yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-21701: Microsoft Protected Extensible Authentication Protocol (PEAP) Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21702: Windows iSCSI Service Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21703: Azure Data Box Gateway Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21704: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21705: Microsoft SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21706: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21707: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21708: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21709: Microsoft Exchange Server Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-2171: The BadgeOS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.7.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-21710: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21712: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: windows point-to-point tunneling protocol remote code execution
CVE-2023-21713: Microsoft SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21714: Microsoft Office Information Disclosure Vulnerability
Key phrases: microsoft office information disclosure
CVE-2023-21715: Microsoft Publisher Security Features Bypass Vulnerability
Key phrases: Microsoft Publisher Security Features Bypass, bypass
CVE-2023-21716: Microsoft Word Remote Code Execution Vulnerability
Key phrases: microsoft word remote code execution
CVE-2023-21717: Microsoft SharePoint Server Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21718: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21719: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-2172: The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeos_update_steps_ajax_handler, badgeos_update_award_steps_ajax_handler, badgeos_update_deduct_steps_ajax_handler, and badgeos_update_ranks_req_steps_ajax_handler functions. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to overwrite arbitrary post titles.
Key phrases: overwrite arbitrary post titles, insecure direct object reference
CVE-2023-21720: Microsoft Edge (Chromium-based) Tampering Vulnerability
Key phrases: tampering
CVE-2023-21721: Microsoft OneNote Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21722: .NET Framework Denial of Service Vulnerability
Key phrases: .net framework denial of service
CVE-2023-21724: Microsoft DWM Core Library Elevation of Privilege Vulnerability
Key phrases: microsoft dwm core library elevation of privilege
CVE-2023-21725: Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21726: Windows Credential Manager User Interface Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21727: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21728: Windows Netlogon Denial of Service Vulnerability
Key phrases: windows netlogon denial of service
CVE-2023-21729: Remote Procedure Call Runtime Information Disclosure Vulnerability
Key phrases: remote procedure call runtime information disclosure
CVE-2023-2173: The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeos_delete_step_ajax_handler, badgeos_delete_award_step_ajax_handler, badgeos_delete_deduct_step_ajax_handler, and badgeos_delete_rank_req_step_ajax_handler functions. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts.
Key phrases: delete arbitrary posts, insecure direct object reference
CVE-2023-21730: Microsoft Cryptographic Services Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21732: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21733: Windows Bind Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows bind filter driver elevation of privilege
CVE-2023-21734: Microsoft Office Remote Code Execution Vulnerability
Key phrases: microsoft office remote code execution
CVE-2023-21735: Microsoft Office Remote Code Execution Vulnerability
Key phrases: microsoft office remote code execution
CVE-2023-21736: Microsoft Office Visio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21737: Microsoft Office Visio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21738: Microsoft Office Visio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21739: Windows Bluetooth Driver Elevation of Privilege Vulnerability
Key phrases: windows bluetooth driver elevation of privilege
CVE-2023-2174: The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_log_entries function in versions up to, and including, 3.7.1.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the plugin's log entries.
Key phrases: unauthorized modification of data, missing capability check
CVE-2023-21740: Windows Media Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21741: Microsoft Office Visio Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-21742: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21743: Microsoft SharePoint Server Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-21744: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21745: Microsoft Exchange Server Spoofing Vulnerability
Key phrases: microsoft exchange server spoofing
CVE-2023-21746: Windows NTLM Elevation of Privilege Vulnerability
Key phrases: windows ntlm elevation of privilege
CVE-2023-21747: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-21748: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-21749: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-21750: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-21751: Azure DevOps Server Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-21752: Windows Backup Service Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21753: Event Tracing for Windows Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-21754: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-21755: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-21756: Windows Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21757: Windows Layer 2 Tunneling Protocol (L2TP) Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21758: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Key phrases: windows internet key exchange (ike) extension denial of service
CVE-2023-21759: Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-2176: A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege.
Key phrases: out-of-boundary read, escalation of privilege, crash, crash system, escalation privilege
CVE-2023-21760: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21761: Microsoft Exchange Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-21762: Microsoft Exchange Server Spoofing Vulnerability
Key phrases: microsoft exchange server spoofing
CVE-2023-21763: Microsoft Exchange Server Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21764: Microsoft Exchange Server Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21765: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21766: Windows Overlay Filter Information Disclosure Vulnerability
Key phrases: windows overlay filter information disclosure
CVE-2023-21767: Windows Overlay Filter Elevation of Privilege Vulnerability
Key phrases: windows overlay filter elevation of privilege
CVE-2023-21768: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Key phrases: winsock elevation of privilege
CVE-2023-21769: Microsoft Message Queuing Denial of Service Vulnerability
Key phrases: microsoft message queuing denial of service
CVE-2023-2177: A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service.
