yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-33975: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. This issue is fixed in pull request 19680. As a workaround, disable support for fragmented IP datagrams.
Key phrases: execute arbitrary code, out of bounds write, overflow, denial of service, buffer overflow
CVE-2023-33977: Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy. This issue has been addressed in version 12.4. Users are advised to upgrade. Users unable to upgrade who are serving Kiwi TCMS behind a reverse proxy should make sure that additional header values are still passed to the client browser. If they aren't redefining them inside the proxy configuration.
Key phrases: upload attachments to test plans, upgrade, cross-site-scripting, file upload, cross-site scripting
CVE-2023-33979: gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects some unknown processing of the component Configuration File Handler. The manipulation of the argument file leads to information disclosure. Since no sensitive files are configured to be off-limits, sensitive information files in some working directories can be read through the `/file` route, leading to sensitive information leakage. This affects users that uses file configurations via `config.py`, `config_private.py`, `Dockerfile`. A patch is available at commit 1dcc2873d2168ad2d3d70afcb453ac1695fbdf02. As a workaround, one may use environment variables instead of `config*.py` files to configure this project, or use docker-compose installation to configure this project.
Key phrases: information disclosure, sensitive information, sensitive information leakage
CVE-2023-3398: Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.
Key phrases: denial of service
CVE-2023-33980: Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) via a series of long messages to a contact.
Key phrases: denial of service (repeated application crashes), cause a denial of service (repeated application
CVE-2023-33981: Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need to be an exact duplicate of a legitimate message displayed alongside the spoofed one.
Key phrases: spoof other users' messages in a blog, spoofing
CVE-2023-33982: Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic between two accounts if they later compromise both accounts. NOTE: the eavesdropping is typically impractical because BHP runs over an encrypted session that uses the Tor hidden service protocol.
Key phrases: forward secure, compromise
CVE-2023-33983: The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. An introducer can launch man-in-the-middle attacks against later private communication between two introduced parties.
Key phrases: man-in-the-middle, man in the middle
CVE-2023-33984: SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to Cross-Site Scripting vulnerability.
Key phrases: create a file with a malicious content and, cross-site scripting
CVE-2023-33985: SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
Key phrases: cross-site scripting (xss), limited impact, confidentiality, confidentiality and integrity
CVE-2023-33986: SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.
Key phrases: cross-site scripting (xss), limited impact, confidentiality, confidentiality and integrity
CVE-2023-33987: An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server whichmay, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimatemessages. This can result in the back-end server executing a malicious payload which can be used to read ormodify information on the server or make it temporarily unavailable.
Key phrases: malicious payload, temporarily unavailable
CVE-2023-33988: In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are not implemented, allowing an unauthenticated attacker to attempt reflected cross-site scripting, which could result in disclosure or modification of information.
Key phrases: attempt reflected cross-site scripting, disclosure, modification of information
CVE-2023-33989: An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can be over-written leading to system compromise.
Key phrases: directory traversal flaw, system compromise, file read, file write
CVE-2023-3399: An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates.
CVE-2023-33990: SAP SQL Anywhere- version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be leveraged by an attacker to perform a Denial of Service. Further, an attacker might be able to modify sensitive data in shared memory objects.This issue only affects SAP SQL Anywhere on Windows. Other platforms are not impacted.
Key phrases: prevent legitimate users from accessing the service by, shared memory objects, denial of service, sensitive data, crash
CVE-2023-33991: SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerability. After successful exploitation, an attacker with user level access can cause high impact on confidentiality, modify some information and can cause unavailability of the application at user level.
Key phrases: stored cross-site scripting (stored xss), confidentiality
CVE-2023-33992: The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.
Key phrases: unauthorized cell values, missing check, data level
CVE-2023-33993: B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to send crafted queries over the network to read or modify the SQL data. On successful exploitation, the attacker can cause high impact on confidentiality, integrity and availability of the application.
