yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-39538: AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.
Key phrases: loss of confidentiality, integrity, and or availability, unrestricted upload
CVE-2023-39539: AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.
Key phrases: loss of confidentiality, integrity, and or availability, unrestricted upload
CVE-2023-3954: The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Key phrases: reflected cross-site scripting
CVE-2023-39540: A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv4 ICMP packet.
Key phrases: denial of service, out-of-bounds read, out of bounds read
CVE-2023-39541: A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv6 ICMPv6 packet.
Key phrases: denial of service, out-of-bounds read, out of bounds read
CVE-2023-39542: A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files, which can lead to remote code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Key phrases: create arbitrary files, code execution, remote code execution
CVE-2023-39543: Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.
Key phrases: execute an arbitrary script on the web browser, cross-site scripting, execute arbitrary
CVE-2023-39544: CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.
Key phrases: log in to the product may execute an, execute arbitrary, arbitrary commands
CVE-2023-39545: CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.
Key phrases: log in to the product may execute an, execute arbitrary, arbitrary commands
CVE-2023-39546: CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.
Key phrases: log in to the product may execute an, execute arbitrary, arbitrary commands
CVE-2023-39547: CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.
Key phrases: log in to the product may execute an, execute arbitrary, arbitrary commands
CVE-2023-39548: CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.
Key phrases: log in to the product may execute an, execute arbitrary, arbitrary commands
CVE-2023-39549: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 2). The affected application contains a use-after-free vulnerability that could be triggered while parsing specially crafted DWG file. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19562)
Key phrases: use-after-free, use after free, execute code
CVE-2023-3955: A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
Key phrases: security issue
CVE-2023-39550: Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_passwd and http_username parameters in the check_auth function.
Key phrases: buffer overflows
CVE-2023-39551: PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php.
Key phrases: sql injection
CVE-2023-39553: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server.This issue affects Apache Airflow Drill Provider: before 2.4.3.It is recommended to upgrade to a version that is not affected.
Key phrases: pass in malicious parameters when establishing a connection, improper input validation
CVE-2023-39558: AudimexEE v15.0 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai Data component.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-39559: AudimexEE 15.0 was discovered to contain a full path disclosure vulnerability.
Key phrases: full path disclosure
CVE-2023-3956: The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user.
Key phrases: unauthorized access of data, modification of data, loss of data, missing capability check
CVE-2023-39560: ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \\\\default\\\\helpers\\\\insert.php.
Key phrases: sql injection
CVE-2023-39562: GPAC v2.3-DEV-rev449-g5948e4f70-master was discovered to contain a heap-use-after-free via the gf_bs_align function at bitstream.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2023-3957: The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or above, to update the user metas arbitrarily. The meta value can only be a string.
Key phrases: unauthorized modification of data
CVE-2023-39575: A reflected cross-site scripting (XSS) vulnerability in the url_str URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-39578: A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-3958: The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
Key phrases: make web requests to arbitrary locations originating from, server side request forgery
CVE-2023-39582: SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.
Key phrases: obtain sensitive information, obtain sensitive information via the import sessions functions, sql injection
CVE-2023-39584: Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.
Key phrases: arbitrary file read
CVE-2023-3959: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameraswith firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While processing XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
Key phrases: stack-based overflows, remote code execution, stack based overflow
CVE-2023-39598: Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitrary code via a crafted payload to the mid parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting
CVE-2023-39599: Cross-Site Scripting (XSS) vulnerability in CSZ CMS v.1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Social Settings parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross-site scripting (xss)
CVE-2023-39600: IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.
Key phrases: cross-site scripting (xss)
CVE-2023-3961: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.
Key phrases: send a pipe name containing Unix directory traversal, path traversal, consequential adverse events, service crashes, unauthorized access
CVE-2023-39610: An issue in TP-Link Tapo C100 v1.1.15 Build 211130 Rel.15378n(4555) and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted web request.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2023-39611: An issue in Software FX Chart FX 7 version 7.0.4962.20829 allows attackers to enumerate and read files from the local filesystem by sending crafted web requests.
Key phrases: enumerate and read files from the local filesystem
CVE-2023-39612: A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.
Key phrases: escalate privileges to Administrator via user interaction with, cross-site scripting (xss)
CVE-2023-39615: Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), out-of-bounds read, denial of service (dos), out of bounds read, crash
CVE-2023-39616: AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.
Key phrases: invalid read memory access
CVE-2023-39617: TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
Key phrases: remote code execution (rce)
CVE-2023-39618: TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.
Key phrases: remote code execution (rce)
CVE-2023-39619: ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component.
Key phrases: cause a denial of service via a crafted, redos
CVE-2023-3962: The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting, prototype pollution
CVE-2023-39620: An Issue in Buffalo America, Inc. TeraStation NAS TS5410R v.5.00 thru v.0.07 allows a remote attacker to obtain sensitive information via the guest account function.
Key phrases: obtain sensitive information, obtain sensitive information via the guest account function
CVE-2023-39631: An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.
Key phrases: execute arbitrary code, execute arbitrary code via the evaluate function in
CVE-2023-39637: D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis.
Key phrases: command injection
CVE-2023-39638: D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin.
Key phrases: command injection
CVE-2023-39639: LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs.
Key phrases: sql injection
CVE-2023-3964: An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.
CVE-2023-39640: UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList().
Key phrases: sql injection
CVE-2023-39641: Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent().
Key phrases: sql injection
CVE-2023-39642: Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display().
Key phrases: sql injection
CVE-2023-39643: Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds().
Key phrases: sql injection
CVE-2023-39645: Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module Theme Volty CMS Payment Icon (tvcmspaymenticon) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Key phrases: sql injection
CVE-2023-39646: Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop. In the module Theme Volty CMS Category Chain Slide"(tvcmscategorychainslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Key phrases: sql injection
CVE-2023-39647: Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop. In the module Theme Volty CMS Category Product (tvcmscategoryproduct) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Key phrases: sql injection
CVE-2023-39648: Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module Theme Volty CMS Testimonial (tvcmstestimonial) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Key phrases: sql injection
CVE-2023-39649: Improper neutralization of SQL parameter in Theme Volty CMS Category Slider module for PrestaShop. In the module Theme Volty CMS Category Slider (tvcmscategoryslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Key phrases: sql injection
CVE-2023-3965: The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting, prototype pollution
CVE-2023-39650: Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single.
Key phrases: sql injection
CVE-2023-39651: Improper neutralization of SQL parameter in Theme Volty CMS BrandList module for PrestaShop In the module Theme Volty CMS BrandList (tvcmsbrandlist) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
Key phrases: sql injection
CVE-2023-39652: theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run().
Key phrases: sql injection
CVE-2023-39654: abupy up to v0.4.0 was discovered to contain a SQL injection vulnerability via the component abupy.MarketBu.ABuSymbol.search_to_symbol_dict.
Key phrases: sql injection
CVE-2023-39655: A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords and take over their accounts.
Key phrases: reset other users' passwords and take over, host header injection, take over their accounts
CVE-2023-39659: An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to
CVE-2023-3966: A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.
Key phrases: denial of service, invalid memory accesses
CVE-2023-39660: An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted request to
CVE-2023-39661: An issue in pandas-ai v.0.9.1 and before allows a remote attacker to execute arbitrary code via the _is_jailbreak function.
Key phrases: execute arbitrary code, execute arbitrary code via the _is_jailbreak function
CVE-2023-39662: An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
Key phrases: execute arbitrary code, execute arbitrary code via the `exec`
CVE-2023-39663: Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk.
Key phrases: Denial of Service (ReDoS), regular expression denial of service (redos), markdownpattern
CVE-2023-39665: D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the acStack_50 parameter.
