yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-35157: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.
Key phrases: xss
CVE-2023-35158: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: > /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. 
Key phrases: inject Javascript in the page (XSS), xss
CVE-2023-35159: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Key phrases: inject Javascript in the page (XSS), xss
CVE-2023-35160: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/XWiki/Main xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Key phrases: inject Javascript in the page (XSS), xss
CVE-2023-35161: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.2-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Key phrases: inject Javascript in the page (XSS), xss
CVE-2023-35162: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: > <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Key phrases: inject Javascript in the page (XSS), xss
CVE-2023-35163: Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vegas Ethereum bridge. For example, a deposit to the collateral bridge for 100USDT that credits a partys general account on Vega, can be re-processed 50 times resulting in 5000USDT in that partys general account. This is without depositing any more than the original 100USDT on the bridge. Despite this exploit requiring access to a validator's Vega key, a validator key can be obtained at the small cost of 3000VEGA, the amount needed to announce a new node onto the network.A patch is available in version 0.71.6. No known workarounds are available, however there are mitigations in place should this vulnerability be exploited. There are monitoring alerts for `mainnet1` in place to identify any issues of this nature including this vulnerability being exploited. The validators have the ability to stop the bridge thus stopping any withdrawals should this vulnerability be exploited.
Key phrases: version 0.71.6, trick the Vega network into re-processing
CVE-2023-35164: DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization check allows unauthorized users to manipulate a dashboard created by the administrator. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: gain insight into business trends. In affected versions, manipulate a dashboard created by the administrator, authorization check, missing authorization
CVE-2023-35165: AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks` 1.57.0 until 1.202.0, `eks.Cluster` and `eks.FargateCluster` constructs create two roles, `CreationRole` and `default MastersRole`, that have an overly permissive trust policy.  The first, referred to as the `CreationRole`, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g `KubernetesManifest`, `HelmChart`, ...) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) may be affected. The second, referred to as the `default MastersRole`, is provisioned only if the `mastersRole` property isn't provided and has permissions to execute `kubectl` commands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) may be affected.The issue has been fixed in `@aws-cdk/aws-eks` v1.202.0 and `aws-cdk-lib` v2.80.0. These versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. There is no workaround available for CreationRole. To avoid creating the `default MastersRole`, use the `mastersRole` property to explicitly provide a role.
CVE-2023-35166: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.
CVE-2023-35167: Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.
Key phrases: gain read, update and delete access, unauthorized access
CVE-2023-35168: DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability.
Key phrases: privilege bypass, gain insight into business trends. Affected versions, gain access
CVE-2023-35169: PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, which results in a remote code execution vulnerability. Every application that stores attachments with `Attachment::save()` without providing a `$filename` or passing unsanitized user input is affected by this attack.An attacker can send an email with a malicious attachment to the inbox, which gets crawled with `webklex/php-imap` or `webklex/laravel-imap`. Prerequisite for the vulnerability is that the script stores the attachments without providing a `$filename`, or providing an unsanitized `$filename`, in `src/Attachment::save(string $path, string $filename = null)`. In this case, where no `$filename` gets passed into the `Attachment::save()` method, the package would use a series of unsanitized and insecure input values from the mail as fallback. Even if a developer passes a `$filename` into the `Attachment::save()` method, e.g. by passing the name or filename of the mail attachment itself (from email headers), the input values never get sanitized by the package. There is also no restriction about the file extension (e.g. ".php") or the contents of a file. This allows an attacker to upload malicious code of any type and content at any location where the underlying user has write permissions. The attacker can also overwrite existing files and inject malicious code into files that, e.g. get executed by the system via cron or requests.Version 5.3.0 contains a patch for this issue.
Key phrases: leverage a directory traversal vulnerability, upload malicious code of any type and content, remote code execution
CVE-2023-3517: Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.
Key phrases: control of system level data sources, jndi identifiers
CVE-2023-35171: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available.
CVE-2023-35172: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can bruteforce the password reset links. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. No known workarounds are available.
Key phrases: password reset links
CVE-2023-35173: Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix.
Key phrases: invalid meta data file, inaccessible
CVE-2023-35174: Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.
Key phrases: triggers arbitrary code execution
CVE-2023-35175: Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.
Key phrases: remote code execution, elevation of privilege, server-side request forgery (ssrf)
CVE-2023-35176: Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restore feature through the embedded web service on the device.
Key phrases: buffer overflow, denial of service
CVE-2023-35177: Certain HP LaserJet Pro print products are potentially vulnerable to a stack-based buffer overflow related to the compact font format parser.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2023-35178: Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow when performing a GET request to scan jobs.
Key phrases: buffer overflow
CVE-2023-35179: A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.
Key phrases: bypass multi-factor/two-factor authentication
CVE-2023-3518: HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.
