yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-3800: A vulnerability was found in EasyAdmin8 2.0.2.2. It has been classified as problematic. Affected is an unknown function of the file /admin/index/index.html#/admin/mall.goods/index.html of the component File Upload Module. The manipulation leads to unrestricted upload. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235068. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: unrestricted upload, disclosure
CVE-2023-38000: Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.
Key phrases: cross-site scripting (xss)
CVE-2023-38003: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a user with DATAACCESS privileges to execute routines that they should not have access to.  IBM X-Force ID:  260214.
Key phrases: execute routines that they should not have access
CVE-2023-3801: A vulnerability was found in IBOS OA 4.5.5. It has been declared as critical. Affected by this vulnerability is the function actionEdit of the file ?r=officialdoc/officialdoc/edit of the component Mobile Notification Handler. The manipulation leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-235069 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: sql injection, disclosure
CVE-2023-38019: IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  260575.
Key phrases: view arbitrary files, traverse directories on the system
CVE-2023-3802: A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Controller/Ajaxfileupload.ashx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235070 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: unrestricted upload, disclosure
CVE-2023-38020: IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to manipulate output written to log files.  IBM X-Force ID:  260576.
Key phrases: manipulate output written to log files
CVE-2023-38021: An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX. Lack of pointer-alignment validation logic in entry functions allows a local attacker to access unauthorized information. This relates to the enclave_ecall function and system call layer.
Key phrases: access unauthorized information
CVE-2023-38022: An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a local attacker to access unauthorized information. This relates to strlen and sgx_is_within_user.
Key phrases: access unauthorized information, pointer validation
CVE-2023-38023: An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack of pointer-alignment logic in __scone_dispatch and other entry functions allows a local attacker to access unauthorized information, aka an "AEPIC Leak."
Key phrases: access unauthorized information, aepic leak
CVE-2023-38024: SpotCam Co., Ltd. SpotCam FHD 2s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.
Key phrases: perform arbitrary system operations or disrupt, telnet function, hard-coded telnet credentials, disrupt service
CVE-2023-38025: SpotCam Co., Ltd. SpotCam FHD 2s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.
Key phrases: os command injection, disrupt service, execute commands
CVE-2023-38026: SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.
Key phrases: perform arbitrary system operations or disrupt, hard-coded uboot credentials, disrupt service
CVE-2023-38027: SpotCam Co., Ltd. SpotCam Senses hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system commands or disrupt service.
Key phrases: perform arbitrary system commands or disrupt, os command injection, disrupt service, execute commands
CVE-2023-38028: Sahos attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data,  but cant control system or disrupt service.
Key phrases: bypass authentication, insufficient authentication, disrupt service
CVE-2023-38029: Sahos attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.
Key phrases: perform arbitrary system commands or disrupt, insufficient filtering, disrupt service, execute arbitrary, arbitrary file
CVE-2023-3803: A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the file /Service/ImageStationDataService.asmx of the component File Name Handler. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235071. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: disclosure
CVE-2023-38030: Sahos attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can execute system commands in partial website URLs to read sensitive device information without permissions.
Key phrases: missing authentication, missing authentication for critical function
CVE-2023-38031: ASUS RT-AC86U Adaptive QoS - Web History function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.
Key phrases: execute arbitrary commands, command injection, disrupt system, terminate services
CVE-2023-38032: ASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.
Key phrases: execute arbitrary commands, command injection, disrupt system, terminate services
CVE-2023-38033: ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.
Key phrases: execute arbitrary commands, command injection, disrupt system, terminate services
CVE-2023-38034: A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE). Affected Products:All UniFi Access Points (Version 6.5.53 and earlier)All UniFi Switches (Version 6.5.32 and earlier) -USW Flex Mini excluded. Mitigation:Update UniFi Access Points to Version 6.5.62 or later.Update UniFi Switches to Version 6.5.59 or later.
Key phrases: Version 6.5.62 or later, command injection, remote code execution (rce)
CVE-2023-38035: A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. 
Key phrases: bypass authentication, bypass authentication controls on the administrative interface due
CVE-2023-38039: When curl retrieves an HTTP response, it stores the incoming headers so thatthey can be accessed later via the libcurl headers API.However, curl did not have a limit in how many or how large headers it wouldaccept in a response, allowing a malicious server to stream an endless seriesof headers and eventually cause curl to run out of heap memory.
Key phrases: stream an endless seriesof headers and eventually cause
CVE-2023-3804: A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file /Service/FileHandler.ashx. The manipulation of the argument userFile leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235072. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: unrestricted upload, disclosure
CVE-2023-38040: A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..