Key phrases: denial of service, null pointer, null pointer dereference, crash, crash system
CVE-2023-21771: Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability
Key phrases: windows local session manager (lsm) elevation of privilege
CVE-2023-21772: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-21773: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-21774: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-21775: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21776: Windows Kernel Information Disclosure Vulnerability
Key phrases: windows kernel information disclosure
CVE-2023-21777: Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21778: Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21779: Visual Studio Code Remote Code Execution Vulnerability
Key phrases: visual studio code remote code execution
CVE-2023-2178: The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2023-21780: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21781: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21782: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21783: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21784: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21785: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21786: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21787: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21788: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21789: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-2179: The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
Key phrases: update arbitrary order status, csrf
CVE-2023-21790: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21791: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21792: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21793: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-21794: Microsoft Edge (Chromium-based) Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-21795: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21796: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21797: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21798: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21799: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-2180: The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization (assuming they can upload a file on the server)
Key phrases: read/downlaod arbitrary files, phar unserialization
CVE-2023-21800: Windows Installer Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-21801: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21802: Windows Media Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21803: Windows iSCSI Discovery Service Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21804: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2023-21805: Windows MSHTML Platform Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21806: Power BI Report Server Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-21807: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-21808: .NET and Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21809: Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, feature bypass
CVE-2023-2181: An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI.
CVE-2023-21811: Windows iSCSI Service Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21812: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2023-21813: Windows Secure Channel Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21815: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21816: Windows Active Directory Domain Services API Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21817: Windows Kerberos Elevation of Privilege Vulnerability
Key phrases: windows kerberos elevation of privilege
CVE-2023-21818: Windows Secure Channel Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-21819: Windows Secure Channel Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-2182: An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users.
Key phrases: become 'regular' users thus leading to, privilege escalation
CVE-2023-21820: Windows Distributed File System (DFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-21822: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2023-21823: Windows Graphics Component Remote Code Execution Vulnerability
Key phrases: windows graphics component remote code execution
CVE-2023-21824: Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Customer, Config, Pricing Manager).  Supported versions that are affected are 12.0.0.3.0-12.0.0.7.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
Key phrases: the infrastructure where Oracle Communications BRM - Elastic, confidentiality impacts, unauthorized access
CVE-2023-21825: Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Supplier Management).  Supported versions that are affected are 12.2.6-12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Key phrases: compromise Oracle iSupplier Portal, confidentiality impacts
CVE-2023-21826: Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting).   The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hospitality Reporting and Analytics.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data as well as  unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H).
Key phrases: compromise Oracle Hospitality Reporting and Analytics, unauthorized access to critical data, hang, hang frequently repeatable crash
CVE-2023-21827: Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server.  Supported versions that are affected are 19c and  21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database Data Redaction.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Database Data Redaction accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Key phrases: compromise Oracle Database Data Redaction, confidentiality impacts
CVE-2023-21828: Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting).   The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hospitality Reporting and Analytics.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as  unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Key phrases: compromise Oracle Hospitality Reporting and Analytics, confidentiality and integrity impacts, unauthorized access
CVE-2023-21829: Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server.  Supported versions that are affected are 19c and  21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Database RDBMS Security accessible data as well as  unauthorized read access to a subset of Oracle Database RDBMS Security accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N).
Key phrases: compromise Oracle Database RDBMS Security, confidentiality and integrity impacts
CVE-2023-2183: Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.
Key phrases: phishing
CVE-2023-21830: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization).  Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf; Oracle GraalVM Enterprise Edition: 20.3.8 and  21.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Key phrases: compromise Oracle Java SE, integrity impacts
CVE-2023-21831: Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft (component: Advising Notes).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Academic Advisement.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise CS Academic Advisement accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Key phrases: compromise PeopleSoft Enterprise CS Academic Advisement, confidentiality impacts
CVE-2023-21832: Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security).  Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Key phrases: compromise Oracle BI Publisher, confidentiality, integrity and availability impacts
CVE-2023-21833: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Key phrases: compromise Oracle ZFS Storage Appliance Kit, confidentiality impacts
CVE-2023-21834: Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workflow, Approval, Work Force Management).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Self-Service Human Resources.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Self-Service Human Resources accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
Key phrases: compromise Oracle Self-Service Human Resources, integrity impacts
CVE-2023-21835: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and  22.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DTLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Key phrases: denial of service (partial DOS), compromise Oracle Java SE, partial denial of service, availability impacts
CVE-2023-21836: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2023-21837: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Key phrases: compromise Oracle WebLogic Server, confidentiality impacts, unauthorized access
CVE-2023-21838: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise Oracle WebLogic Server, availability impacts, hang, hang frequently repeatable crash
CVE-2023-21839: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Key phrases: compromise Oracle WebLogic Server, confidentiality impacts, unauthorized access
CVE-2023-2184: The WP Responsive Tabs horizontal vertical and accordion Tabs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.1.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2023-21840: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS).  Supported versions that are affected are 5.7.40 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2023-21841: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Key phrases: compromise Oracle WebLogic Server, confidentiality impacts, unauthorized access
CVE-2023-21842: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Key phrases: compromise Oracle WebLogic Server, confidentiality impacts, unauthorized access
CVE-2023-21843: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound).  Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and  22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Key phrases: compromise Oracle Java SE, integrity impacts
CVE-2023-21844: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search).  Supported versions that are affected are 8.59 and  8.60. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Key phrases: compromise PeopleSoft Enterprise PeopleTools, scope change
CVE-2023-21845: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor).   The supported version that is affected is 8.60. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Key phrases: compromise PeopleSoft Enterprise PeopleTools, confidentiality and integrity impacts
CVE-2023-21846: Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security).  Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Key phrases: compromise Oracle BI Publisher, confidentiality, integrity and availability impacts
CVE-2023-21847: Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Download).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Web Applications Desktop Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Web Applications Desktop Integrator accessible data as well as  unauthorized read access to a subset of Oracle Web Applications Desktop Integrator accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Key phrases: compromise Oracle Web Applications Desktop Integrator, scope change
CVE-2023-21848: Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin Configuration).   The supported version that is affected is 3.0.3.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Convergence.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Convergence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Key phrases: compromise Oracle Communications Convergence, confidentiality, integrity and availability impacts
CVE-2023-21849: Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications DBA.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Applications DBA accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key phrases: compromise Oracle Applications DBA, integrity impacts
CVE-2023-21850: Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections).  Supported versions that are affected are 12.1 and  12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demantra Demand Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Demantra Demand Management accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key phrases: compromise Oracle Demantra Demand Management, integrity impacts
CVE-2023-21851: Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key phrases: compromise Oracle Marketing, integrity impacts
CVE-2023-21852: Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Learning Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Learning Management accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key phrases: compromise Oracle Learning Management, integrity impacts
CVE-2023-21853: Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Synchronization).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key phrases: compromise Oracle Mobile Field Service, integrity impacts
CVE-2023-21854: Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Sales Offline.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Sales Offline accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key phrases: compromise Oracle Sales Offline, integrity impacts
CVE-2023-21855: Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(PocketPC)).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Sales for Handhelds.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Sales for Handhelds accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key phrases: compromise Oracle Sales for Handhelds, integrity impacts
CVE-2023-21856: Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle iSetup accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key phrases: compromise Oracle iSetup, integrity impacts
CVE-2023-21857: Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Auomated Test Suite).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HCM Common Architecture accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key phrases: compromise Oracle HCM Common Architecture, integrity impacts
CVE-2023-21858: Vulnerability in the Oracle Collaborative Planning product of Oracle E-Business Suite (component: Installation).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Collaborative Planning.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Collaborative Planning accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Key phrases: compromise Oracle Collaborative Planning, integrity impacts
CVE-2023-21859: Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Access Manager executes to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
Key phrases: the infrastructure where Oracle Access Manager executes to, confidentiality impacts, unauthorized access
CVE-2023-2186: On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user can use this format string vulnerability to repeatedly crash the GTWWebMonitor.exe process to DoS the Web Monitor.  Furthermore, an authenticated user can leverage this vulnerability to leak memory from the GTWWebMonitor.exe process. This could be leveraged in an exploit chain to gain code execution.
Key phrases: gain code execution, unrestricted memory reads, format string, dos, exploit chain, crash, leak memory