Key phrases: /denies access regardless of service identities
CVE-2023-35180: The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds ARM API.
Key phrases: abuse SolarWinds ARM API, remote code execution
CVE-2023-35181: The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation.
Key phrases: abuse incorrect folder permission resulting in Privilege Escalation, privilege escalation
CVE-2023-35182: The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server.
Key phrases: remote code execution
CVE-2023-35183: The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation.
Key phrases: abuse local resources to Privilege Escalation, privilege escalation
CVE-2023-35184: The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a SolarWinds service resulting in a remote code execution.
Key phrases: abuse a SolarWinds service resulting in a remote, remote code execution
CVE-2023-35185: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges. 
Key phrases: directory traversal remote code
CVE-2023-35186: The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution.
Key phrases: abuse SolarWinds service resulting in remote code execution
CVE-2023-35187: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to achieve the Remote Code Execution.
Key phrases: achieve the Remote Code Execution, directory traversal remote code, remote code execution
CVE-2023-35188: SQL Injection Remote Code Execution Vulnerability was found using a create statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited.
Key phrases: sql injection, remote code execution
CVE-2023-35189: Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.
Key phrases: upload a malicious payload and execute it, remote code execution
CVE-2023-3519: Unauthenticated remote code execution
Key phrases: unauthenticated remote code execution
CVE-2023-35191: Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of service via network access.
Key phrases: potentially enable denial of service via network access, uncontrolled resource consumption
CVE-2023-35193: An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset 0x4bddb8.
Key phrases: os command injection, http request, command execution
CVE-2023-35194: An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset `0x4bde44`.
Key phrases: os command injection, http request, command execution
CVE-2023-3520: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.
Key phrases: sensitive cookie
CVE-2023-3521: Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.
Key phrases: cross-site scripting (xss)
CVE-2023-3522: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection.This issue affects License Portal System: before 1.48.
Key phrases: SQL Injection, sql command, sql injection
CVE-2023-3523: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
Key phrases: out-of-bounds read
CVE-2023-3524: The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2023-3525: The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to 'APPROVED' without payment.
Key phrases: bypass due to missing validation, authorization bypass, payment status
CVE-2023-3526: In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.
Key phrases: reflective xss, execute code
CVE-2023-3527: A CSV injection vulnerability was found in theAvaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.
Key phrases: attempt arbitrary command execution, input crafted data which, csv injection, arbitrary commands
CVE-2023-3528: A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument cat_id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-233252.
Key phrases: sql injection
CVE-2023-3529: A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api/otp/send?id=[ID][ampersand]method=sms of the component OTP URI Interface. The manipulation leads to information exposure through discrepancy. It is possible to initiate the attack remotely. The identifier VDB-233253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: information exposure, disclosure
CVE-2023-35296: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-35297: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35298: HTTP.sys Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-35299: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2023-35300: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35302: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35303: USB Audio Class System Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35304: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35305: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35306: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-35308: Windows MSHTML Platform Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows mshtml platform security feature bypass
CVE-2023-35309: Microsoft Message Queuing Remote Code Execution Vulnerability
Key phrases: microsoft message queuing remote code execution
CVE-2023-3531: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Key phrases: cross-site scripting (xss)
CVE-2023-35310: Windows DNS Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35311: Microsoft Outlook Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-35312: Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-35313: Windows Online Certificate Status Protocol (OCSP) SnapIn Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35314: Remote Procedure Call Runtime Denial of Service Vulnerability
Key phrases: remote procedure call runtime denial of service
CVE-2023-35315: Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability
Key phrases: windows bridge network driver remote code execution
CVE-2023-35316: Remote Procedure Call Runtime Information Disclosure Vulnerability
Key phrases: remote procedure call runtime information disclosure
CVE-2023-35317: Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-35318: Remote Procedure Call Runtime Denial of Service Vulnerability
Key phrases: remote procedure call runtime denial of service
CVE-2023-35319: Remote Procedure Call Runtime Denial of Service Vulnerability
Key phrases: remote procedure call runtime denial of service
CVE-2023-3532: Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.
Key phrases: cross-site scripting (xss)
CVE-2023-35320: Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Key phrases: telemetry elevation of privilege
CVE-2023-35321: Windows Deployment Services Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-35322: Windows Deployment Services Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35323: Windows OLE Remote Code Execution Vulnerability
Key phrases: windows ole remote code execution
CVE-2023-35324: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-35325: Windows Print Spooler Information Disclosure Vulnerability
Key phrases: windows print spooler information disclosure
CVE-2023-35326: Windows CDP User Components Information Disclosure Vulnerability
Key phrases: windows cdp user components information disclosure
CVE-2023-35328: Windows Transaction Manager Elevation of Privilege Vulnerability
Key phrases: windows transaction manager elevation of privilege
CVE-2023-35329: Windows Authentication Denial of Service Vulnerability
Key phrases: windows authentication denial of service
CVE-2023-3533: Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.
