yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-2484: The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Key phrases: time-based sql injection, sensitive information
CVE-2023-24840: HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject SQL commands to read, modify, and delete the database.
Key phrases: insufficient validation
CVE-2023-24841: HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service.
Key phrases: perform arbitrary system operation or disrupt, insufficient filtering for user input, disrupt service, execute arbitrary
CVE-2023-24842: HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access partial content of another users mail by changing user ID and mail ID within URL.
Key phrases: hgiga mailsherlock, insufficient access control, partial content
CVE-2023-24843: Transient DOS in Modem while triggering a camping on an 5G cell.
Key phrases: transient dos
CVE-2023-24844: Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.
Key phrases: memory corruption
CVE-2023-24847: Transient DOS in Modem while allocating DSM items.
Key phrases: transient dos
CVE-2023-24848: Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
Key phrases: information disclosure
CVE-2023-24849: Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
Key phrases: information disclosure
CVE-2023-2485: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.
CVE-2023-24850: Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.
Key phrases: memory corruption
CVE-2023-24851: Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
Key phrases: memory corruption
CVE-2023-24852: Memory Corruption in Core due to secure memory access by user while loading modem image.
Key phrases: memory corruption, secure memory access
CVE-2023-24853: Memory Corruption in HLOS while registering for key provisioning notify.
Key phrases: memory corruption
CVE-2023-24854: Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
Key phrases: memory corruption
CVE-2023-24855: Memory corruption in Modem while processing security related configuration before AS Security Exchange.
Key phrases: memory corruption
CVE-2023-24856: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24857: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24858: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24859: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Key phrases: windows internet key exchange (ike) extension denial of service
CVE-2023-24860: Microsoft Defender Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-24861: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2023-24862: Windows Secure Channel Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-24863: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24864: Microsoft PostScript and PCL6 Class Printer Driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-24865: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24866: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24867: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24868: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24869: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-2487: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Key phrases: exposure of sensitive information
CVE-2023-24870: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24871: Windows Bluetooth Service Remote Code Execution Vulnerability
Key phrases: windows bluetooth service remote code execution
CVE-2023-24872: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24876: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24879: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-2488: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Key phrases: reflected cross-site scripting
CVE-2023-24880: Windows SmartScreen Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows smartscreen security feature bypass
CVE-2023-24881: Microsoft Teams Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24882: Microsoft OneDrive for Android Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24883: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24884: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24885: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24886: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24887: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-2489: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2023-24890: Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-24891: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-24892: Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-24893: Visual Studio Code Remote Code Execution Vulnerability
Key phrases: visual studio code remote code execution
CVE-2023-24895: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Key phrases: visual studio remote code execution
CVE-2023-24896: Dynamics 365 Finance Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-24897: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Key phrases: visual studio remote code execution
CVE-2023-24898: Windows SMB Denial of Service Vulnerability
Key phrases: windows smb denial of service
CVE-2023-24899: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2023-2490: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fernando Briano UserAgent-Spy plugin <=1.3.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24900: Windows NTLM Security Support Provider Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24901: Windows NFS Portmapper Information Disclosure Vulnerability
Key phrases: windows nfs portmapper information disclosure
CVE-2023-24902: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-24903: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24904: Windows Installer Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-24905: Remote Desktop Client Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24906: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24907: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24908: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24909: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-2491: A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Key phrases: security regression, arbitrary commands, arbitrary command execution
CVE-2023-24910: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2023-24911: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24912: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2023-24913: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24914: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-24919: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-2492: The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Key phrases: sql injection
CVE-2023-24920: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-24921: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-24922: Microsoft Dynamics 365 Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24923: Microsoft OneDrive for Android Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24924: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24925: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24926: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24927: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24928: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24929: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-2493: The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Key phrases: sql injection
CVE-2023-24930: Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-24931: Windows Secure Channel Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-24932: Secure Boot Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, secure boot security feature bypass
CVE-2023-24934: Microsoft Defender Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-24935: Microsoft Edge (Chromium-based) Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-24936: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Key phrases: visual studio elevation of privilege
CVE-2023-24937: Windows CryptoAPI  Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-24938: Windows CryptoAPI  Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-24939: Server for NFS Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-2494: The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to modify access to the plugin when it should only be the administrator's privilege.
Key phrases: unauthorized modification of data, missing capability check
CVE-2023-24940: Windows Pragmatic General Multicast (PGM) Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-24941: Windows Network File System Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24942: Remote Procedure Call Runtime Denial of Service Vulnerability
Key phrases: remote procedure call runtime denial of service
CVE-2023-24943: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24944: Windows Bluetooth Driver Information Disclosure Vulnerability
Key phrases: windows bluetooth driver information disclosure
CVE-2023-24945: Windows iSCSI Target Service Information Disclosure Vulnerability
Key phrases: windows iscsi target service information disclosure
CVE-2023-24946: Windows Backup Service Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-24947: Windows Bluetooth Driver Remote Code Execution Vulnerability
Key phrases: windows bluetooth driver remote code execution
CVE-2023-24948: Windows Bluetooth Driver Elevation of Privilege Vulnerability
Key phrases: windows bluetooth driver elevation of privilege
CVE-2023-24949: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-2495: The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.