Key phrases: buffer overflow
CVE-2023-39666: D-Link DIR-842 fw_revA_1-02_eu_multi_20151008 was discovered to contain multiple buffer overflows in the fgets function via the acStack_120 and acStack_220 parameters.
Key phrases: buffer overflows
CVE-2023-39667: D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in the FUN_0000acb4 function.
Key phrases: buffer overflow
CVE-2023-39668: D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in the inet_ntoa() function.
Key phrases: buffer overflow
CVE-2023-39669: D-Link DIR-880 A1_FW107WWb08 was discovered to contain a NULL pointer dereference in the function FUN_00010824.
Key phrases: null pointer dereference
CVE-2023-3967: Allocation of Resources Without Limits or Throttling vulnerability in Hitachi Ops Center Common Services on Linux allows DoS.This issue affects Hitachi Ops Center Common Services: before 10.9.3-00.
Key phrases: DoS.This issue affects Hitachi Ops Center Common Services, allocation of resources without limits, throttling, dos
CVE-2023-39670: Tenda AC6 _US_AC6V1.0BR_V15.03.05.16 was discovered to contain a buffer overflow via the function fgets.
Key phrases: buffer overflow
CVE-2023-39671: D-Link DIR-880 A1_FW107WWb08 was discovered to contain a buffer overflow via the function FUN_0001be68.
Key phrases: buffer overflow
CVE-2023-39672: Tenda WH450 v1.0.0.18 was discovered to contain a buffer overflow via the function fgets.
Key phrases: buffer overflow
CVE-2023-39673: Tenda AC15 V1.0BR_V15.03.05.18_multi_TD01 was discovered to contain a buffer overflow via the function FUN_00010e34().
Key phrases: buffer overflow
CVE-2023-39674: D-Link DIR-880 A1_FW107WWb08 was discovered to contain a buffer overflow via the function fgets.
Key phrases: buffer overflow
CVE-2023-39675: SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.
Key phrases: sql injection
CVE-2023-39676: FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-39677: MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php.
Key phrases: phpinfo, information disclosure
CVE-2023-39678: A cross-site scripting (XSS) vulnerability in the device web interface (Log Query page) of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-39680: Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code.
Key phrases: execute arbitrary code, untrusted data
CVE-2023-39681: Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php. This vulnerability is triggered via a crafted payload.
Key phrases: remote code execution (rce)
CVE-2023-39683: Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user input parameter(s). NOTE: Researcher claims issue is present in all versions prior and later than tested version.
Key phrases: execute arbitrary code, execute arbitrary code via the user input parameter(s, cross site scripting (xss)
CVE-2023-39685: An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2023-3969: A vulnerability, which was classified as problematic, has been found in GZ Scripts Availability Booking Calendar PHP 1.0. Affected by this issue is some unknown functionality of the file index.php of the component HTTP POST Request Handler. The manipulation of the argument promo_code leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235568.
CVE-2023-39691: An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET request.
Key phrases: arbitrarily add Administrator accounts via crafted GET request
CVE-2023-39695: Insufficient session expiration in Elenos ETG150 FM Transmitter v3.12 allows attackers to arbitrarily change transmitter configuration and data after logging out.
Key phrases: arbitrarily change transmitter configuration and data after logging, insufficient session expiration
CVE-2023-39699: IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.