Key phrases: obtain remote code execution, perform stored cross-site scripting attacks and, path traversal, arbitrary file write, file upload
CVE-2023-35330: Windows Extended Negotiation Denial of Service Vulnerability
Key phrases: windows extended negotiation denial of service
CVE-2023-35331: Windows Local Security Authority (LSA) Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-35332: Windows Remote Desktop Protocol Security Feature Bypass
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-35333: MediaWiki PandocUpload Extension Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35335: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-35336: Windows MSHTML Platform Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows mshtml platform security feature bypass
CVE-2023-35337: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-35338: Windows Peer Name Resolution Protocol Denial of Service Vulnerability
Key phrases: windows peer name resolution protocol denial of service
CVE-2023-35339: Windows CryptoAPI  Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-3534: A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file check_availability.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-233286 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-35340: Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Key phrases: windows cng key isolation service elevation of privilege
CVE-2023-35341: Microsoft DirectMusic Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-35342: Windows Image Acquisition Elevation of Privilege Vulnerability
Key phrases: windows image acquisition elevation of privilege
CVE-2023-35343: Windows Geolocation Service Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35344: Windows DNS Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35345: Windows DNS Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35346: Windows DNS Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35347: Microsoft Install Service Elevation of Privilege Vulnerability
Key phrases: microsoft install service elevation of privilege
CVE-2023-35348: Active Directory Federation Service Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-35349: Microsoft Message Queuing Remote Code Execution Vulnerability
Key phrases: microsoft message queuing remote code execution
CVE-2023-3535: A vulnerability was found in SimplePHPscripts FAQ Script PHP 2.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233287.
CVE-2023-35350: Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35351: Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35352: Windows Remote Desktop Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows remote desktop security feature bypass
CVE-2023-35353: Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Key phrases: telemetry elevation of privilege
CVE-2023-35355: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows cloud files mini filter driver elevation of privilege
CVE-2023-35356: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35357: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35358: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35359: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-3536: A vulnerability was found in SimplePHPscripts Funeral Script PHP 3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233288.
Key phrases: cross site scripting
CVE-2023-35360: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35361: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35362: Windows Clip Service Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-35363: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35364: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35365: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35366: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35367: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35368: Microsoft Exchange Remote Code Execution Vulnerability
Key phrases: microsoft exchange remote code execution
CVE-2023-3537: A vulnerability classified as problematic has been found in SimplePHPscripts News Script PHP Pro 2.4. This affects an unknown part of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-233289 was assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-35371: Microsoft Office Remote Code Execution Vulnerability
Key phrases: microsoft office remote code execution
CVE-2023-35372: Microsoft Office Visio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35373: Mono Authenticode Validation Spoofing Vulnerability
Key phrases: mono authenticode validation spoofing
CVE-2023-35374: Paint 3D Remote Code Execution Vulnerability
Key phrases: paint remote code execution
CVE-2023-35376: Microsoft Message Queuing Denial of Service Vulnerability
Key phrases: microsoft message queuing denial of service
CVE-2023-35377: Microsoft Message Queuing Denial of Service Vulnerability
Key phrases: microsoft message queuing denial of service
CVE-2023-35378: Windows Projected File System Elevation of Privilege Vulnerability
Key phrases: windows projected file system elevation of privilege
CVE-2023-35379: Reliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-3538: A vulnerability classified as problematic was found in SimplePHPscripts Photo Gallery PHP 2.0. This vulnerability affects unknown code of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-233290 is the identifier assigned to this vulnerability.
CVE-2023-35380: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35381: Windows Fax Service Remote Code Execution Vulnerability
Key phrases: windows fax service remote code execution
CVE-2023-35382: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35383: Microsoft Message Queuing Information Disclosure Vulnerability
Key phrases: message queuing information disclosure
CVE-2023-35384: Windows HTML Platforms Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-35385: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35386: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35387: Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-35388: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35389: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-3539: A vulnerability, which was classified as problematic, has been found in SimplePHPscripts Simple Forum PHP 2.7. This issue affects some unknown processing of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-233291.
Key phrases: cross site scripting
CVE-2023-35390: .NET and Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35391: ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
Key phrases: visual studio information disclosure
CVE-2023-35392: Microsoft Edge (Chromium-based) Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-35393: Azure Apache Hive Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-35394: Azure HDInsight Jupyter Notebook Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-3540: A vulnerability, which was classified as problematic, was found in SimplePHPscripts NewsLetter Script PHP 2.4. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233292.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-3541: A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /author_posts.php. The manipulation of the argument author with the input g6g12<script>alert(1)</script>o8sdm leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233293 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-3542: A vulnerability was found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument name/body leads to cross site scripting. The attack may be launched remotely. VDB-233294 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-3543: A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file load.php of the component HTTP POST Request Handler. The manipulation of the argument cid/first_name/second_name/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233295. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, cross-site scripting, disclosure
CVE-2023-3544: A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, disclosure
CVE-2023-3545: Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of `.htaccess` file. This vulnerability may be exploited by privileged attackers or chained with unauthenticated arbitrary file write vulnerabilities, such as CVE-2023-3533, to achieve remote code execution.
