yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-23370: An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors.We have already fixed the vulnerability in the following version:QVPN Windows 2.1.0.0518 and later
Key phrases: gain access, gain access to user accounts and access sensitive, insufficiently protected credentials, unspecified vectors
CVE-2023-23371: A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors.We have already fixed the vulnerability in the following version:QVPN Windows 2.2.0.0823 and later
Key phrases: read sensitive data via unspecified vectors, cleartext transmission of sensitive information
CVE-2023-23372: A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to inject malicious code via a network.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2425 build 20230609 and laterQTS 5.1.0.2444 build 20230629 and laterQTS 4.5.4.2467 build 20230718 and laterQuTS hero h5.1.0.2424 build 20230609 and laterQuTS hero h5.0.1.2515 build 20230907 and laterQuTS hero h4.5.4.2476 build 20230728 and later
Key phrases: inject malicious code via a network, cross-site scripting (xss)
CVE-2023-23373: An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network.We have already fixed the vulnerability in the following version:QUSBCam2 2.0.3 ( 2023/06/15 ) and later
Key phrases: execute commands via a network, os command injection
CVE-2023-23374: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23375: Microsoft ODBC and OLE DB Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23376: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2023-23377: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-23378: Print 3D Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23379: Microsoft Defender for IoT Elevation of Privilege Vulnerability
Key phrases: iot elevation of privilege
CVE-2023-2338: SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.
Key phrases: sql injection
CVE-2023-23381: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23382: Azure Machine Learning Compute Instance Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-23383: Service Fabric Explorer Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-23384: Microsoft SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23385: Windows Point-to-Point Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-23388: Windows Bluetooth Driver Elevation of Privilege Vulnerability
Key phrases: windows bluetooth driver elevation of privilege
CVE-2023-23389: Microsoft Defender Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-2339: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
Key phrases: cross-site scripting (xss)
CVE-2023-23390: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-23391: Office for Android Spoofing Vulnerability
Key phrases: android spoofing
CVE-2023-23392: HTTP Protocol Stack Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23393: Windows BrokerInfrastructure Service Elevation of Privilege Vulnerability
Key phrases: service elevation of privilege
CVE-2023-23394: Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-23395: Microsoft SharePoint Server Spoofing Vulnerability
Key phrases: microsoft sharepoint server spoofing
CVE-2023-23396: Microsoft Excel Denial of Service Vulnerability
Key phrases: microsoft excel denial of service
CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability
Key phrases: microsoft outlook elevation of privilege
CVE-2023-23398: Microsoft Excel Spoofing Vulnerability
Key phrases: microsoft excel spoofing
CVE-2023-23399: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2023-2340: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
Key phrases: cross-site scripting (xss)
CVE-2023-23400: Windows DNS Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23401: Windows Media Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23402: Windows Media Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23403: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23404: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: windows point-to-point tunneling protocol remote code execution
CVE-2023-23405: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23406: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23407: Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23408: Azure Apache Ambari Spoofing Vulnerability
Key phrases: azure apache ambari spoofing
CVE-2023-23409: Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-2341: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
Key phrases: cross-site scripting (xss)
CVE-2023-23410: Windows HTTP.sys Elevation of Privilege Vulnerability
Key phrases: windows http.sys elevation of privilege
CVE-2023-23411: Windows Hyper-V Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-23412: Windows Accounts Picture Elevation of Privilege Vulnerability
Key phrases: picture elevation of privilege
CVE-2023-23413: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23414: Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23415: Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23416: Windows Cryptographic Services Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-23417: Windows Partition Management Driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-23418: Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-23419: Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-2342: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
Key phrases: cross-site scripting (xss)
CVE-2023-23420: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-23421: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-23422: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-23423: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-23424: Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution
Key phrases: file writing, code execution, file write
CVE-2023-23426: Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure.
