yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-37274: Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. When Auto-GPT is executed directly on the host system via the provided run.sh or run.bat files, custom Python code execution is sandboxed using a temporary dedicated docker container which should not have access to any files outside of the Auto-GPT workspace directory.Before v0.4.3, the `execute_python_code` command (introduced in v0.4.1) does not sanitize the `basename` arg before writing LLM-supplied code to a file with an LLM-supplied name. This allows for a path traversal attack that can overwrite any .py file outside the workspace directory by specifying a `basename` such as `../../../main.py`. This can further be abused to achieve arbitrary code execution on the host running Auto-GPT by e.g. overwriting autogpt/main.py which will be executed outside of the docker environment meant to sandbox custom python code execution the next time Auto-GPT is started. The issue has been patched in version 0.4.3. As a workaround, the risk introduced by this vulnerability can be remediated by running Auto-GPT in a virtual machine, or another environment in which damage to files or corruption of the program is not a critical problem.
Key phrases: achieve arbitrary code execution, achieve arbitrary code execution on the host running, path traversal
CVE-2023-37275: Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of color-coded print statements to signify different types of system messages to the user, including messages that are crucial for the user to review and control which commands should be executed. Before v0.4.3, it was possible for a malicious external resource (such as a website browsed by Auto-GPT) to cause misleading messages to be printed to the console by getting the LLM to regurgitate JSON encoded ANSI escape sequences (`\\\\u001b[`). These escape sequences were JSON decoded and printed to the console as part of the model's "thinking process". The issue has been patched in release version 0.4.3.
CVE-2023-37276: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`). Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling. This issue has been addressed in version 3.8.5. Users are advised to upgrade. Users unable to upgrade can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable.
Key phrases: http request smuggling
CVE-2023-37277: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST requests and accepts `text/plain`, `multipart/form-data` or `application/www-form-urlencoded` as content types which can be sent via regular HTML forms, thus allowing cross-site request forgery. With the interaction of a user with programming rights, this allows remote code execution through script macros and thus impacts the integrity, availability and confidentiality of the whole XWiki installation. For regular cookie-based authentication, the vulnerability is mitigated by SameSite cookie restrictions but as of March 2023, these are not enabled by default in Firefox and Safari. The vulnerability has been patched in XWiki 14.10.8 and 15.2 by requiring a CSRF token header for certain request types that are susceptible to CSRF attacks.
Key phrases: CSRF attacks, cross-site request forgery, remote code execution, integrity, availability and confidentiality, csrf, cross site request forgery, integrity and availability
CVE-2023-37278: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in version 10.0.9.
Key phrases: sql injection
CVE-2023-37279: Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.
Key phrases: denial of service, crash
CVE-2023-3728: Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: use after free, heap corruption
CVE-2023-37280: Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.
Key phrases: execute arbitrary scripts, arbitrary scripts html content
CVE-2023-37281: Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when processing the various IPv6 header fields during IPHC header decompression, Contiki-NG confirms the received packet buffer contains enough data as needed for that field. But no similar check is done before decompressing the IPv6 address. Therefore, up to 16 bytes can be read out of bounds on the line with the statement `memcpy(&ipaddr->u8[16 - postcount], iphc_ptr, postcount);`. The value of `postcount` depends on the address compression used in the received packet and can be controlled by the attacker. As a result, an attacker can inject a packet that causes an out-of-bound read. As of time of publication, a patched version is not available. As a workaround, one can apply the changes in Contiki-NG pull request #2509 to patch the system.
Key phrases: out-of-bound read, out of bound read
CVE-2023-37282: An out-of-bounds write vulnerability exists in the VZT LZMA_Read dmem extraction functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-37283: Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter
Key phrases: bypass is possible in the PingFederate Identifier First Adapter, authentication bypass
CVE-2023-37284: Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616' allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command via a crafted request to bypass authentication.
Key phrases: bypass authentication, execute an arbitrary OS command via a crafted, improper authentication, execute arbitrary, arbitrary os command
CVE-2023-37285: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code, out-of-bounds read, out of bounds read
CVE-2023-37286: SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.
