yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-43821: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesActionLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
Key phrases: stack based buffer overflow, remote code execution
CVE-2023-43822: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesTimeLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
Key phrases: stack based buffer overflow, remote code execution
CVE-2023-43823: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
Key phrases: stack based buffer overflow, remote code execution
CVE-2023-43824: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
Key phrases: stack based buffer overflow, remote code execution
CVE-2023-43825: Relative path traversal vulnerability in Shihonkanri Plus Ver9.0.3 and earlier allows a local attacker to execute an arbitrary code by having a legitimate user import a specially crafted backup file of the product..
Key phrases: execute an arbitrary code by having a legitimate, relative path traversal, execute arbitrary, execute arbitrary code
CVE-2023-43826: Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.Users are recommended to upgrade to version 1.5.4, which fixes this issue.
Key phrases: allowing arbitrary code, be executed with the privileges of the running, integer overflow, memory corruption
CVE-2023-43828: A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-4383: A vulnerability, which was classified as critical, was found in MicroWorld eScan Anti-Virus 7.0.32 on Linux. This affects an unknown part of the file runasroot. The manipulation leads to incorrect execution-assigned permissions. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: disclosure
CVE-2023-43830: A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum deposit', 'Maximum deposit' and/or 'Maximum balance'.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-43835: Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite config.inc.php content.
Key phrases: authenticated Arbitrary PHP Code Injection, authenticated arbitrary php code injection, remote code execution
CVE-2023-43836: There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information
Key phrases: obtain database, sql injection
CVE-2023-43838: An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted SVG, arbitrary file upload
CVE-2023-4384: A vulnerability has been found in MaximaTech Portal Executivo 21.9.1.140 and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to missing encryption of sensitive data. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237316. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: disclosure
CVE-2023-4385: A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check.
Key phrases: crash the system due to a missing sanity, null pointer dereference flaw, crash system
CVE-2023-43856: Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java.
Key phrases: arbitrary file read
CVE-2023-43857: Dreamer CMS v4.1.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /admin/u/toIndex.
Key phrases: stored cross-site scripting (xss)
CVE-2023-4386: The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_posts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Key phrases: delete arbitrary files, inject a PHP Object, php object injection, pop chain, sensitive data, execute code
CVE-2023-43860: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanNonLogin function.
Key phrases: buffer overflow
CVE-2023-43861: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPPoE function.
Key phrases: buffer overflow
CVE-2023-43862: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formLanguageChange function.
Key phrases: buffer overflow
CVE-2023-43863: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanDhcpplus function.
Key phrases: buffer overflow
CVE-2023-43864: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard55 function.
Key phrases: buffer overflow
CVE-2023-43865: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPTP function.
Key phrases: buffer overflow
CVE-2023-43866: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard7 function.
Key phrases: buffer overflow
CVE-2023-43867: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanL2TP function.
Key phrases: buffer overflow
CVE-2023-43868: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via websGetVar function.
Key phrases: buffer overflow
CVE-2023-43869: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard56 function.
Key phrases: buffer overflow
CVE-2023-4387: A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.
Key phrases: crash the system due to a double-, use-after-free flaw, double-free, kernel information leak, use after free, crash system, double free
CVE-2023-43870: When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password they could then create their own certificates to emulate another site. Then by establishing a proxy service to emulate the site they could monitor traffic passed between the end user and the site allowing access to the data content.
Key phrases: gain access, the data content
CVE-2023-43871: A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
Key phrases: upload a pdf file with hidden Cross Site, file upload, cross site scripting (xss)
CVE-2023-43872: A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
Key phrases: upload a pdf file with hidden Cross Site, file upload, cross site scripting (xss)
CVE-2023-43873: A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting (xss)
CVE-2023-43874: Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting (xss)
CVE-2023-43875: Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail.
Key phrases: execute arbitrary web scripts, execute arbitrary web scripts via a crafted payload, cross-site scripting (xss)
CVE-2023-43876: A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.
Key phrases: execute arbitrary web scripts, execute arbitrary web scripts via a crafted payload, cross-site scripting (xss)
CVE-2023-43877: Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fields in the Administration menu.
Key phrases: execute arbitrary code, execute arbitrary code via a payload crafted in, cross-site scripting (xss)
CVE-2023-43878: Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a crafted payload into the Main Menu Items in the Administration Menu.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload into, cross-site scripting (xss)
CVE-2023-43879: Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload into the Global Content Blocks in the Administration Menu.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload into, cross-site scripting (xss)
CVE-2023-4388: The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2023-43884: A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-43885: Missing error handling in the HTTP server component of Tenda RX9 Pro Firmware V22.03.02.20 allows authenticated attackers to arbitrarily lock the device.
Key phrases: arbitrarily lock the device, missing error handling
CVE-2023-43886: A buffer overflow in the HTTP server component of Tenda RX9 Pro v22.03.02.20 might allow an authenticated attacker to overwrite memory.
Key phrases: overwrite memory, buffer overflow
CVE-2023-43887: Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::dump.
Key phrases: buffer overflows
CVE-2023-4389: A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information.
Key phrases: crash the system or may lead to leaked, leaked internal kernel information, crash system
CVE-2023-43890: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. This vulnerability is exploited via a crafted HTTP request.
Key phrases: command injection
CVE-2023-43891: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploited via a crafted payload.
Key phrases: command injection
CVE-2023-43892: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is exploited via a crafted payload.
Key phrases: command injection
CVE-2023-43893: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnerability is exploited via a crafted payload.
Key phrases: command injection
CVE-2023-43896: A buffer overflow in Macrium Reflect 8.1.7544 and below allows attackers to escalate privileges or execute arbitrary code.
Key phrases: execute arbitrary code, escalate privileges or execute arbitrary code, buffer overflow
CVE-2023-43898: Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted pic file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), null pointer dereference, denial of service (dos)
CVE-2023-43899: hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx.
Key phrases: sql injection
CVE-2023-4390: The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Key phrases: inject arbitrary web scripts, inject arbitrary web scripts even when the unfiltered_html, popup fields, unfiltered_html capability
CVE-2023-43900: Insecure Direct Object References (IDOR) in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters.
Key phrases: gain unauthorized access, gain unauthorized access to application content and view, insecure direct object references (idor)
CVE-2023-43901: Incorrect access control in the AdHoc User creation form of EMSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privileges by using the email address of a registered user.
Key phrases: arbitrarily modify usernames and privileges by using the, incorrect access control
CVE-2023-43902: Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator privileges via a crafted password reset token.
Key phrases: access accounts of all registered users, incorrect access control
CVE-2023-43905: Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors.
Key phrases: obtain backend account passwords, directly obtain backend account passwords via unspecified vectors, incorrect access control
CVE-2023-43906: Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-43907: OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.
Key phrases: global buffer overflow
CVE-2023-43909: Hospital Management System thru commit 4770d was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.
Key phrases: sql injection
CVE-2023-4392: A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic. Affected by this issue is some unknown functionality of the component Cookie Handler. The manipulation leads to cleartext storage of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237380. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: sensitive information, disclosure
CVE-2023-4393: HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against an organization.
Key phrases: perform more advanced phishing attacks against an organization, html and smtp injections
CVE-2023-4394: A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel information
Key phrases: cause a system crash or leak internal kernel, use-after-free flaw, leak internal kernel information, use after free
CVE-2023-43944: A Stored Cross Site Scripting (XSS) vulnerability was found in SourceCodester Task Management System 1.0. It allows attackers to execute arbitrary code via parameter field in index.php?page=project_list.
Key phrases: execute arbitrary code, execute arbitrary code via parameter field in index.php?page=project_list, stored cross site scripting (xss)
CVE-2023-4395: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
Key phrases: cross-site scripting (xss)
CVE-2023-43951: SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component.
Key phrases: cross-site scripting (xss)
CVE-2023-43952: SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component.
Key phrases: stored cross-site scripting (xss)
CVE-2023-43953: SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.
Key phrases: cross-site scripting (xss)
CVE-2023-43955: The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData.
Key phrases: execute arbitrary code, external intents, arbitrary files, takeblobdownloaddata
CVE-2023-43959: An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted request the
CVE-2023-43960: An issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote attacker to escalate privileges via the User Modify function in the Maintenance/Access function component.
Key phrases: escalate privileges via the User Modify function in
CVE-2023-43961: An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
Key phrases: authentication bypass
CVE-2023-4397: A buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series firmware version 5.37, USG FLEX 50(W) series firmware version 5.37, and USG20(W)-VPN series firmware version 5.37, could allow an authenticated local attacker with administrator privileges to cause denial-of-service (DoS) conditions by executing the CLI command with crafted strings on an affected device.
Key phrases: cause denial-of-service (DoS, buffer overflow, denial-of-service (dos) conditions, denial of service
CVE-2023-43976: An issue in CatoNetworks CatoClient before v.5.4.0 allows attackers to escalate privileges and winning the race condition (TOCTOU) via the PrivilegedHelperTool component.
Key phrases: escalate privileges and winning the race condition (
CVE-2023-43979: ETS Soft ybc_blog before v4.4.0 was discovered to contain a SQL injection vulnerability via the component Ybc_blogBlogModuleFrontController::getPosts().
Key phrases: sql injection
CVE-2023-4398: An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet.
Key phrases: cause denial-of-service (DoS, integer overflow, denial-of-service (dos) conditions, denial of service
CVE-2023-43980: Presto Changeo testsitecreator up to v1.1.1 was discovered to contain a SQL injection vulnerability via the component disable_json.php.
Key phrases: sql injection
CVE-2023-43981: Presto Changeo testsitecreator up to 1.1.1 was discovered to contain a deserialization vulnerability via the component delete_excluded_folder.php.
Key phrases: deserialization
CVE-2023-43982: Bon Presta boninstagramcarousel between v5.2.1 to v7.0.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at insta_parser.php. This vulnerability allows attackers to use the vulnerable website as proxy to attack other websites or exfiltrate data via a HTTP call.
Key phrases: use the vulnerable website as proxy to attack, server-side request forgery (ssrf), exfiltrate data
CVE-2023-43983: Presto Changeo attributegrid up to 2.0.3 was discovered to contain a SQL injection vulnerability via the component disable_json.php.
Key phrases: sql injection
CVE-2023-43984: Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer table.
Key phrases: arbitrarily download user information from the ps_customer table, insecure permissions
CVE-2023-43985: SunnyToo stblogsearch up to v1.0.0 was discovered to contain a SQL injection vulnerability via the StBlogSearchClass::prepareSearch component.
Key phrases: sql injection
CVE-2023-43986: DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken.
Key phrases: sql injection
CVE-2023-43988: An issue in nature fitness saijo mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43989: An issue in mokumoku chohu mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-4399: Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesnt call specific hosts.However, the restriction can be bypassed used punycode encoding of the characters in the request address.
Key phrases: configure Grafana in a way so that the, punycode encoding
CVE-2023-43990: An issue in cherub-hair mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43991: An issue in PRIMA CLINIC mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43992: An issue in STOCKMAN GROUP mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43993: An issue in smaregi_app_market mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43994: An issue in Cleaning_makotoya mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43995: An issue in picot.golf mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43996: An issue in Q co ltd mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43997: An issue in Yoruichi hobby base mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43998: An issue in Books-futaba mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-43999: An issue in COLORFUL_laundry mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-4400: A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was possible due to SWG storing the password in plain text in some configuration files.
Key phrases: be extracted through SWG REST API, password management
CVE-2023-44000: An issue in Otakara lapis totuka mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-44001: An issue in Ailand clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Key phrases: send crafted malicious notifications via leakage of the, leakage of the channel access token
CVE-2023-44008: File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.
Key phrases: execute arbitrary code, execute arbitrary code via the File Manager function, file upload
CVE-2023-44009: File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function.
Key phrases: execute arbitrary code, execute arbitrary code via the Skin Management function, file upload
CVE-2023-4401: Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the more command. A local or remote authenticated attacker could potentially exploit this vulnerability, leading to the ability to gain root-level access.
Key phrases: gain root-level access, os command injection
CVE-2023-44011: An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at the Skin management component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to
CVE-2023-44012: Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx component.
Key phrases: execute arbitrary code, execute arbitrary code via the helpkey parameter in, cross site scripting
CVE-2023-44013: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the list parameter in the fromSetIpMacBind function.
Key phrases: stack overflow
CVE-2023-44014: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain multiple stack overflows in the formSetMacFilterCfg function via the macFilterType and deviceList parameters.
Key phrases: stack overflows
CVE-2023-44015: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the schedEndTime parameter in the setSchedWifi function.
Key phrases: stack overflow
CVE-2023-44016: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.
Key phrases: stack overflow
CVE-2023-44017: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function.
Key phrases: stack overflow
CVE-2023-44018: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the domain parameter in the add_white_node function.
Key phrases: stack overflow
CVE-2023-44019: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the mac parameter in the GetParentControlInfo function.
Key phrases: stack overflow
CVE-2023-4402: The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_products function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Key phrases: delete arbitrary files, inject a PHP Object, php object injection, sensitive data, execute code
CVE-2023-44020: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.
Key phrases: stack overflow
CVE-2023-44021: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the formSetClientState function.
Key phrases: stack overflow
CVE-2023-44022: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.
Key phrases: stack overflow
CVE-2023-44023: Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
Key phrases: stack overflow
CVE-2023-44024: SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to execute arbitrary code via a crafted request to the updateCheckoutBehaviour function in the supercheckout.php component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted request to, sql injection
CVE-2023-44025: SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrulebyid function in the AddifyfreegiftsModel.php component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, sql injection
CVE-2023-44031: Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows attackers to arbitrarily save sensitive files in insecure locations via a crafted POST request.
Key phrases: arbitrarily save sensitive files in insecure locations via, incorrect access control
CVE-2023-44037: An issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows a remote attacker to obtain sensitive information via the TACACS+ server component.
Key phrases: obtain sensitive information, obtain sensitive information via the TACACS+ server component, tacacs+ server component
CVE-2023-44038: In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection attack.
Key phrases: discover information about registered users via an LDAP, ldap injection
CVE-2023-44039: In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticator to a victims account and consequently take over the account.
Key phrases: enroll a FIDO key) to register their
CVE-2023-4404: The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.
Key phrases: privilege escalation
CVE-2023-44040: In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited by an internal unauthenticated attacker for JavaScript execution in the context of the user trying to authenticate.
Key phrases: cross-site scripting (xss)
CVE-2023-44042: A stored cross-site scripting (XSS) vulnerability in /settings/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website header parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-44043: A reflected cross-site scripting (XSS) vulnerability in /install/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website title parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-44044: Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php.
Key phrases: sql injection
CVE-2023-44047: Sourcecodester Toll Tax Management System v1 is vulnerable to SQL Injection.
Key phrases: sql injection
CVE-2023-44048: Sourcecodester Expense Tracker App v1 is vulnerable to Cross Site Scripting (XSS) via add category.
Key phrases: cross site scripting (xss)
CVE-2023-4406: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS.This issue affects E-Commerce Software: through 20231123.NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: Reflected XSS.This issue affects E-Commerce Software, improper neutralization of input during web page generation, cross-site scripting, reflected xss, disclosure
CVE-2023-44061: File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit profile component.
Key phrases: execute arbitrary code, execute arbitrary code via the upload function in, file upload
CVE-2023-4407: A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument date1/date2 leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-237511.
Key phrases: sql injection
CVE-2023-44075: Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the Address parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting
CVE-2023-44077: Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636.
CVE-2023-4408: The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
Key phrases: cpu load
CVE-2023-44080: An issue in PGYER codefever v.2023.8.14-2ce4006 allows a remote attacker to execute arbitrary code via a crafted request to the branchList component.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted request to
CVE-2023-44081: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-44082: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-44083: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-44084: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-44085: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-44086: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-44087: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-44088: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.Arbitrary SQL queries were allowed to be executed using any account with low privileges.This issue affects Pandora FMS: from 700 through 774.
Key phrases: be executed using any account with low privileges, sql command, sql injection
CVE-2023-44089: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).It was possible to execute malicious JS code on Visual Consoles.This issue affects Pandora FMS: from 700 through 774.
Key phrases: execute malicious JS code on Visual Consoles, improper neutralization of input during web page generation, cross-site scripting, cross-site scripting (xss)
CVE-2023-4409: A vulnerability, which was classified as critical, has been found in NBS&HappySoftWeChat 1.1.6. Affected by this issue is some unknown functionality. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237512.
Key phrases: unrestricted upload
CVE-2023-44090: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817. This vulnerability allowed SQL changes to be made to several files in the Grafana module. This issue affects Pandora FMS: from 700 through <776.
Key phrases: be made to several files in the Grafana, sql command, sql injection
CVE-2023-44091: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.This ulnerability allowed SQL injections to be made even if authentication failed.This issue affects Pandora FMS: from 700 through <776.
Key phrases: be made even if authentication failed, sql command, sql injection
CVE-2023-44092: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection.This vulnerability allowed to create a reverse shell and execute commands in the OS.This issue affects Pandora FMS: from 700 through <776.
Key phrases: create a reverse shell and execute commands in, improper neutralization of special elements, os command injection
CVE-2023-44093: Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: vulnerability of package names public keys, service confidentiality
CVE-2023-44094: Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart.
Key phrases: type confusion, restart
CVE-2023-44095: Use-After-Free (UAF) vulnerability in the surfaceflinger module.Successful exploitation of this vulnerability can cause system crash.
Key phrases: use-after-free (uaf), system crash
CVE-2023-44096:  Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: brute-force, service confidentiality
CVE-2023-44097: Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: vulnerability of the permission to access device sns, service confidentiality
CVE-2023-44098: Vulnerability of missing encryption in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: vulnerability of missing encryption, service confidentiality
CVE-2023-44099: Vulnerability of data verification errors in the kernel module. Successful exploitation of this vulnerability may cause WLAN interruption.
Key phrases: vulnerability of data verification errors, wlan interruption
CVE-2023-4410: A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023. This affects the function setDiagnosisCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237513 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: os command injection, disclosure
CVE-2023-44100: Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: broadcast permission control, service confidentiality
CVE-2023-44101: The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentiality.
Key phrases: permission control, broadcast notifications, confidentiality
CVE-2023-44102: Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability can cause the Bluetooth function to be unavailable.
Key phrases: broadcast permission control, unavailable
CVE-2023-44103: Out-of-bounds read vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: out-of-bounds read, service confidentiality, out of bounds read
CVE-2023-44104: Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: broadcast permission control, service confidentiality
CVE-2023-44105: Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally.
Key phrases: vulnerability of permissions, features to perform abnormally