Key phrases: include or execute files from the local file, local file inclusion (lfi)
CVE-2023-3970: A vulnerability, which was classified as problematic, was found in GZ Scripts Availability Booking Calendar PHP 1.0. This affects an unknown part of the file /index.php?controller=GzUser&action=edit&id=1 of the component Image Handler. The manipulation of the argument img leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235569 was assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-39700: IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-39703: A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted Markdown file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted Markdown, cross site scripting (xss)
CVE-2023-39707: A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add Expense parameter under the Expense section.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via injecting, stored cross-site scripting (xss)
CVE-2023-39708: A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parameter under the New Buy section.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via injecting, stored cross-site scripting (xss)
CVE-2023-39709: Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add Member section.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via injecting, cross-site scripting (xss)
CVE-2023-3971: An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
Key phrases: capture credentials by creating a custom login page, html injection flaw, compromise
CVE-2023-39710: Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add Customer section.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via injecting, cross-site scripting (xss)
CVE-2023-39711: Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Subtotal and Paidbill parameters under the Add New Put section.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via injecting, cross-site scripting (xss)
CVE-2023-39712: Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add New Put section.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via injecting, cross-site scripting (xss)
CVE-2023-39714: Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add New Member section.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via injecting, cross-site scripting (xss)
CVE-2023-3972: A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).
Key phrases: executing arbitrary code, malicious scripts, privilege escalation, execute arbitrary, execute arbitrary code
CVE-2023-39726: An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.
Key phrases: execute arbitrary code, execute arbitrary code via crafted commands to the
CVE-2023-3973: Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.
Key phrases: cross-site scripting (xss)
CVE-2023-39731: The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, leakage
CVE-2023-39732: The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, leakage
CVE-2023-39733: The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, leakage
CVE-2023-39734: The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, leakage
CVE-2023-39735: The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, leakage
CVE-2023-39736: The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, leakage
CVE-2023-39737: The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, leakage
CVE-2023-39739: The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, leakage
CVE-2023-3974: OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.
Key phrases: os command injection
CVE-2023-39740: The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, leakage
CVE-2023-39741: lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap overflow, denial of service (dos)
CVE-2023-39742: giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c.
Key phrases: segmentation fault
CVE-2023-39743: lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c.
Key phrases: access violation
CVE-2023-39745: TP-Link TL-WR940N V2, TP-Link TL-WR941ND V5 and TP-Link TL-WR841N V8 were discovered to contain a buffer overflow via the component /userRpm/AccessCtrlAccessRulesRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2023-39747: TP-Link WR841N V8, TP-Link TL-WR940N V2, and TL-WR941ND V5 were discovered to contain a buffer overflow via the radiusSecret parameter at /userRpm/WlanSecurityRpm.
Key phrases: buffer overflow
CVE-2023-39748: An issue in the component /userRpm/NetworkCfgRpm of TP-Link TL-WR1041N V2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2023-39749: D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the component /adv_resource. This vulnerability is exploited via a crafted GET request.
Key phrases: buffer overflow
CVE-2023-3975: OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.
Key phrases: os command injection
CVE-2023-39750: D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the f_ipv6_enable parameter at /bsc_ipv6. This vulnerability is exploited via a crafted POST request.
Key phrases: buffer overflow
CVE-2023-39751: TP-Link TL-WR941ND V6 were discovered to contain a buffer overflow via the pSize parameter at /userRpm/PingIframeRpm.
Key phrases: buffer overflow
CVE-2023-3977: Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-39776: A File Upload vulnerability in PHPJabbers Ticket Support Script v3.2 allows attackers to execute arbitrary code via uploading a crafted file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted file, file upload
CVE-2023-39777: A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via the, cross-site scripting (xss)
CVE-2023-3978: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
CVE-2023-39780: ASUS RT-AX55 v3.0.0.4.386.51598 was discovered to contain an authenticated command injection vulnerability.
Key phrases: authenticated command injection
CVE-2023-39784: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the save_virtualser_data function.
Key phrases: stack overflow
CVE-2023-39785: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the set_qosMib_list function.
Key phrases: stack overflow
CVE-2023-39786: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sscanf function.
Key phrases: stack overflow
CVE-2023-3979: An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge requests source branch.
CVE-2023-39796: SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the DB_RECORD_TABLE parameter, sql injection
CVE-2023-3980: Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.