Key phrases: send crafted queries over the network to read, exploitation, high impact, confidentiality, confidentiality and integrity, integrity and availability
CVE-2023-33997: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <=5.5.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-34000: Unauth. IDOR vulnerability leading to PII Disclosure inWooCommerce Stripe Payment Gateway plugin <= 7.4.0 versions.
Key phrases: idor, pii disclosure
CVE-2023-34002: Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory Manager plugin <=2.1.0.13 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-34004: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Box Office plugin <=1.1.50 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-34005: Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Front End Users plugin <=3.2.24 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-34006: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi Telegram Bot & Channel plugin <=3.6.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-34007: Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.
Key phrases: unrestricted upload of file with dangerous type
CVE-2023-34008: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <=1.12.3 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-3401: An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.
Key phrases: create repositories with malicious code
CVE-2023-34010: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability insubmodule ofDavid Lingren Media Library Assistant plugin <= 3.0.7 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-34011: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ShopConstruct plugin <=1.1.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-34012: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premium Addons for Elementor Premium Addons PRO plugin <=2.8.24 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-34013: Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker  Best WordPress Poll Plugin.This issue affects Poll Maker  Best WordPress Poll Plugin: from n/a through 4.6.2.
Key phrases: server-side request forgery (ssrf)
CVE-2023-34015: Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin <=1.6.4.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-34017: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FiveStarPlugins Five Star Restaurant Reservations plugin <=2.6.7 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-34018: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoundCloud Inc. SoundCloud Shortcode allows Stored XSS.This issue affects SoundCloud Shortcode: from n/a through 3.1.0.
Key phrases: Stored XSS.This issue affects SoundCloud Shortcode: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-34020: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.
Key phrases: url redirection, open redirect
CVE-2023-34021: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <=3.7.29 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-34022: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rakib Hasan Dynamic QR Code Generator plugin <=0.0.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-34023: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <=3.0.4 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-34024: Cross-Site Request Forgery (CSRF) vulnerability in Guillemant David WP Full Auto Tags Manager plugin <=2.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-34025: Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <=2.1.6 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-34026: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BrokenCrust This Day In History plugin <=3.10.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-34027: Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0.
Key phrases: deserialization of untrusted data
CVE-2023-34028: Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF  WordPress Posts Bulk Editor and Manager Professional plugin <=1.0.7 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-34029: Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <=2.3.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-3403: The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to import new users and update existing users.
Key phrases: unauthorized modification of data, missing capability check, update existing users
CVE-2023-34030: Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Request Forgery.This issue affects Complianz: from n/a through 6.4.5; Complianz Premium: from n/a through 6.4.7.
Key phrases: Cross-Site Request Forgery, cross-site request forgery (csrf)
CVE-2023-34031: Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <=1.0.12 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-34032: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pascal Casier bbPress Toolkit plugin <=1.0.12 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-34033: Cross-Site Request Forgery (CSRF) vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin <=2.0.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-34034: Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
Key phrases: security bypass
CVE-2023-34035: Spring Security versions 5.8prior to 5.8.5, 6.0prior to 6.0.5,and 6.1prior to 6.1.2could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String)and multiple servlets, one of them being Spring MVCs DispatcherServlet.(DispatcherServletis a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)Specifically, an application is vulnerable when all of the following are true:  *  Spring MVC is on the classpath  *  Spring Security is securing more than one servlet in a single application (one of them being Spring MVCs DispatcherServlet)  *  The application uses requestMatchers(String)to refer to endpoints that are not Spring MVC endpointsAn application is not vulnerable if any of the following is true:  *  The application does not have Spring MVC on the classpath  *  The application secures no servlets other than Spring MVCs DispatcherServlet  *  The application uses requestMatchers(String)only for Spring MVC endpoints
Key phrases: authorization rule misconfiguration
CVE-2023-34036: Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server.For the application to be affected, it needs to satisfy the following requirements:  *  It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses.  *  The application infrastructure does not guard against clients submitting (X-)Forwardedheaders.
CVE-2023-34037: VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.
Key phrases: http request smuggling
CVE-2023-34038: VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the internal network configuration.