Key phrases: execute arbitrary code, hard-coded machine key, disrupt service
CVE-2023-37287: SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.
Key phrases: hard-coded authentication key
CVE-2023-37288: SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
Key phrases: access arbitrary system files, path traversal
CVE-2023-37289: It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in  InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit this vulnerability without logging system to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.This issue affects Document On-line Submission and Approval System: 22547, 22567.
Key phrases: perform arbitrary system commands, upload and run arbitrary executable files to perform, unrestricted upload of file with dangerous type, disrupt service, file upload
CVE-2023-3729: Use after free in Splitscreen in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. (Chromium security severity: High)
Key phrases: use after free, heap corruption, convince
CVE-2023-37290: InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows unauthenticated remote attackers to perform Server-Side Request Forgery (SSRF) attacks, gaining unauthorized access to arbitrary system files and uncovering the internal network topology.
Key phrases: load remote or local resources through HTML tags, perform Server-Side Request Forgery (SSRF, server-side request forgery (ssrf), unauthorized access
CVE-2023-37291: Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data.This issue affects Vitals ESP: from 3.0.8 through 6.2.0.
Key phrases: hard-coded encryption key, valid token parameter
CVE-2023-37292: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga iSherlock 5.5 (iSherlock-user modules) allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock 5.5: before iSherlock-user-5.5-174.
Key phrases: OS Command Injection, improper neutralization of special elements, os command injection
CVE-2023-37293: AMIs SPx containsa vulnerability in the BMC where an Attacker may cause astack-based buffer overflow via an adjacent network. A successful exploitationof this vulnerability may lead to a loss of confidentiality, integrity, and/oravailability. 
Key phrases: loss of confidentiality, buffer overflow, confidentiality and integrity
CVE-2023-37294: AMIsSPx contains a vulnerability in the BMC where an Attacker maycause a heap memory corruption via an adjacent network. A successful exploitationof this vulnerability may lead to a loss of confidentiality, integrity, and/oravailability.     
Key phrases: amisspx, heap memory corruption, loss of confidentiality, confidentiality and integrity
CVE-2023-37295: AMIsSPx contains a vulnerability in the BMC where an Attacker maycause a heap memory corruption via an adjacent network. A successful exploitationof this vulnerability may lead to a loss of confidentiality, integrity, and/oravailability.    
Key phrases: amisspx, heap memory corruption, loss of confidentiality, confidentiality and integrity
CVE-2023-37296: AMIsSPx contains a vulnerability in the BMC where an Attacker maycause a stack memory corruption via an adjacent network. A successful exploitationof this vulnerability may lead to a loss of confidentiality, integrity, and/oravailability.   
Key phrases: amisspx, stack memory corruption, loss of confidentiality, confidentiality and integrity
CVE-2023-37297: AMIsSPx contains a vulnerability in the BMC where an Attacker maycause a heap memory corruption via an adjacent network. A successful exploitationof this vulnerability may lead to a loss of confidentiality, integrity, and/oravailability.  
Key phrases: amisspx, heap memory corruption, loss of confidentiality, confidentiality and integrity
CVE-2023-37298: Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
Key phrases: XSS via a USE element in an SVG, xss
CVE-2023-37299: Joplin before 2.11.5 allows XSS via an AREA element of an image map.
Key phrases: XSS via an AREA element of an image, xss
CVE-2023-3730: Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: use after free, heap corruption, convince
CVE-2023-37300: An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
Key phrases: incorrect access control
CVE-2023-37301: An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.
CVE-2023-37302: An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).
Key phrases: xss
CVE-2023-37303: An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message.
Key phrases: hang
CVE-2023-37304: An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignment feature.
Key phrases: XSS via the column alignment feature, xss
CVE-2023-37305: An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php, hidden users can be exposed via public interfaces.
Key phrases: hidden users, public interfaces
CVE-2023-37306: MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
Key phrases: obtain sensitive information
CVE-2023-37307: In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.
CVE-2023-37308: Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field.
