yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-44809: D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.
Key phrases: insecure permissions
CVE-2023-4481: An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).When certain specific crafted BGP UPDATE messages are received over an established BGP session, one BGP session may be torn down with an UPDATE message error, or the issue may propagate beyond the local system which will remain non-impacted, but may affect one or more remote systems. This issue is exploitable remotely as the crafted UPDATE message can propagate through unaffected systems and intermediate BGP speakers.Continuous receipt of the crafted BGP UPDATE messages will create a sustained Denial of Service (DoS) condition for impacted devices.This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations.  This issue requires a remote attacker to have at least one established BGP session.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS).When certain, improper input validation, non-impacted, impacted devices
CVE-2023-44811: Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code and obtain sensitive information via, cross site request forgery (csrf)
CVE-2023-44812: Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting (xss)
CVE-2023-44813: Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting (xss)
CVE-2023-4482: The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-44821: Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.
Key phrases: denial of service (memory consumption), affect Gif_Realloc calls, link it into another application as a library, untrusted input
CVE-2023-44824: An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted file uploaded
CVE-2023-44826: Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted script, cross site scripting
CVE-2023-44827: An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to
CVE-2023-44828: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the CurrentPassword parameter in the CheckPasswdSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44829: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the AdminPassword parameter in the SetDeviceSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44830: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the EndTime parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44831: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Type parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44832: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the MacAddress parameter in the SetWanSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44833: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the GuardInt parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44834: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the StartTime parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44835: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Mac parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44836: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44837: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Password parameter in the SetWanSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44838: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the TXPower parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44839: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Encryption parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-44846: An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component.
Key phrases: execute arbitrary code, execute arbitrary code via the admin_ notify.php
CVE-2023-44847: An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ Weixin.php component.
Key phrases: execute arbitrary code, execute arbitrary code via the admin_ Weixin.php
CVE-2023-44848: An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component.
Key phrases: execute arbitrary code, execute arbitrary code via the admin_template.php component
CVE-2023-4485: ARDEREG?Sistema SCADA Central versions 2.203 and priorlogin page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, the vulnerability could allow an attacker to execute arbitrary SQL queries through the login page, potentially leading to unauthorized access, data leakage, or even disruption of critical industrial processes.
Key phrases: execute arbitrary SQL, execute arbitrary SQL queries through the login page, unauthenticated blind sql injection, data leakage, disruption of critical industrial processes, sensitive information, unauthorized access
CVE-2023-4486: Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
Key phrases: invalid authentication credentials, denial-of-service, denial of service
CVE-2023-44860: An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request.
Key phrases: cause a denial of service via the authorization
CVE-2023-4487: GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to escalate privileges and gain full control of the HMI software.
Key phrases: gain full control, insert malicious configuration files in the expected web, process control, escalate privileges
CVE-2023-4488: The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other safe file types can be uploaded and included.
Key phrases: execute arbitrary files, bypass access controls, obtain sensitive data, include and execute arbitrary files on the server, local file inclusion, code execution
CVE-2023-4489: The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access. 
Key phrases: network key prediction and unauthorized S0 network access
CVE-2023-4490: The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
Key phrases: sql injection, exploitable
CVE-2023-4491: Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long username string to /searchbook.ghp, asking for the name via a POST request, resulting in arbitrary code execution on the remote machine.
Key phrases: send a very long username string to /searchbook.ghp, buffer overflow, arbitrary code execution
CVE-2023-4492: Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters (firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate and workzip) of the /addrbook.ghp file, allowing an attacker to inject a JavaScript payload specially designed to run when the application is loaded
Key phrases: inject a JavaScript payload specially designed to run
CVE-2023-4493: Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the users_admin.ghp file that affects multiple parameters such as (firstname, homephone, lastname, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, workzip). This vulnerability allows a remote attacker to store a malicious JavaScript payload in the application to be executed when the page is loaded, resulting in an integrity impact.
Key phrases: store a malicious JavaScript payload in the application, cross-site scripting, integrity impact
CVE-2023-4494: Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file asking for the name via a GET request resulting in arbitrary code execution on the remote machine.