Key phrases: file writing, information disclosure, file write
CVE-2023-23427: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
Key phrases: incorrect privilege assignment, device service exceptions
CVE-2023-23428: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
Key phrases: incorrect privilege assignment, device service exceptions
CVE-2023-23429: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
Key phrases: incorrect privilege assignment, device service exceptions
CVE-2023-2343: Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
Key phrases: cross-site scripting (xss)
CVE-2023-23430: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
Key phrases: incorrect privilege assignment, device service exceptions
CVE-2023-23431: Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
Key phrases: signature management
CVE-2023-23432: Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
Key phrases: signature management
CVE-2023-23433: Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
Key phrases: signature management
CVE-2023-23434: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
Key phrases: information leak
CVE-2023-23435: Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file
Key phrases: signature management
CVE-2023-23436: Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file
Key phrases: signature management
CVE-2023-23437: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak
Key phrases: information leak
CVE-2023-23438: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions
Key phrases: incorrect privilege assignment, device service exceptions
CVE-2023-23439: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
Key phrases: information leak
CVE-2023-2344: A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_service of the component HTTP POST Request Handler. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227587.
Key phrases: sql injection
CVE-2023-23440: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
Key phrases: information leak
CVE-2023-23441: Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.
Key phrases: out of bounds read, information leak
CVE-2023-23442: Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
Key phrases: type confusion, information leak
CVE-2023-23443: Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
Key phrases: type confusion, information leak
CVE-2023-23444: Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an unauthenticated remote attacker to influence the availability of the device by changing the IP settings of the device via broadcasted UDP packets.
Key phrases: influence the availability of the device by changing, missing authentication
CVE-2023-23445: Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remoteattacker to gain unauthorized access to data fields by using a therefore unpriviledged account via theREST interface.
Key phrases: gain unauthorized access, gain unauthorized access to data fields by using, improper access control
CVE-2023-23446: Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the REST interface.
Key phrases: download files by using a therefore unpriviledged account, improper access control
CVE-2023-23447: Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivilegedremote attacker to influence the availability of the webserver by invocing several open file requests viathe REST interface.
Key phrases: influence the availability of the webserver by invocing, uncontrolled resource consumption
CVE-2023-23448: Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows aremote attacker to gain information about valid usernames via analysis of source code.
Key phrases: gain information, gain information about valid usernames via analysis of
CVE-2023-23449: Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attackerto gain information about valid usernames by analyzing challenge responses from the server via theREST interface.
Key phrases: gain information, a remote attackerto gain information about valid usernames, observable response discrepancy
CVE-2023-2345: A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to improper authorization. The attack may be launched remotely. The identifier of this vulnerability is VDB-227588.
Key phrases: improper authorization
CVE-2023-23450: Use of Password Hash Instead of Password for Authentication in SICK FTMg AIRFLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526allows an unprivileged remote attacker to use a password hash instead of an actual password to loginto a valid user account via the REST interface.
CVE-2023-23451: The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN1 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN3S04 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN4 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK FX0-GENT00000 FLEXISOFT EIP GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GMOD00000 FLEXISOFT MOD GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GPNT00000 FLEXISOFT PNET GATEW. with serial number <=2311xxxx with Firmware <=V2.12.0, SICK FX0-GENT00030 FLEXISOFT EIP GATEW.V2 with serial number <=2311xxxx all Firmware versions, SICK FX0-GPNT00030 FLEXISOFT PNET GATEW.V2 with serial number <=2311xxxx all Firmware versions and SICK FX0-GMOD00010 FLEXISOFT MOD GW with serial number <=2311xxxx with Firmware <=V2.11.0 all have Telnet enabled by factory default. No password is set in the default configuration.
Key phrases: default password
CVE-2023-23452: Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution via maliciously crafted RK512 commands to the listener on TCP port 9000.
Key phrases: achieve arbitrary remote code execution via maliciously crafted, missing authentication
CVE-2023-23453: Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution via maliciously crafted RK512 commands to the listener on TCP port 9000.
Key phrases: achieve arbitrary remote code execution via maliciously crafted, missing authentication
CVE-2023-23454: cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
Key phrases: denial of service (slab-out-of-bounds read), cause a denial of service (slab-, type confusion, out of bounds read
CVE-2023-23455: atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
Key phrases: cause a denial of service because of type, type confusion
CVE-2023-23456: A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
Key phrases: denial of service (abort), cause a denial of service (abort), heap-based buffer overflow, heap based buffer overflow
CVE-2023-23457: A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.