Key phrases: information disclosure
CVE-2023-34039: Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation.A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.
Key phrases: bypass SSH authentication, Authentication Bypass, gain access, authentication bypass
CVE-2023-3404: The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to the passphrase and iv being hardcoded in the 'pm_encrypt_decrypt_pass' function and used across all sites running the plugin. This makes it possible for authenticated attackers, with administrator-level permissions or above to decrypt and view users' passwords. If combined with another vulnerability, this can potentially grant lower-privileged users access to users' passwords.
Key phrases: unauthorized decryption of private information, another, hardcoded
CVE-2023-34040: In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.Specifically, an application is vulnerable when all of the following are true:  *  The user does notconfigure an ErrorHandlingDeserializer for the key and/or value of the record  *  The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true.  *  The user allows untrusted sources to publish to a Kafka topicBy default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.
Key phrases: publish to a Kafka topicBy default, deserialization attack vector
CVE-2023-34041: Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations.
Key phrases: http hop-by-hop headers, identification value
CVE-2023-34042: The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system.While there are no known exploits, this is an example of CWE-732: Incorrect Permission Assignment for Critical Resource and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.
CVE-2023-34043: VMware Aria Operations contains a local privilege escalation vulnerability.A malicious actor with administrative access to the local system can escalate privileges to 'root'.
Key phrases: local privilege escalation, escalate privilege
CVE-2023-34044: VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.
Key phrases: out-of-bounds read, out of bounds read
CVE-2023-34045: VMware Fusion(13.x prior to 13.5)contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade.A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.
Key phrases: local privilege escalation, escalate privilege
CVE-2023-34046: VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade.A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.
Key phrases: toctou, escalate privilege
CVE-2023-34047: A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptionsinstance when registering batch loader functions through DefaultBatchLoaderRegistry.
CVE-2023-34048: vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
Key phrases: out-of-bounds write, remote code execution, out of bounds write
CVE-2023-3405: Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service
Key phrases: cause denial of service, unchecked parameter value
CVE-2023-34050: In spring AMQP versions 1.0.0 to2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable classnames were added to Spring AMQP, allowing users to lock down deserialization ofdata in messages from untrusted sources; however by default, when no allowedlist was provided, all classes could be deserialized.Specifically, an application isvulnerable if   *  the     SimpleMessageConverter or SerializerMessageConverter is used   *  the user     does not configure allowed list patterns   *  untrusted     message originators gain permissions to write messages to the RabbitMQ     broker to send malicious content
Key phrases: gain permissions, lock down deserialization ofdata in messages from untrusted
CVE-2023-34051: VMware Aria Operations for Logs contains an authentication bypass vulnerability.An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
Key phrases: authentication bypass, impacted appliance, remote code execution
CVE-2023-34052: VMware Aria Operations for Logs contains a deserialization vulnerability.A malicious actor with non-administrative access to the local system can trigger the deserialization of data which could result in authentication bypass.
Key phrases: authentication bypass, deserialization
CVE-2023-34053: In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.Specifically, an application is vulnerable when all of the following are true:  *  the application uses Spring MVC or Spring WebFlux  *  io.micrometer:micrometer-coreis on the classpath  *  an ObservationRegistry is configured in the application to record observationsTypically, Spring Boot applications need the org.springframework.boot:spring-boot-actuatordependency to meet all conditions.
Key phrases: denial-of-service (dos) condition, denial of service
CVE-2023-34054: In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.
Key phrases: denial-of-service (dos) condition, denial of service
CVE-2023-34055: In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.Specifically, an application is vulnerable when all of the following are true:  *  the application uses Spring MVC or Spring WebFlux  *  org.springframework.boot:spring-boot-actuatoris on the classpath
Key phrases: denial-of-service (dos) condition, denial of service
CVE-2023-34056: vCenter Server contains a partial information disclosure vulnerability.A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data.
Key phrases: partial information disclosure
CVE-2023-34057: VMware Tools contains a local privilege escalation vulnerability.A malicious actor with local user access to a guest virtual machine may elevate privileges within the virtual machine.
Key phrases: local privilege escalation, elevate privileges
CVE-2023-34058: VMware Tools contains a SAML token signature bypass vulnerability.A malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged  Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
Key phrases: SAML token signature bypass, saml token signature bypass, elevate privileges
CVE-2023-34059: open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper.A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.
Key phrases: simulate user inputs, file descriptor hijack, root privilege
CVE-2023-3406: Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server
Key phrases: read some restricted files on the web server, path traversal issue
CVE-2023-34060: VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 froman older version.On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass loginrestrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console) . This bypass is not present on port 443 (VCD providerand tenant login). On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present.VMware Cloud Director Appliance is impacted since it uses an affected version of sssd from the underlying Photon OS. The sssd issue is no longer present in versions of Photon OS that ship with sssd-2.8.1-11 or higher (Photon OS 3) or sssd-2.8.2-9 or higher (Photon OS 4 and 5).
Key phrases: bypass loginrestrictions, bypass is not present on port 443 (VCD providerand tenant login, bypass is not present.VMware Cloud Director Appliance, authentication bypass
CVE-2023-34061: Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack.  An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.
Key phrases: dos, degrade the service availability
CVE-2023-34062: In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
Key phrases: directory traversal
CVE-2023-34063: Aria Automation contains a Missing Access Control vulnerability.An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows.
Key phrases: missing access control, unauthorized access
CVE-2023-34064: Workspace ONE Launcher contains a Privilege Escalation Vulnerability.A malicious actor with physical access to Workspace ONE Launcher could utilize the Edge Panel feature to bypass setup to gain access to sensitive information.
Key phrases: bypass setup to gain access to sensitive information, privilege escalation, feature bypass,, access sensitive information
CVE-2023-3407: The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to send test emails with custom content to users on sites running a vulnerable version of this plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-34085: When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request
CVE-2023-34086: Improper input validation in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2023-34087: An improper array index validation vulnerability exists in the EVCD var len parsing functionality of GTKWave 3.3.115. A specially crafted .evcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
Key phrases: improper array index validation, arbitrary code execution
CVE-2023-34088: Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document name. Later, if an administrator opened the admin console and navigated to the history page, the document name was injected as unescaped HTML and executed as a script inside the context of the admin console. The administrator JSON web token (JWT) used for the websocket connection could be leaked through this flaw. Users should upgrade to Collabora Online 22.05.13 or higher; Collabora Online 21.11.9.1 or higher; Collabora Online 6.4.27 or higher to receive a patch.
Key phrases: stored cross-site scripting (xss)
CVE-2023-34089: Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in version 0.27.3 and 0.26.7.
Key phrases: execute JavaScript code in the context of a, cross-site scripting
CVE-2023-34090: Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3. 
Key phrases: exfiltrate non-public data from the underlying, sensitive data disclosure
CVE-2023-34091: Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.
Key phrases: bypass validate, generate, or mutate-existing policies, bypass a Kyverno policy, bypass policies, leverage the Kubernetes finalizers feature by setting a
CVE-2023-34092: Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, and vite@2.9.16.
Key phrases: read file from the Vite root-path, double forward-slash ( )
CVE-2023-34093: Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the `privateAttributes` getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes). Anyone can be impacted, depending on how people are using/extending content-types. If the users are mutating the content-type, they will not be affected. Version 4.10.8 contains a patch for this issue.
Key phrases: sensitive information
CVE-2023-34094: ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized access to the config.json file of the privately deployed ChuanghuChatGPT project, when authentication is not configured. The attacker can exploit this vulnerability to steal the API keys in the configuration file. The vulnerability has been fixed in commit bfac445. As a workaround, setting up access authentication can help mitigate the vulnerability.
