yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-40542: When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Key phrases: undisclosed requests, memory resource utilization
CVE-2023-40544: An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications.
Key phrases: obtain, via a sniffer, sensitive information
CVE-2023-40545: Authenticationbypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
Key phrases: authenticationbypass
CVE-2023-40546: A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.
Key phrases: crash
CVE-2023-40547: A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.
Key phrases: craft a specific malicious HTTP request, remote code execution, out-of-bounds write primitive, system compromise, man-in-the-middle, out of bounds write
CVE-2023-40548: A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.
Key phrases: buffer overflow, memory corruption, crash, data integrity issues, heap based buffer overflow
CVE-2023-40549: An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.
Key phrases: load a crafted PE binary, out-of-bounds read flaw, denial of service, out of bounds read, crash
CVE-2023-4055: When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVE-2023-40550: An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.
Key phrases: out-of-bounds read flaw, sensitive data, out of bounds read
CVE-2023-40551: A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.
Key phrases: out-of-bounds read, crash, exposure of sensitive data, out of bounds read
CVE-2023-40552: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gurcharan Singh Fitness calculators plugin plugin <=2.0.7 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-40553: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Plausible.Io Plausible Analytics plugin <=1.3.3 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-40554: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Blog2Social, Adenion Blog2Social: Social Media Auto Post & Scheduler plugin <=7.2.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-40555: Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.
Key phrases: deserialization of untrusted data
CVE-2023-40556: Cross-Site Request Forgery (CSRF) vulnerability in Greg Ross Schedule Posts Calendar plugin <=5.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-40558: Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <=3.3.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-40559: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <=2.4.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-4056: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
Key phrases: run arbitrary code, memory safety bugs, memory corruption
CVE-2023-40560: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Greg Ross Schedule Posts Calendar plugin <=5.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-40561: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <=3.7.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-40567: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.
Key phrases: out-of-bounds write, out of bounds write
CVE-2023-40569: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.
Key phrases: out-of-bounds write
CVE-2023-4057: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.
Key phrases: run arbitrary code, memory safety bugs, memory corruption
CVE-2023-40570: Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords. The `/-/api` API explorer endpoint could reveal the names of both databases and tables - but not their contents - to an unauthenticated user. Datasette 1.0a4 has a fix for this issue. This will block access to the API explorer but will still allow access to the Datasette read or write JSON APIs, as those use different URL patterns within the Datasette `/database` hierarchy. This issue is patched in version 1.0a4.
Key phrases: the Datasette read or write JSON APIs, unauthenticated user
CVE-2023-40571: weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deserialization vulnerability which may lead to remote code execution. When weblogic-framework gets the command echo, it directly deserializes the data returned by the server without verifying it. At the same time, the classloader loads a lot of deserialization calls. In this case, the malicious serialized data returned by the server will cause remote code execution. Version 0.2.4 contains a patch for this issue.
Key phrases: deserialization, remote code execution
CVE-2023-40572: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.
Key phrases: script and thus remote code execution when targeting, csrf, confidentiality, confidentiality and integrity, integrity and availability
CVE-2023-40573: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code execution by an attacker with edit right on the wiki. If the attack is successful, an error log entry with "Job content executed" will be produced. This vulnerability has been patched in XWiki 14.10.9 and 15.4RC1.
Key phrases: csrf, remote code execution
CVE-2023-40574: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `writePixelBGRX` function. This issue is likely down to incorrect calculations of the `nHeight` and `srcStep` variables. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
Key phrases: out-of-bounds write
CVE-2023-40575: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_YUV444ToRGB_8u_P3AC4R_BGRX` function. This issue is likely down to insufficient data for the `pSrc` variable and results in crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
Key phrases: out-of-bounds read, crashes
CVE-2023-40576: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `RleDecompress` function. This Out-Of-Bounds Read occurs because FreeRDP processes the `pbSrcBuffer` variable without checking if it contains data of sufficient length. Insufficient data in the `pbSrcBuffer` variable may cause errors or crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
Key phrases: out-of-bounds read, crash
CVE-2023-40577: Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.
Key phrases: execute arbitrary JavaScript code, arbitrary javascript code
CVE-2023-40579: OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. The vulnerability affects customers using `ListObjects` with specific models. The affected models contain expressions of type `rel1 from type1`. This issue has been patched in version 1.3.1.