Key phrases: a denial of service, invalid memory address access
CVE-2023-23458: Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request.
Key phrases: cwe-200, unspecified
CVE-2023-23459: Priority Windows may allow Command Execution via SQL Injection using an unspecified method.
Key phrases: Command Execution via SQL Injection using an unspecified, command execution, sql injection
CVE-2023-2346: A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227589 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-23460: Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass.
Key phrases: authentication bypass, parameter manipulation, unspecified
CVE-2023-23461: Libpeconv – access violation, before commit b076013 (30/11/2022).
Key phrases: access violation
CVE-2023-23462: Libpeconv – integer overflow, before commit 75b1565 (30/11/2022).
Key phrases: integer overflow
CVE-2023-23463: Sunell DVR, latest version, Insufficiently Protected Credentials (CWE-522) may be exposed through an unspecified request.
Key phrases: insufficiently protected credentials, unspecified
CVE-2023-23464: Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure.
Key phrases: information disclosure
CVE-2023-23465: Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint.
Key phrases: csrf, unspecified
CVE-2023-23466: Media CP Media Control Panel latest version. Insufficiently protected credential change.
Key phrases: insufficiently protected credential change
CVE-2023-23467: Media CP Media Control Panel latest version. Reflected XSS possible through unspecified endpoint.
Key phrases: reflected xss, unspecified
CVE-2023-23468: IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to insufficient security configuration which may allow creation of namespaces within a cluster.  IBM X-Force ID:  244500.
Key phrases: creation of namespaces within a cluster, security configuration
CVE-2023-23469: IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 244504.
Key phrases: be stored locally which can be read by
CVE-2023-2347: A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227590 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-23470: IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default configurations, as a result of improper SQL processing. By using a specially crafted SQL operation, the administrator could exploit the vulnerability to perform additional administrator operations.  IBM X-Force ID:  244510.
Key phrases: gain elevated privileges, gain elevated privileges in non-default configurations, improper sql processing
CVE-2023-23473: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  245400.
Key phrases: execute malicious and unauthorized actions transmitted from a, cross-site request forgery, cross site request forgery
CVE-2023-23475: IBM Infosphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  245423.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2023-23476: IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some API routes.  IBM X-Force ID:  245425.
Key phrases: unauthorized access, insufficient authorization validation
CVE-2023-23477: IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.  IBM X-Force ID:  245513.
Key phrases: execute arbitrary code, execute arbitrary code on the system with a
CVE-2023-2348: A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227591.
Key phrases: sql injection
CVE-2023-23480: IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  245885.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2023-23481: IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  245889.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, stored cross-site scripting, credentials disclosure
CVE-2023-23482: IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.  IBM X-Force ID:  245891.
Key phrases: hijack the clicking action of the victim
CVE-2023-23487: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging.  IBM X-Force ID:  245918.
Key phrases: insufficient audit logging
CVE-2023-23488: The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.
Key phrases: unauthenticated sql injection
CVE-2023-23489: The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.
Key phrases: sql injection
CVE-2023-2349: A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227592.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-23490: The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json' action.
Key phrases: authenticated sql injection
CVE-2023-23491: The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.
Key phrases: cross-site scripting
CVE-2023-23492: The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action.
Key phrases: authenticated sql injection
CVE-2023-23493: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, macOS Monterey 12.6.3. An encrypted volume may be unmounted and remounted by a different user without prompting for the password.
CVE-2023-23494: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 16.4 and iPadOS 16.4. A user in a privileged network position may be able to cause a denial-of-service.
Key phrases: buffer overflow, denial-of-service, denial of service
CVE-2023-23495: A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14. An app may be able to access sensitive user data.
Key phrases: permissions issue, sensitive information
CVE-2023-23496: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2, watchOS 9.3, iOS 15.7.2 and iPadOS 15.7.2, Safari 16.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution.