Key phrases: the config.json file of the privately deployed ChuanghuChatGPT, unauthorized access
CVE-2023-34095: cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. In versions 1.0 through 2.0b4, cpdb-libs is vulnerable to buffer overflows via improper use of `scanf(3)`. cpdb-libs uses the `fscanf()` and `scanf()` functions to parse command lines and configuration files, dropping the read string components into fixed-length buffers, but does not limit the length of the strings to be read by `fscanf()` and `scanf()` causing buffer overflows when a string is longer than 1023 characters. A patch for this issue is available at commit f181bd1f14757c2ae0f17cc76dc20421a40f30b7. As all buffers have a length of 1024 characters, the patch limits the maximum string length to be read to 1023 by replacing all occurrences of `%s` with `%1023s` in all calls of the `fscanf()` and `scanf()` functions.
Key phrases: buffer overflows
CVE-2023-34096: Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.
Key phrases: upload a file to any folder which has, path traversal
CVE-2023-34097: hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability. 
Key phrases: elevate privileges
CVE-2023-34098: Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.
Key phrases: incorrect configuration
CVE-2023-34099: Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
Key phrases: flaws
CVE-2023-34100: Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packet, the Contiki-NG OS does not verify that certain buffer indices to read from are within the bounds of the IPv6 packet buffer, uip_buf. In particular, there is a 2-byte buffer read in the module os/net/ipv6/uip6.c. The buffer is indexed using 'UIP_IPTCPH_LEN + 2 + c' and 'UIP_IPTCPH_LEN + 3 + c', but the uip_buf buffer may not have enough data, resulting in a 2-byte read out of bounds. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in release 4.9. Users are advised to watch for the 4.9 release and to upgrade when it becomes available. There are no workarounds for this vulnerability aside from manually patching with the diff in commit `cde4e9839`.
Key phrases: read out of bounds, buffer over read
CVE-2023-34101: Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_input_storing` function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes can be read out of bounds in the `dao_input_storing` function. An attacker can truncate an ICMP packet so that it does not contain enough data, leading to an out-of-bounds read on these lines. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in release 4.9. As a workaround, one can apply the changes in Contiki-NG pull request #2435 to patch the system.
Key phrases: out-of-bounds read, out of bounds read
CVE-2023-34102: Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.
Key phrases: unexpected behavior, remote code execution, application crashes
CVE-2023-34103: Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are stored and no specific timing is required. This issue has been addressed in commit `7891c01e` which is expected to be included in the next release of avo. Users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation.
Key phrases: cross site scripting (xss)
CVE-2023-34104: fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option.
Key phrases: denial of service (DoS), stall for an indefinite amount of time, denial of service (dos)
CVE-2023-34105: SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-server` server is vulnerable to a drive-by command injection. An attacker may send a request to the `/api/v1/snapshots` endpoint containing any commands to be executed as part of the body of the POST request. This issue may lead to Remote Code Execution (RCE). Versions 5.0.157, 5.0-b1, and 6.0.48 contain a fix.
Key phrases: drive-by command injection, remote code execution (rce)
CVE-2023-34106: GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should upgrade to version 10.0.8 to receive a patch.
Key phrases: the list of all users and their personal, incorrect rights check
CVE-2023-34107: GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue.
Key phrases: the view all KnowbaseItems, incorrect rights check
CVE-2023-34108: mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue arises from the behavior of the `passwd-verify.lua` script, which is responsible for verifying user passwords during login attempts. Upon a successful login, the script returns a response in the format of "password=<valid-password>", indicating the successful authentication. By crafting a password with additional key-value pairs appended to it, an attacker can manipulate the returned string and influence the internal behavior of Dovecot. For example, using the password "123 mail_crypt_save_version=0" would cause the `passwd-verify.lua` script to return the string "password=123 mail_crypt_save_version=0". Consequently, Dovecot will interpret this string and set the internal variables accordingly, leading to unintended consequences. This vulnerability can be exploited by an authenticated attacker who has the ability to set their own password. Successful exploitation of this vulnerability could result in unauthorized access to user accounts, bypassing security controls, or other malicious activities. This issue has been patched in version `2023-05a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: manipulate internal Dovecot variables by using specially crafted, unintended consequences, unauthorized access, bypass security