yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-2517: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on the permalink_setup function. This makes it possible for unauthenticated attackers to change the permalink structure via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. While nonce verification is implemented, verification only takes place when a nonce is provided.
Key phrases: cross-site request forgery
CVE-2023-25170: PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
Key phrases: bypass the CSRF protection, cross-site request forgery (csrf), session-fixation, cross site request forgery
CVE-2023-25171: Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.
Key phrases: denial-of-service, smtp resources, denial of service
CVE-2023-25172: Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.
Key phrases: cross-site scripting
CVE-2023-25173: containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `"USER $USERNAME"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups.
Key phrases: bypass primary group restrictions, properly set up supplementary groups, access sensitive information, execute code
CVE-2023-25174: Improper access control in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2023-25175: Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access.
Key phrases: enable information disclosure via local access, improper input validation
CVE-2023-25176: in OpenHarmony v3.2.4 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
Key phrases: a local attacker cause information leak through out, out-of-bounds read, out of bounds read
CVE-2023-25177: Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
Key phrases: execute arbitrary code, stack-based buffer overflow, stack based buffer overflow
CVE-2023-25178: Controller may be loaded with malicious firmware which could enable remote code execution
Key phrases: remote code execution
CVE-2023-25179: Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, uncontrolled resource consumption
CVE-2023-2518: The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Key phrases: reflected cross-site scripting
CVE-2023-25181: A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted set of network packets can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability.
Key phrases: heap-based buffer overflow, arbitrary code execution, heap based buffer overflow
CVE-2023-25182: Uncontrolled search path element in the Intel(R) Unite(R) Client software for Mac before version 4.2.11 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path element, escalation privilege
CVE-2023-25183: In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub device.
Key phrases: execute arbitrary commands, execute arbitrary commands on the hub device
CVE-2023-25184: Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, and SkySpider MB-R210 firmware Ver. 1.01.00 and earlier.
Key phrases: decrypt password for the WebUI of the product, weak credentials
CVE-2023-25185: An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software releases. Certain software processes in the BTS internal software design have unnecessarily high privileges to BTS embedded operating system (OS) resources.
CVE-2023-25186: An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from a Nokia Single RAN BTS baseband unit, a directory path traversal in the Nokia BTS baseband unit diagnostic tool AaShell (which is by default disabled) provides access to the BTS baseband unit internal filesystem from the mobile network solution internal BTS management network.
Key phrases: directory path traversal
CVE-2023-25187: An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factory-time installed) default SSH public/private key values that are specific to a network operator. As a result, the CSP internal BTS network SSH server (disabled by default) continues to apply the default SSH public/private key values. These keys don't give access to BTS, because service user authentication is username/password-based on top of SSH. Nokia factory installed default SSH keys are meant to be changed from operator-specific values during the BTS deployment commissioning phase. However, before the 21B release, BTS commissioning manuals did not provide instructions to change default SSH keys (to BTS operator-specific values). This leads to a possibility for malicious operations staff (inside a CSP network) to attempt MITM exploitation of BTS service user access, during the moments that SSH is enabled for Nokia service personnel to perform troubleshooting activities.
Key phrases: mitm exploitation
CVE-2023-25188: An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from the Nokia Single RAN BTS baseband unit, the BTS baseband unit diagnostic tool AaShell (which is by default disabled) allows unauthenticated access from the mobile network solution internal BTS management network to the BTS embedded Linux operating-system level.
Key phrases: the BTS embedded Linux operating-system level, unauthenticated access
CVE-2023-2519: A vulnerability has been found in Caton CTP Relay Server 1.2.9 and classified as critical. This vulnerability affects unknown code of the file /server/api/v1/login of the component API. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. VDB-228010 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: caton ctp relay server, sql injection, disclosure
CVE-2023-25191: AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-update-5.00.
Key phrases: Password Disclosure through Redfish, password disclosure
CVE-2023-25192: AMI MegaRAC SPX devices allow User Enumeration through Redfish. The fixed versions are SPx12-update-7.00 and SPx13-update-5.00.