Key phrases: arbitrary code execution
CVE-2023-23497: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. An app may be able to gain root privileges.
Key phrases: gain root privileges
CVE-2023-23498: A logic issue was addressed with improved state management. This issue is fixed in iOS 15.7.3 and iPadOS 15.7.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. The quoted original message may be selected from the wrong email when forwarding an email from an Exchange account.
CVE-2023-23499: This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. An app may be able to access user-sensitive data.
Key phrases: user-sensitive data
CVE-2023-2350: A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227593 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-23500: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS 16.3, watchOS 9.3. An app may be able to leak sensitive kernel state.
Key phrases: leak sensitive kernel state
CVE-2023-23501: The issue was addressed with improved memory handling This issue is fixed in macOS Ventura 13.2. An app may be able to disclose kernel memory.
Key phrases: disclose kernel memory
CVE-2023-23502: An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, tvOS 16.3, watchOS 9.3. An app may be able to determine kernel memory layout.
Key phrases: information disclosure issue
CVE-2023-23503: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS 16.3, watchOS 9.3. An app may be able to bypass Privacy preferences.
Key phrases: bypass Privacy preferences, privacy preferences
CVE-2023-23504: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2023-23505: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, iOS 15.7.3 and iPadOS 15.7.3, iOS 16.3 and iPadOS 16.3. An app may be able to access information about a users contacts.
Key phrases: privacy issue
CVE-2023-23506: A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access user-sensitive data.
Key phrases: permissions issue
CVE-2023-23507: The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2023-23508: The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. An app may be able to bypass Privacy preferences.
Key phrases: bypass Privacy preferences, privacy preferences
CVE-2023-2351: The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_admin' function in versions up to, and including, 1.2.3. This makes it possible for authenticated attackers with subscriber-level permissions or above to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0.
Key phrases: install arbitrary plugins, unauthorized modification of data, loss of data, missing capability check
CVE-2023-23510: A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access a users Safari history.
Key phrases: permissions issue
CVE-2023-23511: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, tvOS 16.3, watchOS 9.3. An app may be able to bypass Privacy preferences.
Key phrases: bypass Privacy preferences, privacy preferences
CVE-2023-23512: The issue was addressed with improved handling of caches. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. Visiting a website may lead to an app denial-of-service.
Key phrases: app denial-of-service, denial of service
CVE-2023-23513: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution.
Key phrases: buffer overflow issue, arbitrary code execution
CVE-2023-23514: A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, macOS Big Sur 11.7.5. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code, use after free issue
CVE-2023-23516: The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2023-23517: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, Safari 16.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution.
Key phrases: arbitrary code execution
CVE-2023-23518: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, Safari 16.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution.
Key phrases: arbitrary code execution
CVE-2023-23519: A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. Processing an image may lead to a denial-of-service.
Key phrases: denial-of-service, memory corruption, denial of service
CVE-2023-2352: The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is due to missing or incorrect nonce validation on the chp_abd_action function. This makes it possible for unauthenticated attackers to update or reset plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-23520: A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user may be able to read arbitrary files as root.
Key phrases: read arbitrary files, race condition
CVE-2023-23522: A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Ventura 13.2.1. An app may be able to observe unprotected user data.
Key phrases: unprotected user data
CVE-2023-23523: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Photos belonging to the Hidden Photos Album could be viewed without authentication through Visual Lookup.
Key phrases: logic issue
CVE-2023-23524: A denial-of-service issue was addressed with improved input validation. This issue is fixed in tvOS 16.3.2, iOS 16.3.1 and iPadOS 16.3.1, watchOS 9.3.1, macOS Ventura 13.2.1. Processing a maliciously crafted certificate may lead to a denial-of-service.
Key phrases: denial-of-service issue, denial of service
CVE-2023-23525: This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5. An app may be able to gain root privileges.
Key phrases: gain root privileges
CVE-2023-23526: This was addressed with additional checks by Gatekeeper on files downloaded from an iCloud shared-by-me folder. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. A file from an iCloud shared-by-me folder may be able to bypass Gatekeeper.
