yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-28484: In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.
Key phrases: null pointer dereference
CVE-2023-28485: A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board (where they have BoardAdmin access), and renameAttachment does not block XSS payloads.
Key phrases: inject arbitrary web script or HTML, obtain the privilege, inject arbitrary web script or HTML via names, stored cross-site scripting (stored xss), xss payloads
CVE-2023-28486: Sudo before 1.9.13 does not escape control characters in log messages.
Key phrases: control characters
CVE-2023-28487: Sudo before 1.9.13 does not escape control characters in sudoreplay output.
Key phrases: control characters
CVE-2023-28488: client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.
Key phrases: stack-based buffer overflow, denial of service, stack based buffer overflow
CVE-2023-28489: A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter Remote Operation is enabled. The parameter is disabled by default.The vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device.
Key phrases: perform arbitrary code execution, perform arbitrary code execution on the device, command injection
CVE-2023-28490: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <=2.0.7 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-28491: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6.
Key phrases: sql command, sql injection
CVE-2023-28493: Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <=2.4.4 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-28495: Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop WP Shortcode by MyThemeShop plugin <=1.4.16 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-28496: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SMTP2GO  Email Made Easy plugin <=1.4.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-28497: Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery LITE plugin <=1.7.6 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-28498: Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <=4.6.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-28499: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in simonpedge Slide Anything  Responsive Content / HTML Slider and Carousel plugin <=2.4.9 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-2850: NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.
Key phrases: be extracted by attacker, cross-site websocket hijacking, user information
CVE-2023-28500: A Java insecure deserialization vulnerability in Adobe LiveCycle ES4 version 11.0 and earlier allows unauthenticated remote attackers to gain operating system code execution by submitting specially crafted Java serialized objects to a specific URL. Adobe LiveCycle ES4 version 11.0.1 and later may be vulnerable if the application is installed with Java environment 7u21 and earlier. Exploitation of the vulnerability depends on two factors: insecure deserialization methods used in the Adobe LiveCycle application, and the use of Java environments 7u21 and earlier. The code execution is performed in the context of the account that is running the Adobe LiveCycle application. If the account is privileged, exploitation provides privileged access to the operating system. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: gain operating system code execution, gain operating system code execution by submitting specially, java insecure deserialization
CVE-2023-28501: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a heap-based buffer overflow in the unirpcd daemon that, if successfully exploited, can lead to remote code execution as the root user.
Key phrases: heap-based buffer overflow, remote code execution, heap based buffer overflow
CVE-2023-28502: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as the root user.
Key phrases: stack-based buffer overflow, remote code execution, stack based buffer overflow
CVE-2023-28503: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication checks and execute OS commands as the root user.
Key phrases: bypass authentication, authentication bypass
CVE-2023-28504: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow that can lead to remote code execution as the root user.
Key phrases: stack-based buffer overflow, remote code execution, stack based buffer overflow
CVE-2023-28505: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a buffer overflow in an API function, where a string is copied into a caller-provided buffer without checking the length. This requires a valid login to exploit.
Key phrases: buffer overflow
CVE-2023-28506: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow, where a string is copied into a buffer using a memcpy-like function and a user-provided length. This requires a valid login to exploit.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2023-28507: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a memory-exhaustion issue, where a decompression routine will allocate increasing amounts of memory until all system memory is exhausted and the forked process crashes.
Key phrases: memory-exhaustion issue, memory exhaustion, crash
CVE-2023-28508: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a heap-based overflow vulnerability, where certain input can corrupt the heap and crash the forked process.
Key phrases: heap-based overflow, heap based overflow, crash
CVE-2023-28509: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 use weak encryption for packet-level security and passwords transferred on the wire.
Key phrases: weak encryption
CVE-2023-2851: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AGT Tech Ceppatron allows Command Line Execution through SQL Injection, SQL Injection.This issue affects all versions of the sofware also EOS when CVE-ID assigned.
Key phrases: Command Line Execution through SQL Injection, sql command, sql injection, command line execution
CVE-2023-28512: IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input validation.  IBM X-Force ID:  250396.
Key phrases: manipulate data due to improper input validation
CVE-2023-28513: IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vulnerable to a denial of service attack caused by an error processing messages.  IBM X-Force ID:  250397.
Key phrases: denial of service, error processing messages
CVE-2023-28514: IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace.  IBM X-Force ID:  250398.
Key phrases: obtain sensitive credential information, obtain sensitive credential information when a detailed technical
CVE-2023-28517: IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  250421.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2023-2852: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Softmed SelfPatron allows SQL Injection.This issue affects SelfPatron : before 2.0.
Key phrases: SQL Injection, sql command, sql injection
CVE-2023-28520: IBM Planning Analytics Local 2.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  250454.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2023-28522: IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to.  IBM X-Force ID:  250585.
Key phrases: perform actions that they should not have access
CVE-2023-28523: IBM Informix Dynamic Server 12.10 and 14.10 onsmsync is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code.  IBM X-Force ID:  250753.
Key phrases: execute arbitrary code, heap buffer overflow
CVE-2023-28525: IBM Engineering Requirements Management 9.7.2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  251052.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2023-28526: IBM Informix Dynamic Server 12.10 and 14.10 archecker is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault.  IBM X-Force ID:  251204.
Key phrases: cause a segmentation fault, heap buffer overflow
CVE-2023-28527: IBM Informix Dynamic Server 12.10 and 14.10 cdr is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault. IBM X-Force ID: 251206.
Key phrases: cause a segmentation fault, heap buffer overflow
CVE-2023-28528: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands.  IBM X-Force ID:  251207.
Key phrases: execute arbitrary commands, exploit a vulnerability in the invscout command to
CVE-2023-28529: IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  251213.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, stored cross-site scripting, credentials disclosure
CVE-2023-2853: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softmed SelfPatron allows Reflected XSS.This issue affects SelfPatron : before 2.0.
Key phrases: Reflected XSS.This issue affects SelfPatron : before 2.0, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-28530: IBM Cognos Analytics 11.1 and 11.2 is vulnerable to stored cross-site scripting, caused by improper validation of SVG Files in Custom Visualizations. A remote attacker could exploit this vulnerability to execute scripts in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.  IBM X-Force ID:  251214.
Key phrases: cross-site scripting
CVE-2023-28531: ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
Key phrases: smartcard keys
CVE-2023-28533: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in M Williams Cab Grid plugin <=1.5.15 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-28534: Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Job Portal WP Job Portal  A Complete Job Board plugin <=2.0.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-28535: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Paytm Paytm Payment Donation plugin <=2.2.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-28537: Memory corruption while allocating memory in COmxApeDec module in Audio.
Key phrases: memory corruption
CVE-2023-28538: Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.
Key phrases: memory corruption
CVE-2023-28539: Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Key phrases: memory corruption
CVE-2023-2854: BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Key phrases: denial of service via crafted capture file, crash
CVE-2023-28540: Cryptographic issue in Data Modem due to improper authentication during TLS handshake.
Key phrases: cryptographic issue, improper authentication
CVE-2023-28541: Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Key phrases: memory corruption
CVE-2023-28542: Memory Corruption in WLAN HOST while fetching TX status information.
Key phrases: memory corruption
CVE-2023-28543: A malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model (e.g. from a remote source).
Key phrases: memory corruption, out of bounds read
CVE-2023-28544: Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
Key phrases: memory corruption
CVE-2023-28545: Memory corruption in TZ Secure OS while loading an app ELF.
Key phrases: memory corruption
CVE-2023-28546: Memory Corruption in SPS Application while exporting public key in sorter TA.
Key phrases: memory corruption
CVE-2023-28547: Memory corruption in SPS Application while requesting for public key in sorter TA.
Key phrases: memory corruption
CVE-2023-28548: Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
Key phrases: memory corruption
CVE-2023-28549: Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
Key phrases: memory corruption
CVE-2023-2855: Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Key phrases: denial of service via crafted capture file, crash
CVE-2023-28550: Memory corruption in MPP performance while accessing DSM watermark using external memory address.
Key phrases: memory corruption, mpp performance
CVE-2023-28551: Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
Key phrases: having arbitrary address values, memory corruption
CVE-2023-28553: Information Disclosure in WLAN Host when processing WMI event command.
Key phrases: information disclosure
CVE-2023-28554: Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
Key phrases: information disclosure
CVE-2023-28555: Transient DOS in Audio while remapping channel buffer in media codec decoding.
Key phrases: transient dos
CVE-2023-28556: Cryptographic issue in HLOS during key management.
Key phrases: cryptographic issue
CVE-2023-28557: Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
Key phrases: memory corruption
CVE-2023-28558: Memory corruption in WLAN handler while processing PhyID in Tx status handler.
Key phrases: memory corruption
CVE-2023-28559: Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Key phrases: memory corruption
CVE-2023-2856: VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Key phrases: denial of service via crafted capture file, crash
CVE-2023-28560: Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
Key phrases: memory corruption
CVE-2023-28561: Memory corruption in QESL while processing payload from external ESL device to firmware.
Key phrases: memory corruption
CVE-2023-28562: Memory corruption while handling payloads from remote ESL.
Key phrases: memory corruption
CVE-2023-28563: Information disclosure in IOE Firmware while handling WMI command.
Key phrases: information disclosure
CVE-2023-28564: Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Key phrases: memory corruption
CVE-2023-28565: Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Key phrases: memory corruption
CVE-2023-28566: Information disclosure in WLAN HAL while handling the WMI state info command.
Key phrases: information disclosure
CVE-2023-28567: Memory corruption in WLAN HAL while handling command through WMI interfaces.
Key phrases: memory corruption
CVE-2023-28568: Information disclosure in WLAN HAL when reception status handler is called.
Key phrases: information disclosure
CVE-2023-28569: Information disclosure in WLAN HAL while handling command through WMI interfaces.
Key phrases: information disclosure
CVE-2023-2857: BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Key phrases: denial of service via crafted capture file, crash
CVE-2023-28570: Memory corruption while processing audio effects.
Key phrases: memory corruption
CVE-2023-28571: Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Key phrases: information disclosure
CVE-2023-28572: Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
Key phrases: memory corruption
CVE-2023-28573: Memory corruption in WLAN HAL while parsing WMI command parameters.
Key phrases: memory corruption
CVE-2023-28574: Memory corruption in core services when Diag handler receives a command to configure event listeners.
Key phrases: memory corruption
CVE-2023-28575: The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
Key phrases: invalid type usage, wrong handle
CVE-2023-28576: The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues.
Key phrases: out-of-bounds read write issues
CVE-2023-28577: In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.
Key phrases: uaf
CVE-2023-28578: Memory corruption in Core Services while executing the command for removing a single event listener.
Key phrases: memory corruption, execute commands
CVE-2023-28579: Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.
Key phrases: memory corruption
CVE-2023-2858: NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Key phrases: denial of service via crafted capture file, crash
CVE-2023-28580: Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
Key phrases: memory corruption
CVE-2023-28581: Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.
Key phrases: memory corruption
CVE-2023-28582: Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.
Key phrases: memory corruption
CVE-2023-28583: Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
Key phrases: memory corruption
CVE-2023-28584: Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
Key phrases: transient dos, invalid channel
CVE-2023-28585: Memory corruption while loading an ELF segment in TEE Kernel.
Key phrases: memory corruption
CVE-2023-28586: Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
Key phrases: information disclosure
CVE-2023-28587: Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
Key phrases: memory corruption
CVE-2023-28588: Transient DOS in Bluetooth Host while rfc slot allocation.
Key phrases: transient dos, rfc slot allocation
CVE-2023-2859: Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Key phrases: code injection
CVE-2023-28596: Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.
Key phrases: local privilege escalation, escalate privilege
CVE-2023-28597: Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zooms web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.
Key phrases: improper trust boundary implementation, remote code execution
CVE-2023-28598: Zoom for  Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash.
Key phrases: html injection, zoom application crash
CVE-2023-28599: Zoom clients prior to 5.13.10 contain an HTML injection vulnerability.  A malicious user could inject HTML into  their display name potentially leading a victim to a malicious website during meeting creation.
Key phrases: html injection
CVE-2023-2860: An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. The flaw exists within the processing of seg6 attributes. The issue results from the improper validation of user-supplied data, which can result in a read past the end of an allocated buffer. This flaw allows a privileged local user to disclose sensitive information on affected installations of the Linux kernel.
Key phrases: disclose sensitive information on affected installations of the, out-of-bounds read, out of bounds read
CVE-2023-28600: Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability.  A malicious user may be able to delete/replace Zoom Client files potentially causing  a loss of integrity and availability to the Zoom Client.
Key phrases: access control, loss of integrity, improper access control, integrity and availability
CVE-2023-28601: Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability.  A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client.
Key phrases: memory buffer, integrity issues, out of bounds memory
CVE-2023-28602: Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability.  A malicious user may potentially downgrade Zoom Client components to previous versions.
Key phrases: cryptographic signature, downgrade
CVE-2023-28603: Zoom VDI client installer  prior to 5.14.0 contains an improper access control vulnerability.  A malicious user may potentially delete local files without proper permissions.
Key phrases: access control, improper access control
CVE-2023-28604: The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases that may be edge cases.
Key phrases: XSS via a component argument parameter, xss, edge cases
CVE-2023-28606: js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.
Key phrases: XSS via event-graph node tooltips, xss
CVE-2023-28607: js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.
Key phrases: XSS via the event-graph relationship tooltip, xss
CVE-2023-28609: api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.
CVE-2023-2861: A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.
Key phrases: escape from the exported 9p tree by creating
CVE-2023-28610: The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image. This allows a remote attacker to gain root access to the system.
Key phrases: gain root access, gain root access to the system
CVE-2023-28611: Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions.
Key phrases: bypass intended access restrictions, incorrect authorization
CVE-2023-28613: An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300. An integer overflow in IPv4 fragment handling can occur due to insufficient parameter validation when reassembling these fragments.
Key phrases: integer overflow
CVE-2023-28614: Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page.
Key phrases: a report page, os command injection, shell metacharacters
CVE-2023-28616: An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component.
Key phrases: cleartext
CVE-2023-28617: org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.
Key phrases: execute arbitrary commands, execute arbitrary commands via a file name or, shell metacharacters
CVE-2023-28618: Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <=1.16 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-2862: A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file /api/stl/actions/search. The manipulation of the argument ajaxDivId leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-229818 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-28620: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cyberus Labs Cyberus Key plugin <=1.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-28621: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wishfulthemes Raise Mag, Wishfulthemes Wishful Blog themes allows Reflected XSS.This issue affects Raise Mag: from n/a through 1.0.7; Wishful Blog: from n/a through 2.0.1.
Key phrases: Reflected XSS.This issue affects Raise Mag: from, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-28622: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Trident Technolabs Easy Slider Revolution plugin <=1.0.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-28623: Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only ones enabled in `AUTHENTICATION_BACKENDS` in `/etc/zulip/settings.py` and 2: The organization permissions don't require invitations to join. An attacker can create a new account in the organization with an arbitrary email address in their control that's not in the organization's LDAP directory. The impact is limited to installations which have this specific combination of authentication backends as described above in addition to having `Invitations are required for joining this organization` organization permission disabled. This issue has been addressed in version 6.2. Users are advised to upgrade. Users unable to upgrade may enable the `Invitations are required for joining this organization` organization permission to prevent this issue.
CVE-2023-28625: mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.
Key phrases: null pointer dereference, availability risk, segmentation fault
CVE-2023-28626: comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047`
Key phrases: quadratic parsing issues, denial-of-service, denial of service
CVE-2023-28627: pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: execute arbitrary OS commands, arbitrary os command
CVE-2023-28628: lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in question doesn't handle the backslash (`\\\\`) character in the username correctly, leading to a wrong output. ex. a payload of `https://example.com\\\\\\\\@google.com` would return that the host is `google.com`, but the correct host should be `example.com`. Given that the library returns the wrong authority this may be abused to bypass host restrictions depending on how the library is used in an application. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: bypass host restrictions, send malicious URLs to be parsed by the
CVE-2023-28629: GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that has permissions to configure GoCD pipelines could include JavaScript elements within the label template, causing a XSS vulnerability to be triggered for any users viewing the Value Stream Map or Job Details for runs of the affected pipeline, potentially allowing them to perform arbitrary actions within the victim's browser context rather than their own. This issue has been fixed in GoCD 23.1.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: perform arbitrary actions, perform arbitrary actions within the victim's browser, stored xss, browser display
CVE-2023-2863: A vulnerability has been found in Simple Design Daily Journal 1.012.GP.B on Android and classified as problematic. Affected by this vulnerability is an unknown functionality of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229819.
CVE-2023-28630: GoCD is an open source continuous delivery server. In GoCD versions from 20.5.0 and below 23.1.0, if the server environment is not correctly configured by administrators to provide access to the relevant PostgreSQL or MySQL backup tools, the credentials for database access may be unintentionally leaked to admin alerts on the GoCD user interface. The vulnerability is triggered only if the GoCD server host is misconfigured to have backups enabled, but does not have access to the `pg_dump` or `mysqldump` utility tools to backup the configured database type (PostgreSQL or MySQL respectively). In such cases, failure to launch the expected backup utility reports the shell environment used to attempt to launch in the server admin alert, which includes the plaintext database password supplied to the configured tool. This vulnerability does not affect backups of the default on-disk H2 database that GoCD is configured to use. This issue has been addressed and fixed in GoCD 23.1.0. Users are advised to upgrade. Users unable to upgrade may disable backups, or administrators should ensure that the required `pg_dump` (PostgreSQL) or `mysqldump` (MySQL) binaries are available on the GoCD server when backups are triggered.
CVE-2023-28631: comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A Comrak AST can be constructed manually by a program instead of parsing a Markdown document with `parse_document`. This AST can then be converted to HTML via `html::format_document_with_plugins`. However, the HTML formatting code assumes that the AST is well-formed. For example, many AST notes contain `[u8]` fields which the formatting code assumes is valid UTF-8 data. Several bugs can be triggered if this is not the case. Version 0.17.0 contains adjustments to the AST, storing strings instead of unvalidated byte arrays. Users are advised to upgrade. Users unable to upgrade may manually validate UTF-8 correctness of all data when assigning to `&[u8]` and `Vec<u8>` fields in the AST. This issue is also tracked as `GHSL-2023-049`.
CVE-2023-28632: GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to `Forgotten password?` event. However, it will not prevent unauthorized modification of any user emails.
Key phrases: unauthorized modification
CVE-2023-28633: GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
Key phrases: server-side request forgery (ssrf), server side request forgery
CVE-2023-28634: GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
Key phrases: privilege escalation, hijack
CVE-2023-28635: vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for example, if user id 13 is allowed to run tasks, and an attacker creates a username with username '13', they would be wrongly allowed to run an algorithm. There may also be other places in the code where such a mixup of resource ID or name leads to issues. Version 4.0.0 contains a patch for this issue. The best solution is to check when resources are created or modified, that the resource name always starts with a character.
Key phrases: issues
CVE-2023-28636: GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7.
Key phrases: create a malicious external link
CVE-2023-28637: DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to remote code execution. This vulnerability has been fixed in v1.18.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: remote code execution
CVE-2023-28638: Snappier is a high performance C# implementation of the Snappy compression algorithm. This is a buffer overrun vulnerability that can affect any user of Snappier 1.1.0. In this release, much of the code was rewritten to use byte references rather than pointers to pinned buffers. This change generally improves performance and reduces workload on the garbage collector. However, when the garbage collector performs compaction and rearranges memory, it must update any byte references on the stack to refer to the updated location. The .NET garbage collector can only update these byte references if they still point within the buffer or to a point one byte past the end of the buffer. If they point outside this area, the buffer itself may be moved while the byte reference stays the same. There are several places in 1.1.0 where byte references very briefly point outside the valid areas of buffers. These are at locations in the code being used for buffer range checks. While the invalid references are never dereferenced directly, if a GC compaction were to occur during the brief window when they are on the stack then it could invalidate the buffer range check and allow other operations to overrun the buffer.  This should be very difficult for an attacker to trigger intentionally. It would require a repetitive bulk attack with the hope that a GC compaction would occur at precisely the right moment during one of the requests. However, one of the range checks with this problem is a check based on input data in the decompression buffer, meaning malformed input data could be used to increase the chance of success. Note that any resulting buffer overrun is likely to cause access to protected memory, which will then cause an exception and the process to be terminated. Therefore, the most likely result of an attack is a denial of service. This issue has been patched in release 1.1.1. Users are advised to upgrade. Users unable to upgrade may pin buffers to a fixed location before using them for compression or decompression to mitigate some, but not all, of these cases. At least one temporary decompression buffer is internal to the library and never pinned.
Key phrases: overrun the buffer, buffer overrun, denial of service
CVE-2023-28639: GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7.
Key phrases: reflected xss
CVE-2023-2864: A vulnerability was found in SourceCodester Online Jewelry Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file customer.php of the component POST Parameter Handler. The manipulation of the argument Custid leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229820.
Key phrases: cross site scripting
CVE-2023-28640: Apiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL, which includes Organisation ID, Client ID, and Client Version of the targeted non-permitted resource. While not trivial to exploit, it could be achieved by brute-forcing or guessing common names. Access to the non-permitted API Keys could allow use of other users' resources without their permission (depending on the specifics of configuration, such as whether an API key is the only form of security). Apiman 3.1.0.Final resolved this issue. Users are advised to upgrade. The only known workaround is to restrict account access.
Key phrases: gain access, upgrade, permissions check, brute-forcing
CVE-2023-28642: runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
Key phrases: untrusted container image
CVE-2023-28643: Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to `{name} (2)`. It is recommended that the Nextcloud Server is upgraded to 25.0.3 or 24.0.9. Users unable to upgrade should avoid sharing 2 folders with the same name to the same user.
CVE-2023-28644: Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.
Key phrases: server performances, denial of service
CVE-2023-28645: Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app (richdocuments) is upgraded to 8.0.0-beta.1, 7.0.2 or 6.3.2. Users unable to upgrade may mitigate the issue by taking steps to restrict the ability to download documents. This includes ensuring that the `WOPI configuration` is configured to only serve documents between Nextcloud and Collabora. It is highly recommended to define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud.
Key phrases: list within the Office admin settings of Nextcloud, unprotected internal api endpoint
CVE-2023-28646: Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta information like sharer, sharees and activity of files. It is recommended that the Nextcloud Android app is upgraded to 3.24.1. There are no known workarounds for this vulnerability.
Key phrases: bypass the Nextcloud Android Pin/passcode protection, see meta information like sharer
CVE-2023-28647: Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability.
Key phrases: bypass the Nextcloud pin/password protection, gain access
CVE-2023-28648: Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in context of an affected site.
Key phrases: execute arbitrary HTML
CVE-2023-28649: The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.
Key phrases: impersonate