Key phrases: reflected xss
CVE-2023-38041: A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploit this condition to gain unauthorized elevated privileges on the affected system.
Key phrases: gain unauthorized elevated privileges, time-of-check to time-of-use (toctou), race condition, elevate privileges
CVE-2023-38043: A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to a denial of service (DoS) condition on the user machine and, in some cases, resulting in a full compromise of the system.
Key phrases: denial of service (DoS), exploit a vulnerable configuration, full compromise of the system
CVE-2023-38044: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
Key phrases: SQL Injection, improper neutralization of special elements, sql injection
CVE-2023-38045: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.
Key phrases: XSS Targeting Non-Script Elements, improper neutralization of input during web page generation, cross-site scripting
CVE-2023-38046: A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.
CVE-2023-3805: A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects some unknown processing in the library UserInfoAction.class of the component Login. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235073 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: improper authorization, disclosure
CVE-2023-38056: Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Key phrases: any authenticated attacker with admin privileges local execution, improper neutralization
CVE-2023-38057: An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent.This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.
Key phrases: a valid and unanswered survey request to inject, a cross site scripting attack while reading the, input validation, improper input validation, cross-site scripting
CVE-2023-38058: An improper privilege check in the OTRS ticket move action in the agent interface allows   any as agent authenticated attacker to  to perform a move of an ticket without the needed permission.This issue affects OTRS: from 8.0.X before 8.0.35.
Key phrases:  to perform a move of an ticket, improper privilege check
CVE-2023-38059: The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
CVE-2023-3806: A vulnerability, which was classified as critical, was found in SourceCodester House Rental and Property Listing System 1.0. Affected is an unknown function of the file btn_functions.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-235074 is the identifier assigned to this vulnerability.
Key phrases: unrestricted upload
CVE-2023-38060: Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows  any authenticated attacker to  to perform an host header injection for the ContentType header of the attachment.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Key phrases:  to perform an host header injection for, improper input validation
CVE-2023-38061: In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible
Key phrases: xss
CVE-2023-38062: In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations
CVE-2023-38063: In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible
Key phrases: xss
CVE-2023-38064: In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log
CVE-2023-38065: In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible
Key phrases: stored xss
CVE-2023-38066: In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads
Key phrases: xss
CVE-2023-38067: In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log
CVE-2023-38068: In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms
Key phrases: captcha
CVE-2023-38069: In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases
CVE-2023-3807: A vulnerability has been found in Campcodes Beauty Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_product.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235075.
Key phrases: sql injection
CVE-2023-38070: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application is vulnerable to stack-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20818)
Key phrases: execute code in the context of the current, stack-based buffer overflow, stack based buffer overflow
CVE-2023-38071: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20824)
Key phrases: execute code in the context of the current, heap-based buffer overflow, heap based buffer overflow
CVE-2023-38072: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20825)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-38073: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains a type confusion vulnerability while parsing WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20826)
Key phrases: execute code in the context of the current, type confusion
CVE-2023-38074: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains a type confusion vulnerability while parsing WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20840)
Key phrases: execute code in the context of the current, type confusion
CVE-2023-38075: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains a use-after-free vulnerability that could be triggered while parsing specially crafted WRL files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-20842)
Key phrases: use-after-free, use after free, execute code
CVE-2023-38076: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21041)
Key phrases: execute code in the context of the current, heap-based buffer overflow, heap based buffer overflow
CVE-2023-3808: A vulnerability was found in Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file patientforgotpassword.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235076.
Key phrases: sql injection
CVE-2023-3809: A vulnerability was found in Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file patient.php. The manipulation of the argument address leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235077 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-3810: A vulnerability was found in Hospital Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file patientappointment.php. The manipulation of the argument loginid/password/mobileno/appointmentdate/appointmenttime/patiente/dob/doct/city leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235078 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-3811: A vulnerability was found in Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file patientprofile.php. The manipulation of the argument address leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235079.
Key phrases: sql injection
CVE-2023-3812: An out-of-bounds memory access flaw was found in the Linux kernels TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Key phrases: crash or potentially escalate their privileges on the, out-of-bounds memory access flaw, out of bounds memory, escalate privilege
CVE-2023-38126: Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability.The specific flaw exists within the processing of backup zip files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this to execute code in the context of root. Was ZDI-CAN-20543.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Softing, restore configuration directory traversal remote code execution, execute code
CVE-2023-38127: An integer overflow exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the parser to make an under-sized allocation, which can later allow for memory corruption, potentially resulting in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: trigger this vulnerability, integer overflow, under-sized allocation, memory corruption, arbitrary code execution, malicious file
CVE-2023-38128: An out-of-bounds write vulnerability exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause a type confusion, which can lead to memory corruption and eventually arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: out-of-bounds write, type confusion, memory corruption, arbitrary code execution, malicious file, out of bounds write
CVE-2023-3813: The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated.