Key phrases: trigger the plugin's functionality to change Post, csrf
CVE-2023-24950: Microsoft SharePoint Server Spoofing Vulnerability
Key phrases: microsoft sharepoint server spoofing
CVE-2023-24953: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2023-24954: Microsoft SharePoint Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-24955: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-24956: Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php.
Key phrases: sql injection
CVE-2023-24957: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  246115.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2023-24958: A vulnerability in the IBM TS7700 Management Interface 8.51.2.12, 8.52.200.111, 8.52.102.13, and 8.53.0.63 could allow an authenticated user to submit a specially crafted URL leading to privilege escalation and remote code execution.  IBM X-Force ID:  246320.
Key phrases: submit a specially crafted URL leading to privilege, privilege escalation, remote code execution
CVE-2023-24959: IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration.  IBM X-Force ID:  246332.
CVE-2023-2496: The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability check on the 'validate_upload' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to upload arbitrary files on the affected site's server which may make remote code execution possible.
Key phrases: upload arbitrary files, unauthorized arbitrary file uploads, remote code execution
CVE-2023-24960: IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  246333
Key phrases: view arbitrary files, traverse directories on the system
CVE-2023-24964: IBM InfoSphere Information Server 11.7 could allow a local user to obtain sensitive information from a log files.  IBM X-Force ID:  246463.
Key phrases: obtain sensitive information, obtain sensitive information from a log files, sensitive information log file
CVE-2023-24965: IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.  IBM X-Force ID:  246713.
CVE-2023-24966: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  246904.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2023-2497: The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers to exploit PHP Object Injection due to the use of unserialize() on the user supplied parameter via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery, php object injection
CVE-2023-24971: IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 could allow a user to cause a denial of service due to the deserializing of untrusted serialized Java objects. IBM X-Force ID: 246976.
Key phrases: cause a denial of service due to the, untrusted serialized java objects
CVE-2023-24975: IBM Spectrum Symphony 7.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 247030.
Key phrases: conduct various attacks against the vulnerable system, http header injection, cross-site scripting, cache poisoning, session hijacking
CVE-2023-24977: Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0.Users are advised to upgrade to Apache InLong's latest version or cherry-pick  https://github.com/apache/inlong/pull/7214 https://github.com/apache/inlong/pull/7214 to solve it.
Key phrases: out-of-bounds read
CVE-2023-24978: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted SPP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19788)
Key phrases: uninitialized pointer access, execute code
CVE-2023-24979: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19789)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-2498: The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.19 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-24980: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19790)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24981: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19791)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24982: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19804)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24983: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19805)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24984: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19806)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24985: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19807)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24986: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19808)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24987: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19809)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24988: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19810)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24989: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19811)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-2499: The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Key phrases: bypass in versions up to, authentication bypass
CVE-2023-24990: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19812)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24991: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19813)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24992: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19814)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24993: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19815)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24994: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19816)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24995: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19817)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24996: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19818)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-24997: Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0.Users are advised to upgrade to Apache InLong's latest version or cherry-pick  https://github.com/apache/inlong/pull/7223 https://github.com/apache/inlong/pull/7223 to solve it.
Key phrases: deserialization of untrusted data
CVE-2023-24998: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.Note that, like all of the file upload limits, the          new configuration option (FileUploadBase#setFileCountMax) is not          enabled by default and must be explicitly configured.
Key phrases: dos, malicious upload, series of uploads, file upload
CVE-2023-24999: HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
CVE-2023-2500: The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'go_pricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Key phrases: delete arbitrary files, inject a PHP Object, php object injection, pop chain, execute code
CVE-2023-25000: HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Key phrases: cache-timing, brute force effort
CVE-2023-25001: A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
Key phrases: use-after-free, code execution, use after free
CVE-2023-25002: A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
Key phrases: use-after-free, code execution, use after free
CVE-2023-25003: A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnerabilities. Exploitation of this vulnerability may lead to code execution.
Key phrases: out-of-bound read write read, code execution, out of bound read
CVE-2023-25004: A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploitation of these vulnerabilities may lead to code execution.
Key phrases: integer overflow, code execution
CVE-2023-25005: A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL files could lead to a resource injection vulnerability.
Key phrases: resource injection
CVE-2023-25006: A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in code execution.
Key phrases: use-after-free, code execution, convince, use after free
CVE-2023-25007: A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execution.
Key phrases: uninitialized pointer, code execution, convince
CVE-2023-25008: A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result in code execution.
Key phrases: out-of-bounds read, code execution, convince, out of bounds read
CVE-2023-25009: A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result in code execution.
Key phrases: out-of-bounds write, code execution, convince, out of bounds write
CVE-2023-25010: A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code execution.
Key phrases: uninitialized variable, code execution, convince
CVE-2023-25011: PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administrator privileges with standard user privileges.
Key phrases: write to the registry as administrator privileges with
CVE-2023-25012: The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long.
Key phrases: use-after-free
CVE-2023-25013: An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users.
Key phrases: set the password of all frontend users, missing access checks
CVE-2023-25014: An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users.
Key phrases: delete all frontend users, missing access checks
CVE-2023-25015: Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
Key phrases: CSRF, csrf
CVE-2023-25016: Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.
Key phrases: sensitive information
CVE-2023-25017: RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data.
Key phrases: rifartek iot wall, incorrect authorization
CVE-2023-25018: RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can inject JavaScript to perform reflected XSS (Reflected Cross-site scripting) attack.
Key phrases: reflected xss
CVE-2023-25019: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <=3.0.9 versions
Key phrases: reflected cross-site scripting (xss)
CVE-2023-25020: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25021: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FareHarbor FareHarbor for WordPress plugin <=3.6.6 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25022: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Watu Quiz plugin <= 3.3.8 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25023: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saleswonder.Biz Webinar ignition plugin <= 2.14.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25024: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Icegram Icegram Collect plugin <= 1.3.8 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25025: Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <=3.1.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25027: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Chained Quiz plugin <= 1.3.2.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25028: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in chuyencode CC Custom Taxonomy plugin <=1.0.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25029: Cross-Site Request Forgery (CSRF) vulnerability in utahta WP Social Bookmarking Light plugin <=2.0.7 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-2503: The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Key phrases: reflected cross-site scripting
CVE-2023-25031: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25032: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Print, PDF, Email by PrintFriendly plugin <=5.5.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25033: Cross-Site Request Forgery (CSRF) vulnerability in Sumo Social Share Boost plugin <=4.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25034: Cross-Site Request Forgery (CSRF) vulnerability in BoLiQuan WP Clean Up plugin <=1.2.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25036: Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <=1.6 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25038: Cross-Site Request Forgery (CSRF) vulnerability in 984.Ru For the visually impaired plugin <=0.58 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25039: Missing Authorization vulnerability in CodePeople Google Maps CP.This issue affects Google Maps CP: from n/a through 1.0.43.
Key phrases: missing authorization
CVE-2023-2504: Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials.
Key phrases: gain unauthorized access, gain unauthorized access as a root user using, hard-coded credentials, hard coded credentials
CVE-2023-25040: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin  Shortcodes Ultimate plugin <=5.12.6 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25041: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Monolit theme <= 2.0.6 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-25042: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy (Storm Consultancy) oAuth Twitter Feed for Developers plugin <=2.3.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25044: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sumo Social Share Boost plugin <=4.4 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25045: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.
Key phrases: SQL Injection, sql command, sql injection
CVE-2023-25046: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25047: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.
Key phrases: SQL Injection, sql command, sql injection
CVE-2023-25049: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.4 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-2505: The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files.
Key phrases: execute code and upload malicious files, csrf
CVE-2023-25051: Cross-Site Request Forgery (CSRF) vulnerability in Denishua Comment Reply Notification plugin <= 1.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25052: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa Yandex.News Feed by Teplitsa plugin <=1.12.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25054: Improper Control of Generation of Code ('Code Injection') vulnerability in David F. Carr RSVPMaker.This issue affects RSVPMaker: from n/a through 10.6.6.
Key phrases: improper control of generation of code, code injection
CVE-2023-25055: Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Videos plugin <= 2.6.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25056: Cross-Site Request Forgery (CSRF) vulnerability in SlickRemix Feed Them Social plugin <=3.0.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25057: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.3.2.
Key phrases: exposure of sensitive information
CVE-2023-25058: Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Schema  All In One Schema Rich Snippets plugin <=1.6.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25059: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in avalex GmbH avalex – Automatically secure legal texts plugin <= 3.0.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25061: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25062: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.2.8 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25063: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anadnet Quick Page/Post Redirect Plugin plugin <=5.2.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25064: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Matteo Candura WP htpasswd plugin <= 1.7 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25065: Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25066: Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25069: TXOne StellarOne has an improper access control privilege escalation vulnerability in every version before V2.0.1160 that could allow a malicious, falsely authenticated user to escalate his privileges to administrator level. With these privileges, an attacker could perform actions they are not authorized to.Please note: an attacker must first obtain a low-privileged authenticated user's profile on the target system in order to exploit this vulnerability.
Key phrases: obtain a low-privileged, escalate his privileges to administrator level, privilege escalation, improper access control, escalate privilege
CVE-2023-2507: CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker.This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
Key phrases: execute JavaScript code in any application that is
CVE-2023-25070: Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the telnet connection is enabled, a remote unauthenticated attacker may eavesdrop on or alter the administrator's communication to the product.
Key phrases: cleartext transmission, telnet connection, sensitive information
CVE-2023-25071: NULL pointer dereference in some Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows Drviers before version 31.0.101.4255 may allow authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, null pointer dereference
CVE-2023-25072: Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product.
Key phrases: decrypt password for the WebUI of the product, weak credentials
CVE-2023-25073: Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper access control