Key phrases: bypass when calling the ListObjects API. The vulnerability affects customers, authorization bypass
CVE-2023-4058: Memory safety bugs present in Firefox 115. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116.
Key phrases: run arbitrary code, memory safety bugs, memory corruption
CVE-2023-40580: Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the mnemonic recovery phrase. This issue was patched in version 5.3.1.
Key phrases: access control
CVE-2023-40581: yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the shell used by Python's `subprocess` on Windows) does not properly escape special characters, which can allow for remote code execution if `--exec` is used directly with maliciously crafted remote data. This vulnerability only impacts `yt-dlp` on Windows, and the vulnerability is present regardless of whether `yt-dlp` is run from `cmd` or from `PowerShell`. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2023.09.24 fixes this issue by properly escaping each special character. `\\\\n` will be replaced by `\\\\r` as no way of escaping it has been found. It is recommended to upgrade yt-dlp to version 2023.09.24 as soon as possible. Also, always be careful when using --exec, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade: 1. Avoid using any output template expansion in --exec other than {} (filepath). 2. If expansion in --exec is needed, verify the fields you are using do not contain ", | or &. 3. Instead of using --exec, write the info json and load the fields from it instead.
Key phrases: provide shell command lines to be executed at, quote/escape these values so they can, `yt-dlp` in version 2021.04.11, remote code execution
CVE-2023-40582: find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This issue has been addressed in version 1.0.3. users are advised to upgrade. Users unable to upgrade should ensure that all input passed to find-exec comes from a trusted source.
Key phrases: command injection
CVE-2023-40583: libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote nodes memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4.
Key phrases: silent, crash, memory consumption
CVE-2023-40584: Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz archive in a way that prevents the deletion of its inner files when the manifest generation process is completed. A patch for this vulnerability has been released in versions 2.6.15, 2.7.14, and 2.8.3. Users are advised to upgrade. The only way to completely resolve the issue is to upgrade, however users unable to upgrade should configure RBAC (Role-Based Access Control) and provide access for configuring applications only to a limited number of administrators. These administrators should utilize trusted and verified Helm charts.
Key phrases: denial-of-service attack vector, systems functionality and availability
CVE-2023-40585: ironic-image is a container image to run OpenStack Ironic as part of Metal. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authentication. Ironic API is also listening in host network. In case the node is not behind a firewall, the API could be accessed by anyone via network without authentication. By default, Ironic API in Metal3 is protected by TLS and basic authentication, so this vulnerability requires operator to configure API without TLS for it to be vulnerable. TLS and authentication however should not be coupled as they are in versions prior to capm3-v1.4.3. A patch exists in versions capm3-v1.4.3 and newer. Some workarounds are available. Either configure TLS for Ironic API (`deploy.sh -t ...`, `IRONIC_TLS_SETUP=true`) or split Ironic API and Conductor via configuration change (old implementation, not recommended). With both workarounds, services are configured with httpd front-end, which has proper authentication configuration in place.
CVE-2023-40586: OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`. This issue was patched in version 3.0.1.
Key phrases: malicious request, crash
CVE-2023-40587: Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a `index.html` file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is `index.html`. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in `os.path.normpath` to no longer truncate on the first `0x00` found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
Key phrases: path traversal
CVE-2023-40588: Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.
Key phrases: denial of service
CVE-2023-40589: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
Key phrases: global-buffer-overflow, crash
CVE-2023-4059: The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog
Key phrases: create the register, csrf
CVE-2023-40590:  GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\\\\\\\Program Files\\\\\\\\Git\\\\\\\\cmd\\\\\\\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.
Key phrases: run any arbitrary commands
CVE-2023-40591: go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: vulnerable node
CVE-2023-40592: In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the /app/search/table web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance.
Key phrases: reflected cross-site scripting (xss), arbitrary commands
CVE-2023-40593: In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.
Key phrases: malformed security assertion markup language (saml) request, denial of service, crash, hang
CVE-2023-40594: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.
Key phrases: denial of service (DoS), denial of service (dos)
CVE-2023-40595: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code.
Key phrases: execute arbitrary code, untrusted data
CVE-2023-40596: In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine.
Key phrases: insecure path, privilege escalation
CVE-2023-40597: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.
Key phrases: execute arbitrary code, absolute path traversal
CVE-2023-40598: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
Key phrases: execute arbitrary code, external lookup, legacy internal function
CVE-2023-40599: Regular expression Denial-of-Service (ReDoS) exists in multiple add-ons for Mailform Pro CGI 4.3.1.3 and earlier, which allows a remote unauthenticated attacker to cause a denial-of-service condition. Affected add-ons are as follows: call/call.js, prefcodeadv/search.cgi, estimate/estimate.js, search/search.js, suggest/suggest.js, and coupon/coupon.js.
Key phrases: cause a denial-of-service condition, regular expression denial-of-service (redos), denial of service
CVE-2023-4060: The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2023-40600: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer.It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.
Key phrases: exposure of sensitive information
CVE-2023-40601: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <=2.0.7 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-40602: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 1.5.49.
Key phrases: url redirection, open redirect
CVE-2023-40604: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jes Madsen Cookies by JM plugin <=1.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-40605: Auth. (contributor) Cross-Site Scripting (XSS) vulnerability in 93digital Typing Effect plugin <=1.3.6 versions.
Key phrases: cross-site scripting (xss)
CVE-2023-40606: Improper Control of Generation of Code ('Code Injection') vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.
Key phrases: improper control of generation of code, code injection
CVE-2023-40607: Cross-Site Request Forgery (CSRF) vulnerability in CLUEVO CLUEVO LMS, E-Learning Platform plugin <=1.10.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-40609: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aiyaz, maheshpatel Contact form 7 Custom validation allows SQL Injection.This issue affects Contact form 7 Custom validation: from n/a through 1.1.3.
Key phrases: SQL Injection, sql command, sql injection
CVE-2023-4061: A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.
Key phrases: obtain possible sensitive information, access the system and obtain possible sensitive information
CVE-2023-40610: Improper authorization check and possible privilege escalation on Apache Supersetup to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.
Key phrases: both the examples schema and Apache Superset's, privilege escalation, weakness, tampering, improper authorization
CVE-2023-40611: Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allowsauthenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.Users should upgrade to version 2.7.1 or later which has removed the vulnerability.
CVE-2023-40612: In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
Key phrases: xxe injection
CVE-2023-40617: A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start 7 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'file' parameter in 'displayPDF.php'.
Key phrases: execute arbitrary JavaScript, execute arbitrary JavaScript in the web browser of, reflected cross-site scripting (xss), malicious payload
CVE-2023-40618: A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Visual Project Explorer 1.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'service' parameter in 'headstart_snapshot.php'.
Key phrases: execute arbitrary JavaScript, execute arbitrary JavaScript in the web browser of, reflected cross-site scripting (xss), malicious payload
CVE-2023-40619: phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.
Key phrases: deserialization, remote code execution, deserialization of untrusted data
CVE-2023-40621: SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. The application has a security option to disable or prompt users before untrusted scripts are executed, but this is not set as default.
Key phrases: inject VBScript code in a document and have
CVE-2023-40622: SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.
Key phrases: view sensitive information which is otherwise restricted, exploitation, high impact, confidentiality, confidentiality and integrity, integrity and availability
CVE-2023-40623: SAP BusinessObjects SuiteInstaller - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the operating system files causing a limited impact on integrity and completely compromising the availability of the system.
Key phrases: create a directory under temporary directory and link, exploitation, integrity, availability
CVE-2023-40624: SAP NetWeaver AS ABAP (applications based on Unified Rendering)- versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can be executed in the web-application. An attacker could thereby control the behavior of this web-application.
Key phrases: inject JavaScript code that can be executed in, behavior
CVE-2023-40625: S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and integrity with no impact on availibility of the system.
Key phrases: perform unintended actions resulting in escalation of privileges, availibility of the system, escalation privilege, confidentiality, confidentiality and integrity
CVE-2023-40626: The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
Key phrases: environment variables
CVE-2023-40627: A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.
Key phrases: xss
CVE-2023-40628: A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.
Key phrases: xss
CVE-2023-40629: SQLi vulnerability in LMS Lite component for Joomla.
Key phrases: sqli
CVE-2023-4063: Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request.
Key phrases: denial of service, escl url get request
CVE-2023-40630: Unauthenticated LFI/SSRF in JCDashboards component for Joomla.
Key phrases: unauthenticated lfi ssrf
CVE-2023-40631: In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-40632: In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execution privileges needed
Key phrases: use after free, logic error, remote information disclosure
CVE-2023-40633: In phasecheckserver, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-40634: In phasechecksercer, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: missing permission check, local escalation of privilege, escalation privilege
CVE-2023-40635: In linkturbo, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: missing permission check, local escalation of privilege, escalation privilege
CVE-2023-40636: In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with System execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-40637: In telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
Key phrases: permission check, local information disclosure
CVE-2023-40638: In Telecom service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
Key phrases: missing permission check, local denial of service
CVE-2023-40639: In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
Key phrases: permission check, local information disclosure
CVE-2023-40640: In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
Key phrases: permission check, local information disclosure
CVE-2023-40641: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: permission check, local information disclosure
CVE-2023-40642: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: permission check, local information disclosure
CVE-2023-40643: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: permission check, local information disclosure
CVE-2023-40644: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: permission check, local information disclosure
CVE-2023-40645: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: permission check, local information disclosure
CVE-2023-40646: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: permission check, local information disclosure
CVE-2023-40647: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: permission check, local information disclosure
CVE-2023-40648: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: permission check, local information disclosure
CVE-2023-40649: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: permission check, local information disclosure
CVE-2023-4065: A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local attacker to access information outside of their permissions.
Key phrases: access information outside of their permissions
CVE-2023-40650: In Telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-40651: In urild service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2023-40652: In jpg driver, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds write, improper input validation, local denial of service
CVE-2023-40653: In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed
Key phrases: missing permission check, local escalation of privilege, escalation privilege
CVE-2023-40654: In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed
Key phrases: missing permission check, local escalation of privilege, escalation privilege
CVE-2023-40655: A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.
Key phrases: xss
CVE-2023-40656: A reflected XSS vulnerability was discovered in the Quickform component for Joomla.
Key phrases: reflected xss
CVE-2023-40657: A reflected XSS vulnerability was discovered in the Joomdoc component for Joomla.
Key phrases: xss
CVE-2023-40658: A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla.
Key phrases: reflected xss
CVE-2023-40659: A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla.
Key phrases: xss
CVE-2023-4066: A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.
CVE-2023-40660: A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.
Key phrases: potential PIN bypass, gain unauthorized access, computers, pin bypass, malicious actions
CVE-2023-40661: Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise key generation, certificate loading, and other card management operations during enrollment.
Key phrases: compromise key generation, memory
CVE-2023-40662: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jonk @ Follow me Darling Cookies and Content Security Policy.This issue affects Cookies and Content Security Policy: from n/a through 2.15.
Key phrases: exposure of sensitive information
CVE-2023-40663: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rextheme WP VR plugin <=8.3.4 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-40664: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy  Smart Donations plugin <=4.0.12 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-40665: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as Image plugin by Pdfcrowd plugin <=2.16.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-40667: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Lasso Simple URLs plugin <=117 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-40668: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd plugin <=2.16.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-40669: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in twinpictures, baden03 Collapse-O-Matic plugin <=1.8.5.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-4067: The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'tab_date_r' parameters in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2023-40671: Cross-Site Request Forgery (CSRF) vulnerability in ??wp DX-auto-save-images plugin <=1.4.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-40674: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lasso Simple URLs  Link Cloaking, Product Displays, and Affiliate Link Management allows Stored XSS.This issue affects Simple URLs  Link Cloaking, Product Displays, and Affiliate Link Management: from n/a through 118.
Key phrases: Stored XSS.This issue affects Simple URLs  Link, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-40675: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps Landing Page Builder plugin <=1.5.1.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-40676: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <=5.0.8 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-40677: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Vertical marquee plugin <=7.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-4068: Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
Key phrases: perform arbitrary read, type confusion
CVE-2023-40680: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects Yoast SEO: from n/a through 21.0.
Key phrases: Stored XSS.This issue affects Yoast SEO: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-40681: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. Groundhogg plugin <=2.7.11.10 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-40682: IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive information from API logs.  IBM X-Force ID:  263833.
Key phrases: obtain sensitive information, obtain sensitive information from API logs, unspecified, unspecified vulnerability
CVE-2023-40683: IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticating as an OpenPages user and using non-public APIs, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrative access to the application.  IBM X-Force ID:  264005.
Key phrases: bypass security restrictions, bypass security and gain unauthorized administrative access to, insufficient authorization checks