Key phrases: arbitrary file downloads, sensitive information
CVE-2023-38130: Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system.
Key phrases: delete data in the system, cross-site request forgery (csrf), cross site request forgery
CVE-2023-38131: Improper input validationation for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network access.
Key phrases: potentially enable denial of service via network access, improper input validationation
CVE-2023-38132: LAN-W451NGR all versions provided by LOGITEC CORPORATION contains an improper access control vulnerability, which allows an unauthenticated attacker to log in to telnet service.
Key phrases: log in to telnet service, access control, improper access control
CVE-2023-38133: The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may disclose sensitive information.
Key phrases: sensitive information
CVE-2023-38135: Improper authorization in some Intel(R) PM software may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper authorization, escalation privilege
CVE-2023-38136: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2023-38138: A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: run JavaScript in the context of the currently, reflected cross-site scripting (xss)
CVE-2023-38139: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-3814: The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.
Key phrases: read arbitrary files, list and read arbitrary files and folders on
CVE-2023-38140: Windows Kernel Information Disclosure Vulnerability
Key phrases: windows kernel information disclosure
CVE-2023-38141: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-38142: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-38143: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2023-38144: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2023-38146: Windows Themes Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-38147: Windows Miracast Wireless Display Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-38148: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
Key phrases: internet connection sharing (ics), remote code execution
CVE-2023-38149: Windows TCP/IP Denial of Service Vulnerability
Key phrases: windows tcp ip denial of service
CVE-2023-3815: A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function uploadFilesPath of the component File Upload. The manipulation of the argument originalFilenames leads to cross site scripting. The attack may be launched remotely. VDB-235118 is the identifier assigned to this vulnerability.
CVE-2023-38150: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-38151: Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-38152: DHCP Server Service Information Disclosure Vulnerability
Key phrases: dhcp server service information disclosure
CVE-2023-38154: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-38155: Azure DevOps Server Remote Code Execution Vulnerability
Key phrases: azure devops server remote code execution
CVE-2023-38156: Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability
Key phrases: jdbc injection
CVE-2023-38157: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-38158: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-38159: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2023-38160: Windows TCP/IP Information Disclosure Vulnerability
Key phrases: windows tcp ip information disclosure
CVE-2023-38161: Windows GDI Elevation of Privilege Vulnerability
Key phrases: windows gdi elevation of privilege
CVE-2023-38162: DHCP Server Service Denial of Service Vulnerability
Key phrases: dhcp server service denial of service
CVE-2023-38163: Windows Defender Attack Surface Reduction Security Feature Bypass
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-38164: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-38166: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: layer tunneling protocol remote code execution
CVE-2023-38167: Microsoft Dynamics Business Central Elevation Of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-38169: Microsoft SQL OLE DB Remote Code Execution Vulnerability
Key phrases: microsoft sql ole db remote code execution
CVE-2023-3817: Issue summary: Checking excessively long DH keys or parameters may be very slow.Impact summary: Applications that use the functions DH_check(), DH_check_ex()or EVP_PKEY_param_check() to check a DH key or DH parameters may experience longdelays. Where the key or parameters that are being checked have been obtainedfrom an untrusted source this may lead to a Denial of Service.The function DH_check() performs various checks on DH parameters. After fixingCVE-2023-3446 it was discovered that a large q parameter value can also triggeran overly long computation during some of these checks. A correct q value,if present, cannot be larger than the modulus p parameter, thus it isunnecessary to perform these checks if q is larger than p.An application that calls DH_check() and supplies a key or parameters obtainedfrom an untrusted source could be vulnerable to a Denial of Service attack.The function DH_check() is itself called by a number of other OpenSSL functions.An application calling any of those other functions may similarly be affected.The other functions affected by this are DH_check_ex() andEVP_PKEY_param_check().Also vulnerable are the OpenSSL dhparam and pkeyparam command line applicationswhen using the "-check" option.The OpenSSL SSL/TLS implementation is not affected by this issue.The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
Key phrases: denial of service
CVE-2023-38170: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-38171: Microsoft QUIC Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-38172: Microsoft Message Queuing Denial of Service Vulnerability
Key phrases: microsoft message queuing denial of service
CVE-2023-38173: Microsoft Edge for Android Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-38174: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-38175: Microsoft Windows Defender Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-38176: Azure Arc-Enabled Servers Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-38177: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-38178: .NET Core and Visual Studio Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-38180: .NET and Visual Studio Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-38181: Microsoft Exchange Server Spoofing Vulnerability
Key phrases: microsoft exchange server spoofing
CVE-2023-38182: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-38184: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-38185: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-38186: Windows Mobile Device Management Elevation of Privilege Vulnerability
Key phrases: windows mobile device management elevation of privilege
CVE-2023-38187: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-38188: Azure Apache Hadoop Spoofing Vulnerability
Key phrases: azure apache hadoop spoofing
CVE-2023-3819: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.
CVE-2023-38190: An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter.
Key phrases: Export SQL Injection via the size parameter, export sql injection
CVE-2023-38191: An issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename.
Key phrases: spamtest_external.php XSS via a crafted filename, spamtest_external.php xss
CVE-2023-38192: An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwords.
Key phrases: superadmincreate.php XSS via crafted incorrect passwords, xss
CVE-2023-38193: An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line.
Key phrases: Remote Code Execution via a crafted sendmail command, remote code execution
CVE-2023-38194: An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.
Key phrases: keepalive.php XSS via a GET parameter, keepalive.php xss
CVE-2023-38195: Datalust Seq before 2023.2.9489 allows insertion of sensitive information into an externally accessible file or directory. This is exploitable only when external (SQL Server or PostgreSQL) metadata storage is used. Exploitation can only occur from a high-privileged user account.
Key phrases: insertion of sensitive information into an externally accessible, exploitable
CVE-2023-38197: An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.
Key phrases: infinite loops
CVE-2023-38198: acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.
Key phrases: runs arbitrary commands, eval, exploited in the wild
CVE-2023-38199: coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.
Key phrases: bypass a WAF with a crafted payload, aka, content-type confusion, malformed header
CVE-2023-3820:  SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
Key phrases: sql injection
CVE-2023-38200: A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
Key phrases: exhaust all available connections, remote denial of service
CVE-2023-38201: A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
Key phrases: bypass of the challenge-response protocol during agent registration, impersonate an agent and hide the true status, breach, integrity
CVE-2023-38203: Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Key phrases: deserialization of untrusted data, arbitrary code execution
CVE-2023-38204: Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Key phrases: deserialization of untrusted data, arbitrary code execution
CVE-2023-38205: Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
Key phrases: Security feature bypass, improper access control, security feature bypass, exploitation, feature bypass,
CVE-2023-38206: Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints resulting in a low-confidentiality impact. Exploitation of this issue does not require user interaction.
Key phrases: Security feature bypass, improper access control, security feature bypass, low-confidentiality impact, feature bypass,, confidentiality impacts
CVE-2023-38207: Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction.
Key phrases: xml injection (aka blind xpath injection), arbitrary file system read
CVE-2023-38208: Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.
Key phrases: improper neutralization of special elements used in an os command, os command injection, arbitrary code execution
CVE-2023-38209: Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.
Key phrases: Security feature bypass, incorrect authorization, security feature bypass, users data, exploitation, feature bypass,
CVE-2023-3821: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.
Key phrases: cross-site scripting (xss)
CVE-2023-38210: Adobe XMP Toolkit versions 2022.06 is affected by a Uncontrolled Resource Consumption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: uncontrolled resource consumption, application denial-of-service, denial of service
CVE-2023-38211: Adobe Dimension version 3.4.9 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: use after free, arbitrary code execution
CVE-2023-38212: Adobe Dimension version 3.4.9 is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: heap-based buffer overflow, arbitrary code execution
CVE-2023-38213: Adobe Dimension version 3.4.9 is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2023-38214: Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2023-38215: Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2023-38216: Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, use after free, exploitation, disclosure
CVE-2023-38217: Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, exploitation, disclosure
CVE-2023-38218: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation.
Key phrases: incorrect authorization, information exposure, privilege escalation
CVE-2023-38219: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victims browser when they browse to the page containing the vulnerable field. Payload is stored in an admin area, resulting in high confidentiality and integrity impact.
Key phrases: cross-site scripting (xss), confidentiality and integrity impact
CVE-2023-3822: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.
Key phrases: cross-site scripting (xss)
CVE-2023-38220: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.
Key phrases: bypass in a way that an attacker could access unauthorised data, security feature bypass, improper authorization, exploitation, feature bypass,
CVE-2023-38221: Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.
Key phrases: improper neutralization of special elements, sql injection, attack complexity, arbitrary code, arbitrary code execution