yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-41114: An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the functions get_url_as_text and get_url_as_bytea that are publicly executable, thus permitting an authenticated user to read any file from the local filesystem or remote system regardless of that user's permissions.
Key phrases: publicly executable
CVE-2023-41115: An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. When using UTL_ENCODE, an authenticated user can read any large object, regardless of that user's permissions.
Key phrases: utl_encode
CVE-2023-41116: An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It allows an authenticated user to refresh any materialized view, regardless of that user's permissions.
Key phrases: refresh any materialized view
CVE-2023-41117: An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contain packages, standalone packages, and functions that run SECURITY DEFINER but are inadequately secured against search_path attacks.
Key phrases: search_path
CVE-2023-41118: An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It may allow an authenticated user to bypass authorization requirements and access underlying implementation functions. When a superuser has configured file locations using CREATE DIRECTORY, these functions allow users to take a wide range of actions, including read, write, copy, rename, and delete.
Key phrases: bypass authorization requirements, bypass authorization requirements and access underlying implementation functions, take a wide range of actions
CVE-2023-41119: An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the function _dbms_aq_move_to_exception_queue that may be used to elevate a user's privileges to superuser. This function accepts the OID of a table, and then accesses that table as the superuser by using SELECT and DML commands.
CVE-2023-4112: A vulnerability was found in PHP Jabbers Shuttle Booking Software 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-235959. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross-site scripting, disclosure
CVE-2023-41120: An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It permits an authenticated user to use DBMS_PROFILER to remove all accumulated profiling data on a system-wide basis, regardless of that user's permissions.
Key phrases: dbms_profiler, system-wide basis
CVE-2023-41121: Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP operations.
Key phrases: crash through abnormal HTTP operations, denial of service
CVE-2023-41127: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Evergreen Content Poster Evergreen Content Poster  Auto Post and Schedule Your Best Content to Social Media allows Stored XSS.This issue affects Evergreen Content Poster  Auto Post and Schedule Your Best Content to Social Media: from n/a through 1.3.6.1.
Key phrases: Social Media: from n/a through, cross-site scripting, stored xss
CVE-2023-41128: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design WP Roadmap  Product Feedback Board allows Stored XSS.This issue affects WP Roadmap  Product Feedback Board: from n/a through 1.0.8.
Key phrases: Stored XSS.This issue affects WP Roadmap  Product, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-41129: Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6.
Key phrases: cross-site request forgery (csrf)
CVE-2023-4113: A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-235960. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: php jabbers service booking script, disclosure
CVE-2023-41131: Cross-Site Request Forgery (CSRF) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <=2.10 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41136: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laurence/OhMyBox.Info Simple Long Form allows Stored XSS.This issue affects Simple Long Form: from n/a through 2.2.2.
Key phrases: Stored XSS.This issue affects Simple Long Form:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-41137: Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.
Key phrases: reverse engineering, impersonate
CVE-2023-41138: The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process.
Key phrases: executing arbitrary commands, execute arbitrary
CVE-2023-41139: A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
Key phrases: untrusted pointer, code execution
CVE-2023-4114: A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235961 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, disclosure
CVE-2023-41140: A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Key phrases: execute arbitrary code, heap-based buffer overflow, crash, sensitive data
CVE-2023-41145: Autodesk users who no longer have an active license for an account can still access cases for that account.
CVE-2023-41146: Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account.
Key phrases: see cases created by other users on the
CVE-2023-41149: F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running.
Key phrases: os command injection, execute arbitrary, arbitrary os command
CVE-2023-4115: A vulnerability classified as problematic has been found in PHP Jabbers Cleaning Business 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument index leads to cross site scripting. It is possible to launch the attack remotely. VDB-235962 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, cross-site scripting, disclosure
CVE-2023-41150: F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.
Key phrases: cross-site scripting, arbitrary script
CVE-2023-41151: An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wants to send an error packet, while socket is blocked on writing.
Key phrases: application crash
CVE-2023-41152: A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the handle program field while creating a new MIME type program.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, stored cross-site scripting (xss)
CVE-2023-41153: A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via options for the host value while editing the host options.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via options, stored cross-site scripting (xss)
CVE-2023-41154: A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, stored cross-site scripting (xss)
CVE-2023-41155: A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the forward to field while creating a mail forwarding rule.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, stored cross-site scripting (xss)
CVE-2023-41156: A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the save to new folder named field while creating a new filter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, stored cross-site scripting (xss)
CVE-2023-41157: Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name parameter while creating the folder to manage the folder tab, filter tab, and forward mail tab.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2023-41158: A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the description field while creating a new MIME type program.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, stored cross-site scripting (xss)
CVE-2023-41159: A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML by editing the forward file manually.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML by editing, stored cross-site scripting (xss)
CVE-2023-4116: A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, disclosure
CVE-2023-41160: A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the key name field while adding an authorized key.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, stored cross-site scripting (xss)
CVE-2023-41161: Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, stored cross-site scripting (xss)
CVE-2023-41162: A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the file mask field while searching under the tools drop down.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, reflected cross-site scripting (xss)
CVE-2023-41163: A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools drop down.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, reflected cross-site scripting (xss)
CVE-2023-41164: In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
Key phrases:  DoS (denial of service), dos (denial of service)
CVE-2023-41165: An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9. An administrator with write access to the SNS firewall can configure a login disclaimer with malicious JavaScript elements that can result in data theft.
Key phrases: malicious javascript elements, data theft
CVE-2023-41166: An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0 through 4.7.1. It's possible to know if a specific user account exists on the SNS firewall by using remote access commands.
Key phrases: remote access commands
CVE-2023-41167: @webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the editor.js rich text editor to handle rich text content. The CMS stores rich text content from the editor.js into the database. When the @webiny/react-rich-text-renderer is used to render such content, it uses the dangerouslySetInnerHTML prop, without applying HTML sanitization. The issue arises when an actor, who in this context would specifically be a content manager with access to the CMS, inserts a malicious script as part of the user-defined input. This script is then injected and executed within the user's browser when the main page or admin page loads.
Key phrases: render data coming from Webiny Headless CMS and, xss
CVE-2023-41168: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 1 of 4).
Key phrases: a Stored Cross-Site scripting vulnerability (, stored cross-site scripting
CVE-2023-41169: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 2 of 4).
Key phrases: a Stored Cross-Site scripting vulnerability (, stored cross-site scripting
CVE-2023-4117: A vulnerability, which was classified as problematic, has been found in PHP Jabbers Rental Property Booking 2.0. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235964. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, disclosure
CVE-2023-41170: NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability.
Key phrases: a Reflected Cross-Site scripting vulnerability, reflected cross-site scripting
CVE-2023-41171: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 3 of 4).
Key phrases: a Stored Cross-Site scripting vulnerability (, stored cross-site scripting
CVE-2023-41172: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 4 of 4).
Key phrases: a Stored Cross-Site scripting vulnerability (, stored cross-site scripting
CVE-2023-41173: AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets.
Key phrases: cause a denial of service via malformed UDP, malformed udp packets
CVE-2023-41174: The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2023-41175: A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
Key phrases: cause a denial of service or possibly execute, integer overflows, heap-based buffer overflow, execute arbitrary, execute arbitrary code, heap based buffer overflow
CVE-2023-41176: Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.Please note, this vulnerability is similar to, but not identical to, CVE-2023-41177.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41177: Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.Please note, this vulnerability is similar to, but not identical to, CVE-2023-41178.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41178: Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.Please note, this vulnerability is similar to, but not identical to, CVE-2023-41176.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41179: A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation.Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Key phrases: execute arbitrary commands, obtain administrative console access, manipulate the module to execute arbitrary commands on, party av uninstaller module
CVE-2023-4118: A vulnerability, which was classified as problematic, was found in Cute Http File Server 2.0. This affects an unknown part of the component Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235965 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, cross-site scripting, disclosure
CVE-2023-41180: Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped,  disabling verification by default, when using HTTPS.Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.
Key phrases: present a forged certificate during TLS handshake negotation, incorrect certificate validation, default behavior
CVE-2023-4119: A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The manipulation of the argument query/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-235966 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, disclosure
CVE-2023-4120: A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the file importhtml.php. The manipulation of the argument sql leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235967. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: command injection, disclosure
CVE-2023-4121: A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235968. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: unrestricted upload, disclosure
CVE-2023-4122: Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.
Key phrases: obtain Remote Code Execution, obtain Remote Code Execution on the server hosting, insecure file upload, remote code execution
CVE-2023-41231: Incorrect default permissions in some ACAT software maintained by Intel(R) before version 2.0.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2023-41232: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.7, iOS 17 and iPadOS 17, macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. An app may be able to disclose kernel memory.
Key phrases: out-of-bounds read, out of bounds read
CVE-2023-41233: Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.
Key phrases: inject an arbitrary script, cross-site scripting
CVE-2023-41235: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Everest News Pro theme <=1.1.7 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41236: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Happy addons Happy Elementor Addons Pro plugin <=2.8.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41237: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Arya Multipurpose Pro theme <=1.0.8 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41238: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UltimatelySocial Social Media Share Buttons & Social Sharing Icons plugin <=2.8.3 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41239: Server-Side Request Forgery (SSRF) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry.This issue affects PowerPress Podcasting plugin by Blubrry: from n/a through 11.0.6.
Key phrases: server-side request forgery (ssrf)
CVE-2023-4124: Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.
Key phrases: missing authorization
CVE-2023-41241: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SureCart WordPress Ecommerce For Creating Fast Online Stores plugin <=2.5.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41242: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hassan Ali Snap Pixel plugin <=1.5.7 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41244: Cross-Site Request Forgery (CSRF) vulnerability in Buildfail Localize Remote Images plugin <=1.0.9 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41248: In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration
Key phrases: stored xss
CVE-2023-41249: In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step
Key phrases: xss
CVE-2023-4125: Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.
Key phrases: weak password requirements
CVE-2023-41250: In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration
Key phrases: xss
CVE-2023-41252: Out-of-bounds read in some Intel(R) QAT software drivers for Windows before version QAT1.7-W-1.11.0 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, out-of-bounds read, out of bounds read
CVE-2023-41253: When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: plaintext
CVE-2023-41254: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. An app may be able to access sensitive user data.
Key phrases: privacy issue
CVE-2023-41255: The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the su binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol  exposed on the network.
Key phrases: gain a root shell, the subnet of the TPC-110W device to gain
CVE-2023-41256: Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 are vulnerable to authentication bypass that could allow an unauthorized attacker to obtain user access.
Key phrases: bypass that could allow an unauthorized attacker to obtain user access, authentication bypass
CVE-2023-41257: A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties.  A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Key phrases: type confusion, memory corruption, arbitrary code execution, exploitation
CVE-2023-41259: Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.
Key phrases: Information Disclosure via fake or spoofed RT email, information disclosure, spoofing
CVE-2023-4126: Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0.
Key phrases: insufficient session expiration
CVE-2023-41260: Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.
Key phrases: mail-gateway REST API calls, information exposure
CVE-2023-41261: An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV does not require authentication and allows an unauthenticated user to export a report and access the results.
Key phrases: export a report and access the results, unauthenticated user
CVE-2023-41262: An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allowing an unauthenticated user to execute arbitrary SQL statements in the context of the application's backend database server.
Key phrases: execute arbitrary SQL statements, execute arbitrary SQL statements in the context of, sql injection
CVE-2023-41263: An issue was discovered in Plixer Scrutinizer before 19.3.1. It exposes debug logs to unauthenticated users at the /debug/ URL path. With knowledge of valid IP addresses and source types, an unauthenticated attacker can download debug logs containing application-related information.
CVE-2023-41264: Netwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows authentication bypass on deployment endpoints, leading to privilege escalation. This only occurs if the configuration omits the required restSettings.AuthorizedClientId and restSettings.AuthorizedSecret fields (for the POST /api/Deployment/ExportConfiguration and POST /api/Deployment endpoints).
Key phrases: bypass on deployment endpoints, leading to privilege escalation, authentication bypass
CVE-2023-41265: An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Key phrases: elevate their privilege by tunneling HTTP requests in, send requests that get executed by the backend, http request tunneling, elevate privileges
CVE-2023-41266: A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Key phrases: generate an anonymous session, transmit HTTP requests to unauthorized endpoints, path traversal
CVE-2023-41267: In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentationinfo pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1
CVE-2023-41268: Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault.This issue affects Escargot: from 3.0.0 through 4.0.0.
Key phrases: stack overflow and segmentation fault, improper input validation
CVE-2023-4127: Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.
Key phrases: race condition
CVE-2023-41270: Improper Restriction of Excessive Authentication Attempts vulnerability in Samsung Smart TV UE40D7000 version T-GAPDEUC-1033.2 and before allows attackers to cause a denial of service via WPS attack tools.
Key phrases: cause a denial of service via WPS attack, excessive authentication attempts
CVE-2023-41273: A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.2.2533 build 20230926 and laterQuTS hero h5.1.2.2534 build 20230927 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, heap-based buffer overflow, heap based buffer overflow
CVE-2023-41274: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.2.2533 build 20230926 and laterQuTS hero h5.1.2.2534 build 20230927 and laterQuTScloud c5.1.5.2651 and later
Key phrases: launch a denial-of-service (, null pointer dereference, denial-of-service (dos), denial of service
CVE-2023-41275: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.2.2533 build 20230926 and laterQuTS hero h5.1.2.2534 build 20230927 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-41276: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.2.2533 build 20230926 and laterQuTS hero h5.1.2.2534 build 20230927 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-41277: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.2.2533 build 20230926 and laterQuTS hero h5.1.2.2534 build 20230927 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-41278: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.2.2533 build 20230926 and laterQuTS hero h5.1.2.2534 build 20230927 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-41279: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.2.2533 build 20230926 and laterQuTS hero h5.1.2.2534 build 20230927 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-41280: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.2.2533 build 20230926 and laterQuTS hero h5.1.2.2534 build 20230927 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-41281: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute commands via a network, os command injection
CVE-2023-41282: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute commands via a network, os command injection
CVE-2023-41283: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute commands via a network, os command injection
CVE-2023-41284: A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.We have already fixed the vulnerability in the following version:QuMagie 2.1.4 and later
Key phrases: inject malicious code via a network, sql injection
CVE-2023-41285: A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.We have already fixed the vulnerability in the following version:QuMagie 2.1.4 and later
Key phrases: inject malicious code via a network, sql injection
CVE-2023-41287: A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a network.We have already fixed the vulnerability in the following version:Video Station 5.7.2 ( 2023/11/23 ) and later
Key phrases: inject malicious code via a network, sql injection
CVE-2023-41288: An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network.We have already fixed the vulnerability in the following version:Video Station 5.7.2 ( 2023/11/23 ) and later
Key phrases: execute commands via a network, os command injection
CVE-2023-41289: An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network.We have already fixed the vulnerability in the following version:QcalAgent 1.1.8 and later
Key phrases: execute commands via a network, os command injection
CVE-2023-4129: Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this vulnerability, allowing an attacker to recover plaintext from a block of ciphertext.
Key phrases: recover plaintext from a block of ciphertext, inadequate encryption strength
CVE-2023-41292: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and laterQuTScloud c5.1.5.2651 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-41293: Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality.
Key phrases: data security classification, confidentiality
CVE-2023-41294: The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services.
Key phrases: service hijacking
CVE-2023-41295: Vulnerability of improper permission management in the displayengine module. Successful exploitation of this vulnerability may cause the screen to turn dim.
Key phrases: vulnerability of improper permission management, screen to turn dim, improper permissions
CVE-2023-41296: Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect integrity and confidentiality.
Key phrases: vulnerability of missing authorization, integrity, confidentiality
CVE-2023-41297: Vulnerability of defects introduced in the design process in the HiviewTunner module. Successful exploitation of this vulnerability may cause service hijacking.
Key phrases: service hijacking
CVE-2023-41298: Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality.
Key phrases: vulnerability of permission control, affect confidentiality
CVE-2023-41299: DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
Key phrases: dos, restart
CVE-2023-41300: Vulnerability of parameters not being strictly verified in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
Key phrases: system to restart
CVE-2023-41301: Vulnerability of unauthorized API access in the PMS module. Successful exploitation of this vulnerability may cause features to perform abnormally.
Key phrases: vulnerability of unauthorized api access, perform abnormally
CVE-2023-41302: Redirection permission verification vulnerability in the home screen module. Successful exploitation of this vulnerability may cause features to perform abnormally.
Key phrases: redirection permission verification, perform abnormally
CVE-2023-41303: Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may cause variables in the sock structure to be modified.
Key phrases: command injection
CVE-2023-41304: Parameter verification vulnerability in the window module.Successful exploitation of this vulnerability may cause the size of an app window to be adjusted to that of a floating window.
Key phrases: parameter verification, size of an app window
CVE-2023-41305: Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of this vulnerability may affect confidentiality.
Key phrases: vulnerability of messages, affect confidentiality
CVE-2023-41306: Vulnerability of mutex management in the bone voice ID trusted application (TA) module. Successful exploitation of this vulnerability may cause the bone voice ID feature to be unavailable.
Key phrases: mutex management, unavailable
CVE-2023-41307: Memory overwriting vulnerability in the security module. Successful exploitation of this vulnerability may affect availability.
Key phrases: memory overwriting, availability, memory overwrite
CVE-2023-41308: Screenshot vulnerability in the input module. Successful exploitation of this vulnerability may affect confidentiality.
Key phrases: screenshot, affect confidentiality
CVE-2023-41309: Permission control vulnerability in the MediaPlaybackController module. Successful exploitation of this vulnerability may affect availability.
Key phrases: permission control, availability
CVE-2023-41310: Keep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation of this vulnerability may cause malicious apps to run continuously in the background.
Key phrases: keep-alive
CVE-2023-41311: Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause an app to be activated automatically.
Key phrases: permission control, activated automatically
CVE-2023-41312: Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several apps to be activated automatically.
Key phrases: permission control
CVE-2023-41313: The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks.Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue.
Key phrases: timing
CVE-2023-41314: The api /api/snapshot and /api/get_log_file would allow unauthenticated access.It could allow aDoS attack or get arbitrary files from FE node.Pleaseupgrade to 2.0.3 to fix these issues.
Key phrases: get arbitrary files, 2.0.3 to fix these issues, unauthenticated access
CVE-2023-41316: Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitation emails which appear as legitimate org invitations. Bad actors may direct users to malicious website or execute javascript in the context of the users browser. This vulnerability has been addressed in version 3.29.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: html injected code