Key phrases: User Enumeration through Redfish, user enumeration
CVE-2023-25193: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
Key phrases: trigger O(n^2) growth via consecutive marks during
CVE-2023-25194: A possible security vulnerability has been identified in Apache Kafka Connect API.This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS configand a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.When configuring the connector via the Kafka Connect REST API, anauthenticated operatorcan set the `sasl.jaas.config`property for any of the connector's Kafka clientsto "com.sun.security.auth.module.JndiLoginModule", which can be done via the`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.This will allow the server to connect to the attacker's LDAP serverand deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.Attacker can cause unrestricted deserialization of untrusted data (or)RCE vulnerability when there are gadgets in the classpath.Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-boxconfigurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connectorclient override policy that permits them.Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usagein SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0. We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally,in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connectorclient config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.
Key phrases: connect to the attacker's LDAP serverand deserialize, leveraging the "org.apache.kafka.disallowed.login.modules" system property, java deserialization gadget chains, rce, deserialization of untrusted data
CVE-2023-25195: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract.Authorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic.This issue affects Apache Fineract: from 1.4 through 1.8.3.
Key phrases: gain access, server-side request forgery (ssrf)
CVE-2023-25196: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache Fineract.Authorized users may be able to change or add data in certain components. This issue affects Apache Fineract: from 1.4 through 1.8.2.
Key phrases: sql command, sql injection
CVE-2023-25197: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation apache fineract.Authorized users may be able to exploit this for limited impact on components. This issue affects apache fineract: from 1.4 through 1.8.2.
Key phrases: sql command, sql injection, limited impact on components
CVE-2023-2520: A vulnerability was found in Caton Prime 2.1.2.51.e8d7225049(202303031001) and classified as critical. This issue affects some unknown processing of the file cgi-bin/tools_ping.cgi?action=Command of the component Ping Handler. The manipulation of the argument Destination leads to command injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-228011. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: command injection, disclosure
CVE-2023-25201: Cross Site Request Forgery (CSRF) vulnerability in MultiTech Conduit AP MTCAP2-L4E1 MTCAP2-L4E1-868-042A v.6.0.0 allows a remote attacker to execute arbitrary code via a crafted script upload.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script upload, cross site request forgery (csrf)
CVE-2023-25206: PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.
Key phrases: sql injection
CVE-2023-25207: PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
Key phrases: sql injection
CVE-2023-2521: A vulnerability was found in NEXTU NEXT-7004N 3.0.1. It has been classified as problematic. Affected is an unknown function of the file /boafrm/formFilter of the component POST Request Handler. The manipulation of the argument url with the input <svg onload=alert(1337)> leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-228012. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross-site scripting, disclosure
CVE-2023-25210: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromSetSysTime function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-25211: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the R7WebsSecurityHandler function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-25212: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromSetWirelessRepeat function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-25213: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the check_param_changed function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-25214: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the setSchedWifi function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-25215: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the saveParentControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-25216: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the formSetFirewallCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-25217: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the formWifiBasicSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-25218: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-25219: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromDhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-2522: A vulnerability was found in Chengdu VEC40G 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=access_detect of the component Network Detection. The manipulation of the argument COUNT with the input 3 | netstat -an leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228013 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: os command injection, disclosure
CVE-2023-25220: Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the add_white_node function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2023-25221: Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function in motion.cc.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2023-25222: A heap-based buffer overflow vulnerability exits in GNU LibreDWG v0.12.5 via the bit_read_RC function at bits.c.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2023-25223: CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.
Key phrases: sql injection
CVE-2023-2523: A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax.php?action=mobile_upload_save. The manipulation of the argument upload_quwan leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228014 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: unrestricted upload, disclosure
CVE-2023-25230: A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hook_url parameter.
Key phrases: make arbitrary requests, force the application to make arbitrary requests via, server-side request forgery (ssrf)
CVE-2023-25231: Tenda Router W30E V1.0.1.25(633) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface.
Key phrases: buffer overflow
CVE-2023-25233: Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface.
Key phrases: buffer overflow
CVE-2023-25234: Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInterface.
Key phrases: buffer overflow
CVE-2023-25235: Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function formOneSsidCfgSet via parameter ssid.
Key phrases: buffer overflow
CVE-2023-2524: A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/#/. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-228015. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: disclosure
CVE-2023-25240: An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, samesite attribute
CVE-2023-25241: bgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-2526: The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to executes AJAX actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-25260: Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.
Key phrases: local file inclusion
CVE-2023-25261: Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 2023.1.4 and Stimulsoft Designer (Web) 2023.1.3 and Stimulsoft Viewer (Web) 2023.1.3. Access to the local file system is not prohibited in any way. Therefore, an attacker may include source code which reads or writes local directories and files. It is also possible for the attacker to prepare a report which has a variable that holds the gathered data and render it in the report.
Key phrases: remote code execution
CVE-2023-25262: Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather than the client. Therefore, the server causes outbound traffic and potentially imports data. An attacker may also leverage this behaviour to exfiltrate data of machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).
Key phrases: server side request forgery (ssrf), outbound traffic
CVE-2023-25263: In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not differ between the tested versions and different operating systems.
CVE-2023-25264: An issue was discovered in Docmosis Tornado prior to version 2.9.5. An unauthenticated attacker can bypass the authentication check filter completely by introducing a specially crafted request with relative path segments.
Key phrases: bypass the authentication, bypass authentication
CVE-2023-25265: Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the file system.
Key phrases: directory traversal, disclosure of arbitrary content
CVE-2023-25266: An issue was discovered in Docmosis Tornado prior to version 2.9.5. An authenticated attacker can change the Office directory setting pointing to an arbitrary remote network path. This triggers the execution of the soffice binary under the attackers control leading to arbitrary remote code execution (RCE).
Key phrases: arbitrary remote code execution (rce)
CVE-2023-25267: An issue was discovered in GFI Kerio Connect 9.4.1 patch 1 (fixed in 10.0.0). There is a stack-based Buffer Overflow in the webmail component's 2FASetup function via an authenticated request with a long primaryEMailAddress field to the webmail/api/jsonrpc URI.
Key phrases: buffer overflow
CVE-2023-2527: The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Key phrases: sql injection
CVE-2023-25279: OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.
Key phrases: escalate privileges to root via a crafted payload, os command injection
CVE-2023-2528: The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to execute AJAX actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-25280: OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
Key phrases: escalate privileges to root via a crafted payload, os command injection
CVE-2023-25281: A stack overflow vulnerability exists in pingV4Msg component in D-Link DIR820LA1_FW105B03, allows attackers to cause a denial of service via the nextPage parameter to ping.ccp.
Key phrases: cause a denial of service via the nextPage, stack overflow
CVE-2023-25282: A heap overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the config.log_to_syslog and log_opt_dropPackets parameters to mydlink_api.ccp.
Key phrases: cause a denial of service via the config.log_to_syslog, heap overflow
CVE-2023-25283: A stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1.0 parameter to lan.asp.
Key phrases: cause a denial of service via the reserveDHCP_HostName_1.1.1.0, stack overflow
CVE-2023-25289: Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1_rtm.101119-1850 6.1.7601.1.0.65792 in embedded web server, allows attacker to gain sensitive information via a crafted GET request.
Key phrases: gain sensitive information, gain sensitive information via a crafted GET request, directory traversal
CVE-2023-2529: The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Key phrases: upload a malicious SVG containing XSS payloads, xss payloads
CVE-2023-25292: Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie.
Key phrases: gain escalated privileges, gain sensitive information, gain escalated privileges and gain sensitive information via, reflected cross site scripting (xss), escalate privilege
CVE-2023-25295: A Cross Site Scripting (XSS) vulnerability in evewa3ajax.php in GRUEN eVEWA3 Community 31 through 53 allows attackers to obtain escalated privileges via a crafted request to the login panel.
Key phrases: obtain escalated privileges, obtain escalated privileges via a crafted request to, cross site scripting (xss), escalate privilege
CVE-2023-2530: A privilege escalation allowing remote code execution was discovered in the orchestration service.
Key phrases: remote code execution was discovered in the orchestration, privilege escalation
CVE-2023-25303: ATLauncher <= 3.4.26.0 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation directory.
Key phrases: create arbitrary files, directory traversal
CVE-2023-25304: An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack file.
Key phrases: perform a directory traversal via importing a crafted
CVE-2023-25305: PolyMC Launcher <= 1.4.3 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation directory.
Key phrases: create arbitrary files, directory traversal
CVE-2023-25306: MultiMC Launcher <= 0.6.16 is vulnerable to Directory Traversal.
Key phrases: directory traversal
CVE-2023-25307: nothub mrpack-install <= v0.16.2 is vulnerable to Directory Traversal.
Key phrases: directory traversal
CVE-2023-25309: Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted url to, cross site scripting (xss)
CVE-2023-2531: Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.
Key phrases: improper restriction, excessive authentication attempts
CVE-2023-25313: OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.
Key phrases: execute arbitrary code, execute arbitrary code via the video link field, os injection
CVE-2023-25314: Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user.
Key phrases: gain sensitive information, gain sensitive information via the success parameter to, cross site scripting (xss)
CVE-2023-2533: A Cross-Site Request Forgery (CSRF) vulnerability has been identified inPaperCut NG/MF, which, under specific conditions, could potentially enablean attacker to alter security settings or execute arbitrary code. This couldbe exploited if the target is an admin with a current login session. Exploitingthis would typically involve the possibility of deceiving an admin into clickinga specially crafted malicious link, potentially leading to unauthorized changes.
Key phrases: execute arbitrary code, cross-site request forgery (csrf), unauthorized changes
CVE-2023-25330: A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the tenant ID, sql injection
CVE-2023-2534: Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into overall system usage. User IDs can easily be correlated with real names e. g. viaticket histories by any user. (Fuzzing for garnering other adjacent user/sensitive data).Subscribing to all possible push events could also lead to performance implications on the server side, depending on the size of the installationand the number of active users. (Flooding)This issue affects OTRS: from 8.0.X before 8.0.32.
Key phrases: gain live insight into overall system usage. User IDs, track user behaviour and to gain live insight, improper authorization, fuzzing, performance implications, flooding
CVE-2023-25341: A Directory Traversal vulnerability in ladle dev server 2.5.1 and earlier allows an attacker on the same network to read files accessible to the user via GET requests.
Key phrases: read files accessible to the user via GET, directory traversal
CVE-2023-25344: An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous function.
Key phrases: execute arbitrary code, execute arbitrary code via crafted Object.prototype anonymous function
CVE-2023-25345: Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.
Key phrases: read arbitrary files, read arbitrary files via the include or extends, directory traversal
CVE-2023-25346: A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, reflected cross-site scripting (xss)
CVE-2023-25347: A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via input, stored cross-site scripting (xss)
CVE-2023-25348: ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted excel file, csv injection
CVE-2023-25350: Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection.
Key phrases: sql injection
CVE-2023-25355: CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions. A user who has the ability to run commands as the `daemon` user on a sipXcom server can overwrite a service file, and escalate their privileges to `root`.
Key phrases: insecure permissions, run commands, escalate privilege
CVE-2023-25356: CoreDial sipXcom up to and including 21.04 is vulnerable to Improper Neutralization of Argument Delimiters in a Command. XMPP users are able to inject arbitrary arguments into a system command, which can be used to read files from, and write files to, the sipXcom server. This can also be leveraged to gain remote command execution.
Key phrases: inject arbitrary arguments, gain remote command execution, improper neutralization of argument delimiters, file write, to write files
CVE-2023-25358: A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Key phrases: execute code remotely, use-after-free, use after free
CVE-2023-25360: A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Key phrases: execute code remotely, use-after-free, use after free
CVE-2023-25361: A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Key phrases: execute code remotely, use-after-free, use after free
CVE-2023-25362: A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Key phrases: execute code remotely, use-after-free, use after free
CVE-2023-25363: A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Key phrases: execute code remotely, use-after-free, use after free
CVE-2023-25364: Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks.
Key phrases: html injection, xss
CVE-2023-25365: Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3
Key phrases: execute arbitrary code, execute arbitrary code via the file type .mp3, cross site scripting
CVE-2023-25366: In Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password.
Key phrases: scpi interface
CVE-2023-25367: Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution (RCE) with SCPI interface or web server.
Key phrases: unfiltered user input resulting in Remote Code Execution, remote code execution (rce)
CVE-2023-25368: Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Incorrect Access Control. An unauthenticated attacker can overwrite firmnware.
Key phrases: incorrect access control, overwrite
CVE-2023-25369: Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Denial of Service on the user interface triggered by malformed SCPI command.
Key phrases: ads, denial of service, malformed scpi command
CVE-2023-2538: A CWE-552 "Files or Directories Accessible to External Parties” in the web interface of the Tyan S5552 BMC version 3.00 allows an unauthenticated remote attacker to retrieve the private key of the TLS certificate in use by the BMC via forced browsing. This can then be abused to perform Man-in-the-Middle (MitM) attacks against victims that access the web interface through HTTPS.
Key phrases: retrieve the private key of the TLS certificate, cwe-552, man-in-the-middle (mitm)
CVE-2023-25392: Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.
Key phrases: missing ssl certificate validation
CVE-2023-25394: Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition. The Updater privileged script attempts to update Videostream every 5 hours.
Key phrases: race condition
CVE-2023-25395: TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules.
Key phrases: command injection
CVE-2023-25396: Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files.
Key phrases: access and manipulate system files, privilege escalation
CVE-2023-25399: A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.
Key phrases: memory leak
CVE-2023-25402: CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix of the uploaded file, resulting in any file upload.
Key phrases: file upload
CVE-2023-25403: CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication.
Key phrases: bypass authentication, Authentication Bypass, authentication bypass
CVE-2023-25407: Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access to administrator credentials.
Key phrases: incorrect access control
CVE-2023-25409: Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have access to other users outlets.
Key phrases: incorrect access control
CVE-2023-2541: The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. No personal information or application data was exposed.
Key phrases: access internals about the application such as versions
CVE-2023-25411: Aten PE8108 2.4.232 is vulnerable to Cross Site Request Forgery (CSRF).
Key phrases: cross site request forgery (csrf)
CVE-2023-25413: Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Telnet and SNMP credentials.
Key phrases: Telnet and SNMP credentials, incorrect access control, unauthenticated access
CVE-2023-25414: Aten PE8108 2.4.232 is vulnerable to denial of service (DOS).
Key phrases: denial of service (DOS), denial of service (dos)
CVE-2023-25415: Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Event Notification configuration.
Key phrases: Event Notification configuration, incorrect access control, unauthenticated access
CVE-2023-25428: A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leading to code execution.
Key phrases: create arbitrary DLLs, create arbitrary DLLs leading to code execution, dll hijacking
CVE-2023-25431: An issue was discovered in Online Reviewer Management System v1.0. There is a XSS vulnerability via reviewer_0/admins/assessments/course/course-update.php.
Key phrases: xss
CVE-2023-25432: An issue was discovered in Online Reviewer Management System v1.0. There is a SQL injection that can directly issue instructions to the background database system via reviewer_0/admins/assessments/course/course-update.php.
Key phrases: sql injection
CVE-2023-25433: libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.
Key phrases: buffer overflow, heap-buffer-overflow, segv, heap buffer overflow
CVE-2023-25434: libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.
Key phrases: buffer overflow
CVE-2023-25435: libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753.
Key phrases: buffer overflow
CVE-2023-25437: An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cleartext passwords passed in the raw HTML.
Key phrases: gain escalated privileges, gain sensitive information, gain escalated privileges and gain sensitive information due, cleartext passwords, escalate privilege
CVE-2023-25438: An issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute arbitrary code and gain escalated privileges via modifying specific files.
Key phrases: execute arbitrary code, gain escalated privileges, execute arbitrary code and gain escalated privileges via, escalate privilege
CVE-2023-25439: Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content fields to the expenses, tasks, and customer details.
Key phrases: execute arbitrary code, execute arbitrary code via the description or content, stored cross site scripting (xss)
CVE-2023-2544: Authorization bypass vulnerability in UPV PEIX, affecting the component "pdf_curri_new.php". Through a POST request, an authenticated user could change the ID parameter to retrieve all the stored information of other registered users.
Key phrases: Authorization bypass, authorization bypass, stored information
CVE-2023-25440: Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.
Key phrases: execute arbitrary code, execute arbitrary code in first/second name, stored cross site scripting (xss)
CVE-2023-25442: Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Marcel Pol Zeno Font Resizer plugin <= 1.7.9 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25443: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25447: Cross-Site Request Forgery (CSRF) vulnerability in Inkthemescom ColorWay theme <=4.2.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25448: Cross-Site Request Forgery (CSRF) vulnerability in Eric Teubert Archivist  Custom Archive Templates plugin <=1.7.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25449: Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-2545: The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to access the login links, which can be used for privilege escalation.
Key phrases: unauthorized access of data, missing capability check, privilege escalation
CVE-2023-25450: Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-25451: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPChill CPO Content Types plugin <=1.1.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25452: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Pretty (prettyboymp) CMS Press plugin <=0.2.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25453: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ian Sadovy WordPress Tables plugin <=1.3.9 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-25456: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Klaviyo, Inc. Klaviyo plugin <= 3.0.7 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25458: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GMO Internet Group, Inc. TypeSquare Webfonts for ConoHa plugin <=2.0.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-25459: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Postsnippets Post Snippets plugin <= 4.0.2 versions.
Key phrases: stored cross-site scripting (xss)