Key phrases: XSS via the username field, xss
CVE-2023-3731: Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
Key phrases: use after free, heap corruption, convince
CVE-2023-3732: Out of bounds memory access in Mojo in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: out of bounds memory access, heap corruption
CVE-2023-3733: Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: spoofing
CVE-2023-3734: Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: spoofing
CVE-2023-3735: Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-3736: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: cross-origin data
CVE-2023-37360: pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products).
Key phrases: JavaScript injection, javascript injection, privilege escalation
CVE-2023-37361: REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization.
Key phrases: SQL Injection via scheduling, sql injection
CVE-2023-37362: Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website.
Key phrases: abuse the registration functionality to login with testing
CVE-2023-37364: In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service, a similar issue to CVE-2013-4152.
Key phrases: read arbitrary files, read arbitrary files or cause a denial of, denial of service
CVE-2023-37365: Hnswlib 0.7.0 has a double free in init_index when the M argument is a large integer.
Key phrases: double free
CVE-2023-37367: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. In the NAS Task, an improperly implemented security check for standard can disallow desired services for a while via consecutive NAS messages.
CVE-2023-37368: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos Mobile Processor, Automotive Processor, and Modem - Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123). In the Shannon MM Task, Missing validation of a NULL pointer can cause abnormal termination via a malformed NR MM packet.
Key phrases: null pointer
CVE-2023-37369: In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.
Key phrases: application crash
CVE-2023-3737: Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: medium, spoofing
CVE-2023-37372: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications is vulnerable to SQL injection. This could allow an unauthenticated remote attackers to execute arbitrary SQL queries on the server database.
Key phrases: execute arbitrary SQL, execute arbitrary SQL queries on the server database, ruggedcom crossbow, sql injection
CVE-2023-37373: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications accept unauthenticated file write messages. An unauthenticated remote attacker could write arbitrary files to the affected application's file system.
Key phrases: write arbitrary files, ruggedcom crossbow, file write
CVE-2023-37374: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application is vulnerable to stack-based buffer overflow while parsing specially crafted STP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21054)
Key phrases: execute code in the context of the current, stack-based buffer overflow, stack based buffer overflow
CVE-2023-37375: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application is vulnerable to stack-based buffer overflow while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21060)
Key phrases: execute code in the context of the current, stack-based buffer overflow, stack based buffer overflow
CVE-2023-37376: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application contains a type confusion vulnerability while parsing STP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21051)
Key phrases: execute code in the context of the current, type confusion
CVE-2023-37377: An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor (Exynos 980, Exynos 850, Exynos 2100, and Exynos W920). Improper handling of length parameter inconsistency can cause incorrect packet filtering.
Key phrases: length parameter inconsistency
CVE-2023-37378: Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
Key phrases: mishandles access control
CVE-2023-37379: Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server.Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.
Key phrases: denial of service (DoS), access connection information and exploit the test connection
CVE-2023-3738: Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-37386: Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <=1.2.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-37387: Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <=2.4.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-37388: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sudipto Pratap Mahato Simple Light Weight Social Share plugin <=2.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-3739: Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker to execute arbitrary code via a crafted shell script. (Chromium security severity: Low)
Key phrases: execute arbitrary code, insufficient validation of untrusted input
CVE-2023-37390: Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.
Key phrases: deserialization of untrusted data
CVE-2023-37391: Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack  Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <=3.4.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-37392: Cross-Site Request Forgery (CSRF) vulnerability in Deepak Anand WP Dummy Content Generator plugin <=2.3.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-37393: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management  Atarim plugin <=3.9.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-3740: Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve malicious content to a user via a crafted background URL. (Chromium security severity: Low)
Key phrases: insufficient validation of untrusted input
CVE-2023-37404: IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS poisoning attack.  IBM X-Force ID:  259789.
Key phrases: execute arbitrary code, execute arbitrary code on the host after a, dns poisoning
CVE-2023-3741: An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on the device.
Key phrases: execute any command on the device, os command injection, execute commands
CVE-2023-37410: IBM Personal Communications 14.05, 14.06, and 15.0.0 could allow a local user to escalate their privileges to the SYSTEM user due to overly permissive access controls.  IBM X-Force ID:  260138.