Key phrases: stack-based buffer overflow, arbitrary code execution, stack based buffer overflow
CVE-2023-4495: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Resume parameter. The XSS is loaded from /register.ghp.
Key phrases: cross-site scripting (xss)
CVE-2023-44954: Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings functions.
Key phrases: execute arbitrary code, execute arbitrary code via the ID parameter in, cross site scripting
CVE-2023-44959: An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Address fields of the network settings page.
Key phrases: execute arbitrary code, execute arbitrary code as root via the Router
CVE-2023-4496: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /body2.ghp (POST method), in the mtowho parameter.
Key phrases: cross-site scripting (xss)
CVE-2023-44961: SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. component.
Key phrases: obtain sensitive information, obtain sensitive information via the intranet/cgi, sql injection
CVE-2023-44962: File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component.
Key phrases: read arbitrary files, read arbitrary files via the upload-cover-image.pl component, file upload, arbitrary file upload
CVE-2023-4497: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Icon parameter. The XSS is loaded from /users.ghp.
Key phrases: cross-site scripting (xss)
CVE-2023-44973: An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted PHP, arbitrary file upload
CVE-2023-44974: An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted PHP, arbitrary file upload
CVE-2023-4498: Tenda N300 Wireless N VDSL2 Modem Router allows unauthenticated access to pages that in turn should be accessible to authenticated users only
Key phrases: pages that in turn should be accessible to, unauthenticated access
CVE-2023-44981: Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped.As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree.Quorum Peer authentication is not enabled by default.Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.See the documentation for more details on correct cluster administration.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass through user-controlled key
CVE-2023-44982: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This issue affects Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): from n/a through 6.4.5.
Key phrases: exposure of sensitive information
CVE-2023-44983: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.6.
Key phrases: exposure of sensitive information
CVE-2023-44984: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <=5.6.7 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-44985: Auth. (contributo+) Stored Cross-Site Scripting (XSS) vulnerability in Cytech BuddyMeet plugin <=2.2.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-44986: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Abandoned Cart Lite for WooCommerce plugin <=5.15.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-44987: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Timely - Appointment software Timely Booking Button plugin <=2.0.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-44989: Insertion of Sensitive Information into Log File vulnerability in GSheetConnector CF7 Google Sheets Connector.This issue affects CF7 Google Sheets Connector: from n/a through 5.0.5.
Key phrases: insertion of sensitive information into log file
CVE-2023-4499: A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download Tool) which may lead to information disclosure. HP is releasing mitigation for the potential vulnerability.
Key phrases: information disclosure
CVE-2023-44990: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF  WordPress Posts Bulk Editor and Manager Professional plugin <=1.0.7.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-44991: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Media File Renamer: Rename Files (Manual, Auto & AI).This issue affects Media File Renamer: Rename Files (Manual, Auto & AI): from n/a through 5.6.9.
Key phrases: exposure of sensitive information
CVE-2023-44993: Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <=4.7.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-44994: Cross-Site Request Forgery (CSRF) vulnerability in Bainternet ShortCodes UI plugin <=1.9.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-44995: Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect plugin <=2.2.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-44996: Cross-Site Request Forgery (CSRF) vulnerability in Naresh Parmar Post View Count plugin <=1.8.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-44997: Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha plugin <=4.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-44998: Cross-Site Request Forgery (CSRF) vulnerability in josecoelho, Randy Hoyt, steveclarkcouk, Vitaliy Kukin, Eric Le Bail, Tom Ransom Category Meta plugin plugin <=1.2.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-44999: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.0.
Key phrases: cross-site request forgery (csrf)
CVE-2023-4500: The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers (admin or higher) to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-45001: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Castos Seriously Simple Stats allows SQL Injection.This issue affects Seriously Simple Stats: from n/a through 1.5.0.
Key phrases: SQL Injection, sql command, sql injection
CVE-2023-45003: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin <=2.2.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-45004: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wp3sixty Woo Custom Emails plugin <=2.2 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-45005: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Castos Seriously Simple Stats plugin <=1.5.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-45006: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ByConsole WooODT Lite  WooCommerce Order Delivery or Pickup with Date Time Location plugin <=2.4.6 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-45007: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fotomoto plugin <=1.2.8 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-45008: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <=1.0.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-4501: User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user.Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon.Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.
Key phrases: the product to impersonate any user
CVE-2023-45010: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex MacArthur Complete Open Graph plugin <=3.4.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-45011: Cross-Site Request Forgery (CSRF) vulnerability in Igor Buyanov WP Power Stats plugin <=2.2.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45012: Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.The 'user_email' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-45015: Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'date' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-45018: Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the includes/login.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-45019: Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-4502: The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, multiple parameters
CVE-2023-45024: Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder.
Key phrases: Information Disclosure via a transaction search in the, information disclosure
CVE-2023-45025: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQTS 4.5.4.2627 build 20231225 and laterQuTS hero h5.1.4.2596 build 20231128 and laterQuTS hero h4.5.4.2626 build 20231225 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute commands via a network, os command injection
CVE-2023-45026: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.5.2645 build 20240116 and laterQuTS hero h5.1.5.2647 build 20240118 and laterQuTScloud c5.1.5.2651 and later
Key phrases: read the contents of unexpected files and expose, path traversal
CVE-2023-45027: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.5.2645 build 20240116 and laterQuTS hero h5.1.5.2647 build 20240118 and laterQuTScloud c5.1.5.2651 and later
Key phrases: read the contents of unexpected files and expose, path traversal
CVE-2023-45028: An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.5.2645 build 20240116 and laterQuTS hero h5.1.5.2647 build 20240118 and laterQuTScloud c5.1.5.2651 and later
Key phrases: launch a denial-of-service (, uncontrolled resource consumption, denial-of-service (dos), denial of service
CVE-2023-4503: An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.
Key phrases: access remote HTTP services available from the server, improper initialization
CVE-2023-45035: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-45036: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.3.2578 build 20231110 and laterQuTS hero h5.1.3.2578 build 20231110 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-45037: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.3.2578 build 20231110 and laterQuTS hero h5.1.3.2578 build 20231110 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-45039: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-4504: Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.
Key phrases: heap-based buffer overflow, code execution, heap based buffer overflow
CVE-2023-45040: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-45041: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-45042: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-45043: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-45044: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-45046: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressference Pressference Exporter allows SQL Injection.This issue affects Pressference Exporter: from n/a through 1.0.3.
Key phrases: SQL Injection, sql injection
CVE-2023-45047: Cross-Site Request Forgery (CSRF) vulnerability in LeadSquared, Inc LeadSquared Suite plugin <=0.7.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45048: Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <=5.00 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45049: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <=4.6.7 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-4505: The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.
Key phrases: ldap passback
CVE-2023-45050: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack  WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack  WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1.
Key phrases: Stored XSS.This issue affects Jetpack  WP Security, cross-site scripting, stored xss
CVE-2023-45051: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <=9.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-45052: Cross-Site Request Forgery (CSRF) vulnerability in dan009 WP Bing Map Pro plugin <5.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45054: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <=2.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-45055: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InspireUI MStore API allows SQL Injection.This issue affects MStore API: from n/a through 4.0.6.
Key phrases: SQL Injection, sql injection
CVE-2023-45056: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <=1.3.26 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-45057: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <=5.86 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-45058: Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Short URL plugin <=1.6.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45059: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <=3.1.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-4506: The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.
Key phrases: ldap passback
CVE-2023-45060: Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com Interactive World Map plugin <=3.2.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45062: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <=2.4.6 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-45063: Cross-Site Request Forgery (CSRF) vulnerability in ReCorp AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One plugin <=1.1.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45064: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <=0.3.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-45065: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit plugin <=1.42 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-45066: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Key phrases: exposure of sensitive information
CVE-2023-45067: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <=2.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-45068: Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <=1.7.27 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45069: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Video Gallery by Total-Soft Video Gallery  Best WordPress YouTube Gallery Plugin allows SQL Injection.This issue affects Video Gallery  Best WordPress YouTube Gallery Plugin: from n/a through 2.1.3.
Key phrases: SQL Injection, sql command, sql injection
CVE-2023-45070: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web  Mobile-Friendly Drag & Drop Contact Form Builder plugin <=1.15.18 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-45071: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web  Mobile-Friendly Drag & Drop Contact Form Builder plugin <=1.15.18 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-45072: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <=1.2.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-45073: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Koch Mendeley Plugin plugin <=1.3.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-45074: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter  Most Wanted Analytics Plugin for WordPress allows SQL Injection.This issue affects Advanced Page Visit Counter  Most Wanted Analytics Plugin for WordPress: from n/a through 7.1.1.
Key phrases: SQL Injection, sql injection
CVE-2023-45075: A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
Key phrases: write to NVRAM variables, memory leakage
CVE-2023-45076: A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
Key phrases: write to NVRAM variables, memory leakage
CVE-2023-45077: A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. 
Key phrases: write to NVRAM variables, memory leakage
CVE-2023-45078: A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables. 
Key phrases: write to NVRAM variables, memory leakage
CVE-2023-45079: A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables. 
Key phrases: write to NVRAM variables, memory leakage
CVE-2023-4508: A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS-274X file.
Key phrases: file input, crash, denial-of-service, denial of service
CVE-2023-45083: An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane.An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently succeeding.This issue affects HyperCloud versions 1.0 to any release before 2.1.
Key phrases: improper privilege management
CVE-2023-45084: An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw, which impacts data availability and integrity.This issue only impacts SoftIron HyperCloud "density" storage nodes running HyperCloud software versions 1.0 to before 2.0.3.
Key phrases: synchronization flaw, data availability, integrity, reboot
CVE-2023-45085: An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which impacts the availability of these workloads that may be deployed during this time window.This issue impacts HyperCloud versions from 2.0.0 to before 2.0.3.
Key phrases: availability
CVE-2023-45102: Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Blog Manager Light plugin <=1.20 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45103: Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Permalinks Customizer plugin <=2.8.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45105: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SERVIT Software Solutions affiliate-toolkit  WordPress Affiliate Plugin.This issue affects affiliate-toolkit  WordPress Affiliate Plugin: from n/a through 3.3.9.
Key phrases: url redirection, open redirect
CVE-2023-45106: Cross-Site Request Forgery (CSRF) vulnerability in Fedor Urvanov, Aram Kocharyan Urvanov Syntax Highlighter plugin <=2.8.33 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45107: Cross-Site Request Forgery (CSRF) vulnerability in GoodBarber plugin <=1.0.22 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45108: Cross-Site Request Forgery (CSRF) vulnerability in Mailrelay plugin <=2.1.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-45109: Cross-Site Request Forgery (CSRF) vulnerability in ZAKSTAN WhitePage plugin <=1.1.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-4511: BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
Key phrases: denial of service via packet injection or crafted, infinite loop
CVE-2023-45111: Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.The 'email' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database.
Key phrases: unauthenticated sql injection
CVE-2023-45115: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.The 'ch' parameter of the/update.php?q=addqnsresourcedoes not validate the characters received and theyare sent unfiltered to the database.
Key phrases: authenticated sql injection
CVE-2023-45116: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.The 'demail' parameter of the /update.php resourcedoes not validate the characters received and theyare sent unfiltered to the database.
Key phrases: authenticated sql injection
CVE-2023-45117: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.The 'eid' parameter of the /update.php?q=rmquiz resourcedoes not validate the characters received and theyare sent unfiltered to the database.
Key phrases: authenticated sql injection
CVE-2023-45118: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.The 'fdid' parameter of the /update.php resourcedoes not validate the characters received and theyare sent unfiltered to the database.
Key phrases: authenticated sql injection
CVE-2023-45119: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.The 'n' parameter of the /update.php?q=quiz resourcedoes not validate the characters received and theyare sent unfiltered to the database.
Key phrases: authenticated sql injection
CVE-2023-4512: CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file
Key phrases: denial of service via packet injection or crafted, cbor dissector crash
CVE-2023-45120: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.The 'qid' parameter of the /update.php?q=quiz&step=2 resourcedoes not validate the characters received and theyare sent unfiltered to the database.
Key phrases: authenticated sql injection
CVE-2023-45121: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.The 'desc' parameter of the /update.php?q=addquiz resourcedoes not validate the characters received and theyare sent unfiltered to the database.
Key phrases: authenticated sql injection