Key phrases: cross-site scripting (xss)
CVE-2023-39801: A lack of exception handling in the Renault Easy Link Multimedia System Software Version 283C35519R allows attackers to cause a Denial of Service (DoS) via supplying crafted WMA files when connecting a device to the vehicle's USB plug and play feature.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), exception handling, denial of service (dos)
CVE-2023-39804: In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.
Key phrases: mishandled extension attributes, application crash
CVE-2023-39805: iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.
Key phrases: sql injection
CVE-2023-39806: iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.
Key phrases: sql injection
CVE-2023-39807: N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-register.php.
Key phrases: sql injection
CVE-2023-39808: N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password which allows attackers to login with root privileges via the SSH service.
Key phrases: login with root privileges via the SSH service, hardcoded root password
CVE-2023-39809: N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a command injection vulnerability via the system_hostname parameter at /manage/network-basic.php.
Key phrases: command injection
CVE-2023-3981: Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.
Key phrases: server-side request forgery (ssrf)
CVE-2023-39810: An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
Key phrases: execute a directory traversal
CVE-2023-3982: Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.
Key phrases: cross-site scripting (xss)
CVE-2023-39827: Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the rule_info parameter in the formAddMacfilterRule function.
Key phrases: stack overflow
CVE-2023-39828: Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.
Key phrases: stack overflow
CVE-2023-39829: Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the wpapsk_crypto2_4g parameter in the fromSetWirelessRepeat function.
Key phrases: stack overflow
CVE-2023-3983: An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection.
Key phrases: bypass checks, authenticated sql injection, blind sql injection
CVE-2023-39834: PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.
Key phrases: command injection
CVE-2023-3984: A vulnerability, which was classified as critical, was found in phpscriptpoint RecipePoint 1.9. This affects an unknown part of the file /recipe-result. The manipulation of the argument text/category/type/difficulty/cuisine/cooking_method leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-235605 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-39841: Missing encryption in the RFID tag of Etekcity 3-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.
Key phrases: create a cloned tag via brief physical proximity, missing encryption
CVE-2023-39842: Missing encryption in the RFID tag of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.
Key phrases: create a cloned tag via brief physical proximity, missing encryption
CVE-2023-39843: Missing encryption in the RFID tag of Suleve 5-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.
Key phrases: create a cloned tag via brief physical proximity, missing encryption
CVE-2023-39846: An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.
Key phrases: bypass authentication, bypass authentication via a crafted JWT token
CVE-2023-3985: A vulnerability has been found in SourceCodester Online Jewelry Store 1.0 and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235606 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-39850: Schoolmate v1.3 was discovered to contain multiple SQL injection vulnerabilities via the $courseid and $teacherid parameters at DeleteFunctions.php.
Key phrases: sql injection
CVE-2023-39851: webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php. NOTE: this is disputed by a third party who indicates that the playerID is a session variable controlled by the server, and thus cannot be used for exploitation.
Key phrases: sql injection, exploitation
CVE-2023-39852: Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. NOTE: this is disputed by a third party who claims that the userid is a session variable controlled by the server, and thus cannot be used for exploitation. The original reporter counterclaims that this originates from $_SESSION["userid"]=$_POST["userid"] at line 68 in doctors\\\\doctorlogin.php, where userid under POST is not a session variable controlled by the server.
Key phrases: sql injection
CVE-2023-39853: SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module.
Key phrases: obtain sensitive information, obtain sensitive information via the doobj and doevent, sql injection
CVE-2023-39854: The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or user account) to include files via a URL in the /hydra/view/get_cc_url url parameter. There can be resultant SSRF.
Key phrases: include files via a URL in the /hydra, ssrf, default credentials,
CVE-2023-3986: A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=user/list. The manipulation of the argument First Name/Last Name/Username leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235607.
Key phrases: cross site scripting
CVE-2023-3987: A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=user/manage_user&id=3. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235608.
Key phrases: sql injection
CVE-2023-3988: A vulnerability was found in Cafe Billing System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php of the component Order Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235609 was assigned to this vulnerability.
Key phrases: sql injection