Key phrases: escalate their privileges to the SYSTEM user due, permissive access controls, escalate privilege
CVE-2023-37415: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider.Patching on top of CVE-2023-35797Before6.1.2the proxy_user option can also inject semicolon.This issue affects Apache Airflow Apache Hive Provider: before 6.1.2.It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.
Key phrases: improper input validation
CVE-2023-37416: Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the GUI's legacy VCD parsing code.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-37417: Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the GUI's interactive VCD parsing code.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-37418: Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2vzt conversion utility.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-37419: Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt2 conversion utility.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-3742: Insufficient policy enforcement in ADB in Google Chrome on ChromeOS prior to 114.0.5735.90 allowed a local attacker to bypass device policy restrictions via physical access to the device. (Chromium security severity: High)
Key phrases: bypass device policy, insufficient policy enforcement
CVE-2023-37420: Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt conversion utility.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-37421: Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticatedremote attacker to conduct a stored cross-site scripting(XSS) attack against an administrative user of the interface.A successful exploit allows an attacker to execute arbitraryscript code in a victim's browser in the context of theaffected interface.
Key phrases: conduct a stored cross-site scripting(XSS), execute arbitraryscript code in a victim's browser, stored cross-site scripting(xss)
CVE-2023-37422: Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticatedremote attacker to conduct a stored cross-site scripting(XSS) attack against an administrative user of the interface.A successful exploit allows an attacker to execute arbitraryscript code in a victim's browser in the context of theaffected interface.
Key phrases: conduct a stored cross-site scripting(XSS), execute arbitraryscript code in a victim's browser, stored cross-site scripting(xss)
CVE-2023-37423: Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticatedremote attacker to conduct a stored cross-site scripting(XSS) attack against an administrative user of the interface.A successful exploit allows an attacker to execute arbitraryscript code in a victim's browser in the context of theaffected interface.
Key phrases: conduct a stored cross-site scripting(XSS), execute arbitraryscript code in a victim's browser, stored cross-site scripting(xss)
CVE-2023-37424: A vulnerability in the web-based management interfaceof EdgeConnect SD-WAN Orchestrator could allow anunauthenticated remote attacker to run arbitrary commands onthe underlying host if certain preconditions outside of theattacker's control are met. Successful exploitation of thisvulnerability could allow an attacker to execute arbitrarycommands on the underlying operating system leading tocomplete system compromise.
Key phrases: run arbitrary commands, run arbitrary commands onthe underlying host if certain, execute arbitrarycommands on the underlying operating system leading, system compromise
CVE-2023-37425: A vulnerability in the web-based management interfaceof EdgeConnect SD-WAN Orchestrator could allow anunauthenticated remote attacker to conduct a storedcross-site scripting (XSS) attack against an administrativeuser of the interface. A successful exploit allows anattacker to execute arbitrary script code in a victim'sbrowser in the context of the affected interface.
Key phrases: execute arbitrary script code, conduct a storedcross-site scripting (XSS, execute arbitrary script code in a victim'sbrowser in
CVE-2023-37426: EdgeConnect SD-WAN Orchestrator instances prior to theversions resolved in this advisory were found to haveshared static SSH host keys for all installations. Thisvulnerability could allow an attacker to spoof the SSH hostsignature and thereby masquerade as a legitimate Orchestratorhost.
Key phrases: spoof the SSH hostsignature and thereby masquerade as, static ssh host keys, spoofing
CVE-2023-37427: A vulnerability in the web-based management interface ofEdgeConnect SD-WAN Orchestrator could allow an authenticatedremote attacker to run arbitrary commands on the underlyinghost. Successful exploitation of this vulnerability allowsan attacker to execute arbitrary commands as root on theunderlying operating system leading to complete systemcompromise.
