained in error report, hard-coded credentials, hard coded credentials
CVE-2023-50895: In Janitza GridVis through 9.0.66, exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject project load functionality allow remote authenticated administrative users to execute arbitrary Groovy code.
Key phrases: execute arbitrary Groovy code, dangerous methods
CVE-2023-50896: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weForms weForms  Easy Drag & Drop Contact Form Builder For WordPress allows Stored XSS.This issue affects weForms  Easy Drag & Drop Contact Form Builder For WordPress: from n/a through 1.6.17.
Key phrases: Stored XSS.This issue affects weForms  Easy Drag, cross-site scripting, stored xss
CVE-2023-50898: Missing Authorization vulnerability in sirv.Com Sirv.This issue affects Sirv: from n/a through 7.1.2.
Key phrases: missing authorization
CVE-2023-5090: A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition.
Key phrases: host x2apic msrs when the guest resets its, denial of service condition
CVE-2023-50901: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Mega  Absolute Addons For Elementor allows Reflected XSS.This issue affects HT Mega  Absolute Addons For Elementor: from n/a through 2.3.8.
Key phrases: Reflected XSS.This issue affects HT Mega  Absolute, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-50902: Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.This issue affects New User Approve: from n/a through 2.5.1.
Key phrases: cross-site request forgery (csrf)
CVE-2023-50905: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1.
Key phrases: Stored XSS.This issue affects WP Activity Log:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-5091: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver allows alocal non-privileged user to make improper GPU processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r37p0 through r40p0.
Key phrases: gain access, make improper GPU processing operations to gain access, use after free
CVE-2023-50916: Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path. It allows administrators to configure the backup location of the database used by the application. Attempting to change this location to a UNC path via the GUI is rejected due to the use of a \\\\ (backslash) character, which is supposed to be disallowed in a pathname. Intercepting and modifying this request via a proxy, or sending the request directly to the application endpoint, allows UNC paths to be set for the backup location. Once such a location is set, Kyocera Device Manager attempts to confirm access and will try to authenticate to the UNC path; depending on the configuration of the environment, this may authenticate to the UNC with Windows NTLM hashes. This could allow NTLM credential relaying or cracking attacks.
Key phrases: a UNC path, configure the backup location of the database used, be set for the backup location, NTLM credential relaying or cracking attacks, ntlm credential exposure
CVE-2023-50917: MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
Key phrases: the Majordomo mailing-list manager, thumb.php shell metacharacters, command execution
CVE-2023-50918: app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.
CVE-2023-50919: An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
Key phrases: bypass via Lua string pattern matching. This affects A1300 4.4.6, authentication bypass, nginx authentication bypass
CVE-2023-50920: An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers to share session identifiers between different sessions and bypass authentication or access control measures. Attackers can impersonate legitimate users or perform unauthorized actions. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
Key phrases: bypass authentication, share session identifiers between different sessions and bypass, reboot, impersonate
CVE-2023-50921: An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
Key phrases: gain root privileges, add_user interface
CVE-2023-50922: An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory and waiting for its execution. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
Key phrases: execute arbitrary code, admintoken cookie
CVE-2023-50923: In QUIC in RFC 9000, the Latency Spin Bit specification (section 17.4) does not strictly constrain the bit value when the feature is disabled, which might allow remote attackers to construct a covert channel with data represented as changes to the bit value. NOTE: The "Sheridan, S., Keane, A. (2015). In Proceedings of the 14th European Conference on Cyber Warfare and Security (ECCWS), University of Hertfordshire, Hatfield, UK." paper says "Modern Internet communication protocols provide an almost infinite number of ways in which data can be hidden or embed whithin seemingly normal network traffic."
Key phrases: construct a covert channel with data represented as
CVE-2023-50924: Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user's context. This vulnerability enables an authenticated user to inject Javascript into other user's sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1.
Key phrases: inject Javascript into other user's sessions
CVE-2023-50926: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message when using the RPL-Lite implementation in the Contiki-NG operating system. More specifically, the prefix information of the DIO message contains a field that specifies the length of an IPv6 address prefix. The value of this field is not validated, which means that an attacker can set a value that is longer than the maximum prefix length. Subsequently, a memcmp function call that compares different prefixes can be called with a length argument that surpasses the boundary of the array allocated for the prefix, causing an out-of-bounds read. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in the next release. Users are advised to update as soon as they are able to or to manually apply the changes in Contiki-NG pull request #2721.
Key phrases: out-of-bounds read, out of bounds read
CVE-2023-50927: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite implementation of the RPL protocol in the Contiki-NG operating system. This vulnerability is caused by insufficient control of the lengths for DIO and DAO messages, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are advised to upgrade. Users unable to upgrade should manually apply the code changes in PR #2484.
Key phrases: out-of-bounds reads, out of bounds read
CVE-2023-50928: "Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.
Key phrases: cleaned aws accounts
CVE-2023-50930: An issue was discovered in savignano S/Notify before 4.0.2 for Jira. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Jira, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
Key phrases: csrf, email notifications
CVE-2023-50931: An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Bitbucket, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
Key phrases: csrf, email notifications
CVE-2023-50932: An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Confluence, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
Key phrases: csrf, email notifications
CVE-2023-50933: IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.  IBM X-Force ID:  275113.
Key phrases: html injection
CVE-2023-50934: IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.  IBM X-Force ID:  275114.
Key phrases: risk of compromise
CVE-2023-50935: IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to application functionality and/or resources.  IBM X-Force ID:  275115.
Key phrases: obtain unauthorized access, obtain unauthorized access to application functionality and/or resources
CVE-2023-50936: IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.  IBM X-Force ID:  275116.
Key phrases: impersonate another user on the system
CVE-2023-50937: IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  275117.
Key phrases: decrypt highly sensitive information, weaker than expected cryptographic algorithms
CVE-2023-50938: IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.  IBM X-Force ID:  275128.
Key phrases: hijack the clicking action of the victim
CVE-2023-50939: IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  275129.
Key phrases: decrypt highly sensitive information, weaker than expected cryptographic algorithms
CVE-2023-50940: IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.  IBM X-Force ID:  275130.
Key phrases: carry out privileged actions and retrieve sensitive information, cross-origin resource sharing (cors)
CVE-2023-50941: IBM PowerSC 1.3, 2.0, and 2.1 does not provide logout functionality, which could allow an authenticated user to gain access to an unauthorized user using session fixation.  IBM X-Force ID:  275131.
Key phrases: gain access, gain access to an unauthorized user using session, session fixation
CVE-2023-50943: Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.
Key phrases: poison the XCom data by bypassing the protection
CVE-2023-50944: Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access.This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.
Key phrases: access the source code of a DAG to
CVE-2023-50947: IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  275665.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2023-50948: IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.  IBM X-Force ID:  275671.
Key phrases: hard-coded credentials, hard coded credentials
CVE-2023-50950: IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules.  IBM X-Force ID:  275709.
Key phrases: sensitive email information
CVE-2023-50951: IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive information about invalid authorization attempts.  IBM X-Force ID:  275747.
Key phrases: invalid authorization attempts, sensitive information
CVE-2023-50955: IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installation which could aid in further attacks against the system.  IBM X-Force ID:  275777.
Key phrases: obtain the absolute path of the web server installation
CVE-2023-50957: IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key storage.  IBM X-Force ID:  275783.
Key phrases: perform unauthorized actions after obtaining encrypted data from, clear text key storage
CVE-2023-50959: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Content Management system when configured to use a system account.  IBM X-Force ID:  275938.
Key phrases: query more documents than expected from a connected
CVE-2023-5096: The HTML filter and csv-file search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'csvsearch' shortcode in versions up to, and including, 2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-50961: IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  275939.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, stored cross-site scripting, credentials disclosure
CVE-2023-50962: IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism.  IBM X-Force ID:  276004.
CVE-2023-50963: IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.  IBM X-Force ID:  276101.
Key phrases: conduct various attacks against the vulnerable system, http header injection, cross-site scripting, cache poisoning, session hijacking
CVE-2023-50965: In MicroHttpServer (aka Micro HTTP Server) through 4398570, _ReadStaticFiles in lib/middleware.c allows a stack-based buffer overflow and potentially remote code execution via a long URI.
Key phrases: a stack-based buffer overflow and potentially, remote code execution, stack based buffer overflow
CVE-2023-50966: erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption
CVE-2023-50967: latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, latchset jose, cpu consumption
CVE-2023-50968: Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.The same uri can be operated to realize a SSRF attack also  without  authorizations.Users are recommended to upgrade to version 18.12.11, which fixes this issue.
Key phrases: arbitrary file properties reading, ssrf
CVE-2023-50969: Thales Imperva SecureSphere WAF 14.7.0.40 allows remote attackers to bypass WAF rules via a crafted POST request, a different vulnerability than CVE-2021-45468.
Key phrases: bypass WAF rules, bypass WAF rules via a crafted POST request
CVE-2023-5097: Improper Input Validation vulnerability in HYPR Workforce Access on Windows allows Path Traversal.This issue affects Workforce Access: before 8.7.
Key phrases: Path Traversal, improper input validation, path traversal
CVE-2023-50974: In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.
CVE-2023-50975: The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i.e., ELECTRON_RUN_AS_NODE can be used in production). This makes it easier for a compromised process to access banking information.
Key phrases: allows arbitrary code execution, access banking information
CVE-2023-50976: Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API.
Key phrases: missing authorization checks
CVE-2023-50979: Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.
Key phrases: marvin side channel
CVE-2023-5098: The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS.
Key phrases: outcomes, dos
CVE-2023-50980: gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m) curve, if the degree of each term in the polynomial is not strictly decreasing.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2023-50981: ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data associated with squared odd numbers, such as the square of 268995137513890432434389773128616504853.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop
CVE-2023-50982: Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload_action and edit_action in Admin_SmileysController do not check the file extension. This leads to remote code execution with the privileges of the www-data user. The fixed versions are 5.3.4, 5.2.6, 5.1.7, and 5.0.9.
Key phrases: remote code execution with the privileges of the, xss
CVE-2023-50983: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.
Key phrases: command injection
CVE-2023-50984: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the ip parameter in the spdtstConfigAndStart function.
Key phrases: buffer overflow
CVE-2023-50985: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the lanGw parameter in the lanCfgSet function.
Key phrases: buffer overflow
CVE-2023-50986: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function.
Key phrases: buffer overflow
CVE-2023-50987: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysTimeInfoSet function.
Key phrases: buffer overflow
CVE-2023-50988: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the bandwidth parameter in the wifiRadioSetIndoor function.
Key phrases: buffer overflow