Key phrases: bypass file upload security protections, obtain remote code execution, bypass file upload security protections and obtain remote, improper sanitisation, arbitrary file write
CVE-2023-3547: The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks.
Key phrases: perform CSRF attacks, csrf
CVE-2023-3548: An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack.
Key phrases: gain account access, brute force authentication
CVE-2023-3550: Mediawiki v1.40.0 does not validate namespaces used in XML files.Therefore, if the instance administrator allows XML file uploads,a remote attacker with a low-privileged user account can use thisexploit to become an administrator by sending a malicious link tothe instance administrator.
Key phrases: become an administrator by sending a malicious link
CVE-2023-3551:  Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Key phrases: code injection
CVE-2023-3552: Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Key phrases: improper encoding
CVE-2023-3553: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVE-2023-3554: A vulnerability was found in GZ Scripts GZ Forum Script 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /preview.php. The manipulation of the argument catid/topicid/topic/topic_message/free_name leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233348. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, disclosure
CVE-2023-3555: A vulnerability was found in GZ Scripts PHP Vacation Rental Script 1.8. It has been classified as problematic. This affects an unknown part of the file /preview.php. The manipulation of the argument page/layout/sort_by/property_id leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-233349 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross-site scripting, disclosure
CVE-2023-3556: A vulnerability was found in GZ Scripts Car Listing Script PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /preview.php. The manipulation of the argument page/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-233350 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, disclosure
CVE-2023-3557: A vulnerability was found in GZ Scripts Property Listing Script 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /preview.php. The manipulation of the argument page/layout/sort_by leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-233351. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: gz scripts property listing script, cross site scripting, disclosure
CVE-2023-3558: A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8. Affected is an unknown function of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233352. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, cross-site scripting, disclosure
CVE-2023-3559: A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability is an unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233353 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: disclosure
CVE-2023-3560: A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is some unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack may be launched remotely. VDB-233354 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: disclosure
CVE-2023-3561: A vulnerability, which was classified as problematic, was found in GZ Scripts PHP GZ Hotel Booking Script 1.8. This affects an unknown part of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233355. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, cross-site scripting, disclosure
CVE-2023-35618: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-35619: Microsoft Outlook for Mac Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-3562: A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 and classified as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument action leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233356. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: disclosure
CVE-2023-35621: Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-35622: Windows DNS Spoofing Vulnerability
Key phrases: windows dns spoofing
CVE-2023-35624: Azure Connected Machine Agent Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-35625: Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-35628: Windows MSHTML Platform Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-35629: Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-3563: A vulnerability was found in GZ Scripts GZ E Learning Platform 1.8 and classified as problematic. This issue affects some unknown processing of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-233357 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-35630: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
Key phrases: internet connection sharing (ics), remote code execution
CVE-2023-35631: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-35632: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Key phrases: winsock elevation of privilege
CVE-2023-35633: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-35634: Windows Bluetooth Driver Remote Code Execution Vulnerability
Key phrases: windows bluetooth driver remote code execution
CVE-2023-35635: Windows Kernel Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-35636: Microsoft Outlook Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-35638: DHCP Server Service Denial of Service Vulnerability
Key phrases: dhcp server service denial of service
CVE-2023-35639: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-3564: A vulnerability was found in GZ Scripts GZ Multi Hotel Booking System 1.8. It has been classified as problematic. Affected is an unknown function of the file /index.php. The manipulation of the argument adults/children/cal_id leads to cross site scripting. It is possible to launch the attack remotely. VDB-233358 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-35641: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
Key phrases: internet connection sharing (ics), remote code execution
CVE-2023-35642: Internet Connection Sharing (ICS) Denial of Service Vulnerability
Key phrases: internet connection sharing (ics) denial of service
CVE-2023-35643: DHCP Server Service Information Disclosure Vulnerability
Key phrases: dhcp server service information disclosure
CVE-2023-35644: Windows Sysmain Service Elevation of Privilege
Key phrases: service elevation of privilege
CVE-2023-35645: In tbd of tbd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Key phrases: memory corruption, race condition, local escalation of privilege, escalation privilege
CVE-2023-35646: In TBD of TBD, there is a possible stack buffer overflow due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Key phrases: stack buffer overflow, remote code execution
CVE-2023-35647: In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
Key phrases: out of bounds read, missing bounds check, remote information disclosure