Key phrases: bypass Gatekeeper, bypass gatekeeper
CVE-2023-23527: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. A user may gain access to protected parts of the file system.
Key phrases: gain access, protected parts of the file system
CVE-2023-23528: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 16.4, iOS 16.4 and iPadOS 16.4. Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory.
Key phrases: out-of-bounds read, disclosure of process memory, out of bounds read
CVE-2023-23529: A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Key phrases: type confusion issue, arbitrary code execution
CVE-2023-2353: The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd_action function in versions up to, and including, 3.9.4. This makes it possible for subscriber-level attackers to change or reset plugin settings. CVE-2023-36509 appears to be a duplicate of this issue.
Key phrases: unauthorized plugin settings update and reset, missing capability check
CVE-2023-23530: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
Key phrases: execute arbitrary code
CVE-2023-23531: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
Key phrases: execute arbitrary code
CVE-2023-23532: This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.6 and iPadOS 15.7.6. An app may be able to break out of its sandbox.
Key phrases: break out of its sandbox
CVE-2023-23533: A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An app may be able to modify protected parts of the file system.
Key phrases: logic issue
CVE-2023-23534: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5. Processing a maliciously crafted image may result in disclosure of process memory.
Key phrases: disclosure of process memory
CVE-2023-23535: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.6, tvOS 16.4, watchOS 9.4. Processing a maliciously crafted image may result in disclosure of process memory.
Key phrases: disclosure of process memory
CVE-2023-23536: The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2023-23537: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, watchOS 9.4, macOS Big Sur 11.7.5. An app may be able to read sensitive location information.
Key phrases: privacy issue
CVE-2023-23538: A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An app may be able to modify protected parts of the file system.
Key phrases: logic issue
CVE-2023-23539: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution.
Key phrases: buffer overflow issue, arbitrary code execution
CVE-2023-2354: The CHP Ads Block Detector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings reachable though an AJAX action in versions up to, and including, 3.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-23540: The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.4, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2023-23541: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.4 and iPadOS 16.4. An app may be able to access information about a users contacts.
Key phrases: privacy issue
CVE-2023-23542: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to access user-sensitive data.
Key phrases: privacy issue
CVE-2023-23543: The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. A sandboxed app may be able to determine which app is currently using the camera.
CVE-2023-23545: Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote unauthenticated attacker to alter the product settings without authentication. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions).
Key phrases: alter the product settings without authentication, missing authentication for critical function
CVE-2023-23546: A misconfiguration vulnerability exists in the urvpn_client functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Key phrases: misconfiguration, man-in-the-middle, increased privileges, man in the middle
CVE-2023-23547: A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability.
Key phrases: directory traversal, arbitrary file, arbitrary file read
CVE-2023-23548: Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.
Key phrases: reflected xss
CVE-2023-23549: Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hostnames.
Key phrases: cause partial denial of service of the UI, improper input validation, too long hostnames
CVE-2023-2355: Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3900.
Key phrases: local privilege escalation, dll hijacking
CVE-2023-23550: An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.
Key phrases: os command injection, command execution
CVE-2023-23551: Control By Web X-600M devices run Lua scripts and are vulnerable to code injection, which could allow an attacker to remotely execute arbitrary code. 
Key phrases: execute arbitrary code, remotely execute arbitrary code, code injection
CVE-2023-23552: On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: undisclosed requests, increase in memory resource utilization
CVE-2023-23553: Control By Web X-400 devices are vulnerable to a cross-site scripting attack, which could result in private and session information being transferred to the attacker. 
Key phrases: cross-site scripting, session information
CVE-2023-23554: Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm executes functions without specifying schema names. Under certain conditions, pg_ivm may be tricked to execute unexpected functions from other schemas with the IMMV owner's privilege. If this vulnerability is exploited, an unexpected function provided by an attacker may be executed with the privilege of the materialized view owner.
Key phrases: uncontrolled search path element
CVE-2023-23555: On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0, when FastL4 profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: undisclosed traffic