yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-36678: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <=3.5.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-36679: Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6.
Key phrases: server-side request forgery (ssrf)
CVE-2023-3668: Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.
Key phrases: improper encoding
CVE-2023-36682: Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC Schema Pro allows Cross Site Request Forgery.This issue affects Schema Pro: from n/a through 2.7.7.
Key phrases: Cross Site Request Forgery, cross-site request forgery (csrf), cross site request forgery
CVE-2023-36685: Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC CartFlows Pro allows Cross Site Request Forgery.This issue affects CartFlows Pro: from n/a through 1.11.12.
Key phrases: Cross Site Request Forgery, cross-site request forgery (csrf), cross site request forgery
CVE-2023-36686: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CartFlows Pro plugin <=1.11.11 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-36687: Cross-Site Request Forgery (CSRF) vulnerability in Andrea Tarantini Menubar plugin <=5.8.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-36688: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Mann Simple Site Verify plugin <=1.0.7 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-36689: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory WPFactory Helper plugin <=1.5.2 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-3669: A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
Key phrases: have unlimited attempts of guessing the password within, brute-force protection
CVE-2023-36690: Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <=4.900 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-36691: Cross-Site Request Forgery (CSRF) vulnerability in Albert Peschar WebwinkelKeur plugin <=3.24 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-36692: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Kramer & Hendrik Thole WP-Cirrus plugin <=0.6.11 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-36693: Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez WP RSS Images plugin <=1.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-36696: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows cloud files mini filter driver elevation of privilege
CVE-2023-36697: Microsoft Message Queuing Remote Code Execution Vulnerability
Key phrases: microsoft message queuing remote code execution
CVE-2023-36698: Windows Kernel Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows kernel security feature bypass
CVE-2023-3670: In CODESYS Development System 3.5.9.0 to3.5.17.0 andCODESYS Scripting4.0.0.0 to4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
Key phrases: the workstation to place potentially harmful and disguised, unsafe directory permissions
CVE-2023-36701: Microsoft Resilient File System (ReFS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36702: Microsoft DirectMusic Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36703: DHCP Server Service Denial of Service Vulnerability
Key phrases: dhcp server service denial of service
CVE-2023-36704: Windows Setup Files Cleanup Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36705: Windows Installer Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36706: Windows Deployment Services Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-36707: Windows Deployment Services Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-36709: Microsoft AllJoyn API Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-3671: The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Key phrases: reflected cross-site scripting
CVE-2023-36710: Windows Media Foundation Core Remote Code Execution Vulnerability
Key phrases: windows media foundation core remote code execution
CVE-2023-36711: Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
Key phrases: windows runtime c++ template library elevation of privilege
CVE-2023-36712: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-36713: Windows Common Log File System Driver Information Disclosure Vulnerability
Key phrases: driver information disclosure
CVE-2023-36717: Windows Virtual Trusted Platform Module Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-36718: Microsoft Virtual Trusted Platform Module Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36719: Microsoft Speech Application Programming Interface (SAPI) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-3672: Cross-site Scripting (XSS) - DOM in GitHub repository plaidweb/webmention.js prior to 0.5.5.
Key phrases: cross-site scripting (xss)
CVE-2023-36720: Windows Mixed Reality Developer Tools Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-36721: Windows Error Reporting Service Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36722: Active Directory Domain Services Information Disclosure Vulnerability
Key phrases: active directory domain services information disclosure
CVE-2023-36723: Windows Container Manager Service Elevation of Privilege Vulnerability
Key phrases: service elevation of privilege
CVE-2023-36724: Windows Power Management Service Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-36725: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2023-36726: Windows Internet Key Exchange (IKE) Extension Elevation of Privilege  Vulnerability
Key phrases: elevation of privilege
CVE-2023-36727: Microsoft Edge (Chromium-based) Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-36728: Microsoft SQL Server Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-36729: Named Pipe File System Elevation of Privilege Vulnerability
Key phrases: named pipe file system elevation of privilege
CVE-2023-3673:  SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.
Key phrases: sql injection
CVE-2023-36730: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36731: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36732: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36735: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36736: Microsoft Identity Linux Broker Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36737: Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36739: 3D Viewer Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-3674: A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
CVE-2023-36740: 3D Viewer Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36741: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36742: Visual Studio Code Remote Code Execution Vulnerability
Key phrases: visual studio code remote code execution
CVE-2023-36743: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36744: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36745: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36746: Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the handling of `len` in `fstWritex` when parsing the time table.
Key phrases: heap-based buffer overflow, memory corruption, heap based buffer overflow
CVE-2023-36747: Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the handling of `len` in `fstWritex` when `beg_time` does not match the start of the time table.
Key phrases: heap-based buffer overflow, memory corruption, heap based buffer overflow
CVE-2023-36748: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The affected devices are configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any datapassed over to and from the affected device.
Key phrases: read and modify any datapassed over to and, man-in-the-middle position, man in the middle
CVE-2023-36749: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The webserver of the affected devices support insecure TLS 1.0 protocol. An attacker could achieve a man-in-the-middle attack and compromise confidentiality and integrity of data.
Key phrases: man-in-the-middle, man in the middle, confidentiality, confidentiality and integrity
CVE-2023-36750: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The software-upgrade Url parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
Key phrases: execute arbitrary code, execute arbitrary code with root privileges, command injection
CVE-2023-36751: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The install-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
Key phrases: execute arbitrary code, execute arbitrary code with root privileges, command injection
CVE-2023-36752: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The upgrade-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
Key phrases: execute arbitrary code, execute arbitrary code with root privileges, command injection
CVE-2023-36753: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The uninstall-app App-name parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
Key phrases: execute arbitrary code, execute arbitrary code with root privileges, command injection
CVE-2023-36754: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The SCEP server configuration URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
Key phrases: execute arbitrary code, execute arbitrary code with root privileges, command injection
CVE-2023-36755: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The SCEP CA Certificate Name parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
Key phrases: execute arbitrary code, execute arbitrary code with root privileges, command injection
CVE-2023-36756: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36757: Microsoft Exchange Server Spoofing Vulnerability
Key phrases: microsoft exchange server spoofing
CVE-2023-36758: Visual Studio Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36759: Visual Studio Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-3676: A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
Key phrases: security issue
CVE-2023-36760: 3D Viewer Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36761: Microsoft Word Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-36762: Microsoft Word Remote Code Execution Vulnerability
Key phrases: microsoft word remote code execution
CVE-2023-36763: Microsoft Outlook Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-36764: Microsoft SharePoint Server Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36765: Microsoft Office Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36766: Microsoft Excel Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-36767: Microsoft Office Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-36769: Microsoft OneNote Spoofing Vulnerability
Key phrases: microsoft onenote spoofing
CVE-2023-3677: The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for subscribers or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Key phrases: sql injection, sensitive information
CVE-2023-36770: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-36771: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-36772: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-36773: 3D Builder Remote Code Execution Vulnerability
Key phrases: builder remote code execution
CVE-2023-36776: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36777: Microsoft Exchange Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-36778: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-3678: A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=delete_inquiry of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-234223.
Key phrases: sql injection
CVE-2023-36780: Skype for Business Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36785: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36786: Skype for Business Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36787: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-36788: .NET Framework Remote Code Execution Vulnerability
Key phrases: .net framework remote code execution
CVE-2023-36789: Skype for Business Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-3679: A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=save_inquiry of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-234224.
Key phrases: sql injection
CVE-2023-36790: Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability
Key phrases: windows rdp encoder mirror driver elevation of privilege
CVE-2023-36792: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36793: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36794: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36796: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-36799: .NET Core and Visual Studio Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-3680: A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. This affects an unknown part of the file /classes/Master.php?f=save_item of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-234225 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-36800: Dynamics Finance and Operations Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2023-36801: DHCP Server Service Information Disclosure Vulnerability
Key phrases: dhcp server service information disclosure
CVE-2023-36802: Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
Key phrases: proxy elevation of privilege
CVE-2023-36803: Windows Kernel Information Disclosure Vulnerability
Key phrases: windows kernel information disclosure
CVE-2023-36804: Windows GDI Elevation of Privilege Vulnerability
Key phrases: windows gdi elevation of privilege
CVE-2023-36805: Windows MSHTML Platform Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows mshtml platform security feature bypass
CVE-2023-36806: Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.
Key phrases: malicious code, installations
CVE-2023-36807: pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF. Versions prior to 2.10.5 throw an error, but do not hang forever. This issue was fixed with https://github.com/py-pdf/pypdf/pull/1331 which has been included in release 2.10.6. Users are advised to upgrade. Users unable to upgrade should modify `PyPDF2/generic/_data_structures.py::read_object` to an an error throwing case. See GHSA-hm9v-vj3r-r55m for details. 
Key phrases: infinite loop, memory usage, hang
CVE-2023-36808: GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.
Key phrases: sql injection
CVE-2023-36809: Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS prior to 12.5 had introduced changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed directly. The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ignore the `Content-Type: text/plain` header on some occasions thus allowing potentially dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering code had been found to require additional sanitation and improvements. Version 12.5 fixes this vulnerability with updated Nginx content type configuration, improved file upload validation code to prevent more potentially dangerous uploads, and Sanitization of test plan names used in the `tree_view_html()` function.
Key phrases: upload attachments to test plans, ignore the `Content-Type: text, be executed, file upload
CVE-2023-3681: A vulnerability classified as problematic was found in Campcodes Retro Cellphone Online Store 1.0. This vulnerability affects unknown code of the file /admin/modal_add_product.php. The manipulation of the argument description leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-234226 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-36810: pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: quadratic runtime, memory usage
CVE-2023-36811: borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be able to: 1. insert files (with no additional headers) into backups and 2. gain write access to the repository. This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives. The issue has been fixed in borgbackup 1.2.5. Users are advised to upgrade. Additionally to installing the fixed code, users must follow the upgrade procedure as documented in the change log. Data loss after being attacked can be avoided by reviewing the archives (timestamp and contents valid and as expected) after any "borg check --repair" and before "borg prune". There are no known workarounds for this vulnerability.
Key phrases: gain write access, data loss
CVE-2023-36812: OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in  commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.
Key phrases: remote code execution
CVE-2023-36813: Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information. Version 1.2.31 contains a fix for this issue.
Key phrases: sql injection, privilege escalation, loss of confidentiality
CVE-2023-36814: Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has been fixed in `Products.CMFCore` version 3.2.
Key phrases: unchecked input, unauthenticated denial of service, crash
CVE-2023-36815: Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account `sealos[.] io/v1/Payment`, resulting in the ability to recharge any amount of 1 renminbi (RMB). The charging interface may expose resource information. The namespace of this custom resource would be user's control and may have permission to correct it. It is not clear whether a fix exists.
Key phrases: control the recharge resource account `sealos[, permission flaw
CVE-2023-36816: 2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3.
Key phrases: cross site scripting (xss)
CVE-2023-36817: `tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently exposed in the codebase. If an unauthorized party gains access to this key, they could potentially carry out transactions on behalf of the organization, leading to financial losses. Additionally, they could access sensitive customer information, leading to privacy violations and potential legal implications. The affected component is the codebase of our project, specifically the file(s) where the Stripe API key is embedded. The key should have been stored securely, and not committed to the codebase. The maintainers plan to revoke the leaked Stripe API key immediately, generate a new one, and not commit the key to the codebase.
Key phrases: financial losses, privacy violations, legal implications, sensitive information
CVE-2023-36818: Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit `52b003d915`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: denial of service
CVE-2023-36819: Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/knowage/restful-services/dossier/importTemplateFile_` allows authenticated users to download template hosted on the server. However, starting in the 6.x.x branch and prior to version 8.1.8, the application does not sanitize the `_templateName_ `parameter allowing an attacker to use `*../*` in it, and escaping the directory the template are normally placed and download any file from the system. This vulnerability allows a low privileged attacker to exfiltrate sensitive configuration file. This issue has been patched in Knowage version 8.1.8.
Key phrases: download template hosted on the server, use `*../*` in, exfiltrate sensitive configuration file
CVE-2023-3682: A vulnerability, which was classified as critical, was found in Nesote Inout Blockchain EasyPayments 1.0. Affected is an unknown function of the file /index.php/payment/getcoinaddress of the component POST Parameter Handler. The manipulation of the argument coinid leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234228. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: sql injection, disclosure
CVE-2023-36820: Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.
CVE-2023-36821: Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it's installed by calling `npm install` in the installation directory of the plugin. Because the plugin is not validated against the official list of plugins or installed with `npm install --ignore-scripts`, a maliciously crafted plugin taking advantage of npm scripts can gain remote code execution. Version 1.22.1 contains a patch for this issue.
Key phrases: gain remote code execution, install a maliciously crafted plugin in versions prior, install plugins from an official list of plugins
CVE-2023-36822: Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. Before a plugin is downloaded, the plugin installation directory is checked for existence. If it exists, it's removed before the plugin installation. Because the plugin is not validated against the official list of plugins or sanitized, the check for existence and the removal of the plugin installation directory are prone to path traversal. This vulnerability allows an authenticated attacker to delete files from the server Uptime Kuma is running on. Depending on which files are deleted, Uptime Kuma or the whole system may become unavailable due to data loss.
Key phrases: install plugins from an official list of plugins, delete files from the server Uptime Kuma is, path traversal, data loss
CVE-2023-36823: Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows `style` elements and one or more CSS at-rules. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. Sanitize 6.0.2 performs additional escaping of CSS in `style` element content, which fixes this issue. Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn't allow `style` elements, using a Sanitize config that doesn't allow CSS at-rules, or by manually escaping the character sequence `</` as `<\\\\/` in `style` element content.
Key phrases: sneak arbitrary HTML, upgrade can prevent this issue by using a, `style` elements, CSS at-rules, cross-site scripting, undesired behavior, arbitrary html
CVE-2023-36824: Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12.
Key phrases: heap overflow, heap corruption, remote code execution
CVE-2023-36825: Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.
Key phrases: version 14.5.0 is related to the deserialization of, remote code execution, deserialization of untrusted data
CVE-2023-36826: Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher.
CVE-2023-36827: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. A path traversal (directory traversal) vulnerability affects fides versions lower than version `2.15.1`, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem. The vulnerability is patched in fides `2.15.1`.If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's security best practice documentation, and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error. Additionally, any secrets supplied to the container using environment variables rather than a `fides.toml` configuration file are not affected by this vulnerability.
Key phrases: access arbitrary files, access arbitrary files on the fides webserver container, path traversal, directory traversal
CVE-2023-36828: Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.
Key phrases: malicious svg, cross-site scripting
CVE-2023-36829: Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.
Key phrases: -credentials: true` HTTP header if, other multi-step attacks
CVE-2023-3683: A vulnerability has been found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /items/search. The manipulation of the argument search_term leads to cross site scripting. The attack can be launched remotely. The identifier VDB-234229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: disclosure
CVE-2023-36830: SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the `library_path` config value to allow arbitrary python code to be executed via macros. For many users who use SQLFluff in the context of an environment where all users already have fairly escalated privileges, this may not be an issue - however in larger user bases, or where SQLFluff is bundled into another tool where developers still wish to give users access to supply their on rule configuration, this may be an issue.The 2.1.2 release offers the ability for the `library_path` argument to be overwritten on the command line by using the `--library-path` option. This overrides any values provided in the config files and effectively prevents this route of attack for users which have access to the config file, but not to the scripts which call the SQLFluff CLI directly. A similar option is provided for the Python API, where users also have a greater ability to further customise or override configuration as necessary. Unless `library_path` is explicitly required, SQLFluff maintainers recommend using the option `--library-path none` when invoking SQLFluff which will disable the `library-path` option entirely regardless of the options set in the configuration file or via inline config directives. As a workaround, limiting access to - or otherwise validating configuration files before they are ingested by SQLFluff will provides a similar effect and does not require upgrade.
Key phrases: allow arbitrary python code, be executed via macros, route of, escalate privilege
CVE-2023-36831: An Improper Check or Handling of Exceptional Conditions vulnerability in the UTM (Unified Threat Management) Web-Filtering feature of Juniper Networks Junos OS on SRX Series causes a jbuf memory leak to occur when accessing certain websites, eventually leading to a Denial of Service (DoS) condition.  Service restoration is only possible by rebooting the system.The jbuf memory leak only occurs in SSL Proxy and UTM Web-Filtering configurations.  Other products, platforms, and configurations are not affected by this vulnerability.This issue affects Juniper Networks Junos OS on SRX Series:22.2 versions prior to 22.2R3;22.3 versions prior to 22.3R2-S1, 22.3R3;22.4 versions prior to 22.4R1-S2, 22.4R2.This issue does not affect Juniper Networks Junos OS versions prior to 22.2R2.
Key phrases: Denial of Service (DoS), jbuf memory leak, denial of service (dos) condition, reboot
CVE-2023-36832: An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series allows an unauthenticated network-based attacker to send specific packets to an Aggregated Multiservices (AMS) interface on the device, causing the packet forwarding engine (PFE) to crash, resulting in a Denial of Service (DoS).  Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.This issue is only triggered by packets destined to a local-interface via a service-interface (AMS).  AMS is only supported on the MS-MPC, MS-MIC, and MX-SPC3 cards.  This issue is not experienced on other types of interfaces or configurations.  Additionally, transit traffic does not trigger this issue.This issue affects Juniper Networks Junos OS on MX Series:All versions prior to 19.1R3-S10;19.2 versions prior to 19.2R3-S7;19.3 versions prior to 19.3R3-S8;19.4 versions prior to 19.4R3-S12;20.2 versions prior to 20.2R3-S8;20.4 versions prior to 20.4R3-S7;21.1 versions prior to 21.1R3-S5;21.2 versions prior to 21.2R3-S5;21.3 versions prior to 21.3R3-S4;21.4 versions prior to 21.4R3-S3;22.1 versions prior to 22.1R3-S2;22.2 versions prior to 22.2R3;22.3 versions prior to 22.3R2-S1, 22.3R3;22.4 versions prior to 22.4R1-S2, 22.4R2.
Key phrases: Denial of Service (DoS), send specific packets to an Aggregated Multiservices (, improper handling of exceptional conditions, crash
CVE-2023-36833: A Use After Free vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS Evolved on PTX10001-36MR, and PTX10004, PTX10008, PTX10016 with LC1201/1202 allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).The process 'aftman-bt' will crash after multiple flaps on a multicast-only fast reroute (MoFRR) enabled interface. This will cause the respective FPC to stop forwarding traffic and it needs to be rebooted to restore the service.An indication that the system experienced this issue is the following log message: <date> <hostname> evo-aftmand-bt[<pid>]: [Error] jexpr_fdb: sanity check failed, ... , app_name L3 Mcast RoutesThis issue affects Juniper Networks Junos OS Evolved on PTX10001-36MR, PTX10004, PTX10008, PTX10016 with LC1201/1202:21.2 version 21.2R1-EVO and later versions;21.3 version 21.3R1-EVO and later versions;21.4 versions prior to 21.4R3-S3-EVO;22.1 version 22.1R1-EVO and later versions;22.2 versions prior to 22.2R3-S2-EVO;22.3 versions prior to 22.3R3-EVO;22.4 versions prior to 22.4R1-S2-EVO, 22.4R2-EVO.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS).The process, use after free, denial of service (dos), crash, reboot