Key phrases: run arbitrary commands, run arbitrary commands on the underlyinghost, complete systemcompromise, execute arbitrary
CVE-2023-37428: A vulnerability in the EdgeConnect SD-WAN Orchestratorweb-based management interface allows remote authenticatedusers to run arbitrary commands on the underlying host.A successful exploit could allow an attacker to executearbitrary commands as root on the underlying operating systemleading to complete system compromise.
Key phrases: run arbitrary commands, run arbitrary commands on the underlying host, executearbitrary commands as root on the underlying operating, complete system compromise
CVE-2023-37429: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-3743: Ap Page Builder, in versions lower than 1.7.8.2, could allow a remote attacker to send a specially crafted SQL query to the product_one_img parameter to retrieve the information stored in the database.
Key phrases: send a specially crafted SQL query to the
CVE-2023-37430: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-37431: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-37432: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-37433: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-37434: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-37435: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-37436: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-37437: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-37438: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-37439: Multiple vulnerabilities in the web-based managementinterface of EdgeConnect SD-WAN Orchestrator could allowan authenticated remote attacker to conduct SQL injectionattacks against the EdgeConnect SD-WAN Orchestratorinstance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlyingdatabase potentially leading to the exposure and corruptionof sensitive data controlled by the EdgeConnect SD-WANOrchestrator host.
Key phrases: obtain and modify sensitive information, sql injectionattacks, corruptionof
CVE-2023-3744: Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.
Key phrases: send requests to internal services or upload the, server-side request forgery
CVE-2023-37440: A vulnerability in the web-based management interfaceof EdgeConnect SD-WAN Orchestrator could allow anunauthenticated remote attacker to conduct a server-siderequest forgery (SSRF) attack. A successful exploit allowsan attacker to enumerate information about the internal  structure of the EdgeConnect SD-WAN Orchestrator host leadingto potential disclosure of sensitive information.
Key phrases: conduct a server-siderequest forgery (SSRF, disclosure, sensitive information
CVE-2023-37442: Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI's default VCD parsing code.
Key phrases: out-of-bounds read, arbitrary code execution, out of bounds read
CVE-2023-37443: Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI's legacy VCD parsing code.
Key phrases: out-of-bounds read, arbitrary code execution, out of bounds read
CVE-2023-37444: Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI's interactive VCD parsing code.
Key phrases: out-of-bounds read, arbitrary code execution, out of bounds read
CVE-2023-37445: Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2vzt conversion utility.
Key phrases: out-of-bounds read, arbitrary code execution, out-of-bounds write, out of bounds read, out of bounds write
CVE-2023-37446: Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt2 conversion utility.
Key phrases: out-of-bounds read, arbitrary code execution, out-of-bounds write, out of bounds read, out of bounds write
CVE-2023-37447: Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt conversion utility.
Key phrases: out-of-bounds read, arbitrary code execution, out-of-bounds write, out of bounds read, out of bounds write
CVE-2023-37448: A lock screen issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. A user may be able to view restricted content from the lock screen.
CVE-2023-3745: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
Key phrases: trick the user into opening a specially crafted, crash, heap-based buffer overflow, out-of-bounds read error, denial of service, heap based buffer overflow, out of bounds read, application crash
CVE-2023-37450: The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Key phrases: arbitrary code execution
CVE-2023-37453: An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c.
Key phrases: out-of-bounds, crash
CVE-2023-37454: An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf_put_super and udf_close_lvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this.
Key phrases: use-after-free write operation, use after free
CVE-2023-37455: The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability affects Firefox for iOS < 115.
Key phrases: permission request prompt
CVE-2023-37456: The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS < 115.
Key phrases: session restore helper, crash
CVE-2023-37457: Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.
Key phrases: externally exploitable, crash
CVE-2023-37459: Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify that a full TCP header has been received. Specifically, the implementation attempts to access the flags field from the TCP buffer in the following conditional expression in the `check_for_tcp_syn` function. For this reason, an attacker can inject a truncated TCP packet, which will lead to an out-of-bound read from the packet buffer. As of time of publication, a patched version is not available. As a workaround, one can apply the changes in Contiki-NG pull request #2510 to patch the system.
Key phrases: out-of-bound read, out of bound read
CVE-2023-3746: The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting