yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-31871: OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root. The software comes prepackaged with a root owned SUID binary dm_secure_writer. The binary has security controls in place preventing creation of a file in a non-owned directory, or as the root user. However, these controls can be carefully bypassed to allow for an arbitrary file write as root.
Key phrases: root, for an arbitrary file write as root, privilege escalation
CVE-2023-31873: Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').
Key phrases: execution of arbitrary code when a crafted file
CVE-2023-31874: Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').
Key phrases: execution of arbitrary code when a crafted file
CVE-2023-3188: Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.
Key phrases: server-side request forgery (ssrf)
CVE-2023-3189: A vulnerability, which was classified as problematic, was found in SourceCodester Online School Fees System 1.0. This affects an unknown part of the file /paysystem/branch.php of the component POST Parameter Handler. The manipulation of the argument branch leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231501 was assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-31890: An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the BeanXMLByteCoder.decode(), xml deserialization
CVE-2023-31893: Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.
Key phrases: Denial of Service (DoS), denial of service (dos), dns recursion
CVE-2023-3190: Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Key phrases: improper encoding
CVE-2023-31902: RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).
Key phrases: remote code execution (rce)
CVE-2023-31903: GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.
Key phrases: execute arbitrary code, execute arbitrary code by uploading a php file, unrestricted file upload
CVE-2023-31904: savysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion.
Key phrases: local file inclusion
CVE-2023-31906: Jerryscript 3.0.0(commit 1a2c047) was discovered to contain a heap-buffer-overflow via the component lexer_compare_identifier_to_chars at /jerry-core/parser/js/js-lexer.c.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2023-31907: Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via the component scanner_literal_is_created at /jerry-core/parser/js/js-scanner-util.c.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2023-31908: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component ecma_builtin_typedarray_prototype_sort.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2023-3191: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Key phrases: cross-site scripting (xss)
CVE-2023-31910: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component parser_parse_function_statement at /jerry-core/parser/js/js-parser-statm.c.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2023-31913: Jerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at jerry-core/parser/js/js-parser-expr.c.
Key phrases: assertion failure
CVE-2023-31914: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc.
Key phrases: out-of-memory issue
CVE-2023-31916: Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem_heap_finalize at jerry-core/jmem/jmem-heap.c.
Key phrases: assertion failure
CVE-2023-31918: Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser_parse_function_arguments at jerry-core/parser/js/js-parser.c.
Key phrases: assertion failure
CVE-2023-31919: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext_raise_exception at jerry-core/jcontext/jcontext.c.
Key phrases: assertion failure
CVE-2023-3192: Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.
Key phrases: session fixation
CVE-2023-31920: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c.
Key phrases: assertion failure
CVE-2023-31921: Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_big_uint_div_mod at jerry-core/ecma/operations/ecma-big-uint.c.
Key phrases: assertion failure
CVE-2023-31922: QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c.
Key phrases: stack-overflow, stack overflow
CVE-2023-31923: Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator" privileges to create a highly privileged user account. The vulnerability is caused by missing server-side validation, which can be exploited to gain full administrator privileges on the system.
Key phrases: gain full administrator privileges, create a highly privileged user account, insecure permissions
CVE-2023-31925: Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with knowledge and access to these log files. SNMP credentials could be seen in SANnav SupportSave if the capture is performed after an SNMP configuration failure causes an SNMP communication log dump.
Key phrases: plaintext
CVE-2023-31926: System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.
Key phrases: system files
CVE-2023-31927: An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated attacker to get technical details about the web interface.
Key phrases: get technical details about the web interface, information disclosure
CVE-2023-31928: A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html  of Brocade Fabric OS version before Brocade Fabric OS v9.2.0 that could allow a remote unauthenticated attacker to execute arbitrary JavaScript code in a target users session with the Brocade Webtools application.
Key phrases: execute arbitrary JavaScript code, execute arbitrary JavaScript code in a target users, reflected cross-site scripting (xss)
CVE-2023-3193: Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2023-31932: Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-enquiry.php file.
Key phrases: execute arbitrary code, execute arbitrary code via the viewid parameter of, sql injection
CVE-2023-31933: Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-pass-detail.php file.
Key phrases: execute arbitrary code, execute arbitrary code via the editid parameter of, sql injection
CVE-2023-31934: Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the adminname parameter of admin-profile.php.
Key phrases: obtain sensitive information, obtain sensitive information via the adminname parameter of, cross site scripting
CVE-2023-31935: Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the emial parameter of admin-profile.php.
Key phrases: obtain sensitive information, obtain sensitive information via the emial parameter of, cross site scripting
CVE-2023-31936: Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-pass-detail.php file.
Key phrases: execute arbitrary code, execute arbitrary code via the viewid parameter of, sql injection
CVE-2023-31937: Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-cateogry-detail.php file.
Key phrases: execute arbitrary code, execute arbitrary code via the editid parameter of, sql injection
CVE-2023-31938: SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp_id parameter at employee_detail.php.
Key phrases: execute arbitrary code, execute arbitrary code via the emp_id parameter at, sql injection
CVE-2023-31939: SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomer_id parameter at customer_edit.php.
Key phrases: execute arbitrary code, execute arbitrary code via the costomer_id parameter at, sql injection
CVE-2023-31940: SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the page_id parameter at article_edit.php.
Key phrases: execute arbitrary code, execute arbitrary code via the page_id parameter at, sql injection
CVE-2023-31941: File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP file to the employee_insert.php.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, file upload
CVE-2023-31942: Cross Site Scripting vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the description parameter in insert.php.
Key phrases: execute arbitrary code, execute arbitrary code via the description parameter in, cross site scripting
CVE-2023-31943: SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the ticket_id parameter at ticket_detail.php.
Key phrases: execute arbitrary code, execute arbitrary code via the ticket_id parameter at, sql injection
CVE-2023-31944: SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp_id parameter at employee_edit.php.
Key phrases: execute arbitrary code, execute arbitrary code via the emp_id parameter at, sql injection
CVE-2023-31945: SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the id parameter at daily_expenditure_edit.php.
Key phrases: execute arbitrary code, execute arbitrary code via the id parameter, sql injection
CVE-2023-31946: File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP file to the artical.php.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, file upload
CVE-2023-3195: A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
Key phrases: trick the user into opening a specially crafted, stack-based buffer overflow, denial of service, stack based buffer overflow, application crash
CVE-2023-3196: This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the administration panel.
Key phrases: store a malicious JavaScript payload in the login
CVE-2023-3197: The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Key phrases: unauthenticated blind sql injection, sensitive information
CVE-2023-31972: yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c.
Key phrases: use after free
CVE-2023-31973: yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c.
Key phrases: use after free
CVE-2023-31974: yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c.
Key phrases: use after free, function error
CVE-2023-31975: yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c.
Key phrases: memory leak
CVE-2023-31976: libming v0.4.8 was discovered to contain a stack buffer overflow via the function makeswf_preprocess at /util/makeswf_utils.c.
Key phrases: stack buffer overflow
CVE-2023-31979: Catdoc v0.95 was discovered to contain a global buffer overflow via the function process_file at /src/reader.c.
Key phrases: global buffer overflow
CVE-2023-3198: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message function. This makes it possible for unauthenticated attackers to update status order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-31981: Sngrep v1.6.0 was discovered to contain a stack buffer overflow via the function packet_set_payload at /src/packet.c.
Key phrases: stack buffer overflow
CVE-2023-31982: Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_packet_reasm_ip at /src/capture.c.
Key phrases: heap buffer overflow
CVE-2023-31983: A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the mp function in /bin/webs without any limitations.
Key phrases: execute arbitrary code, execute arbitrary code via the mp function in, command injection
CVE-2023-31985: A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the formAccept function in /bin/webs without any limitations.
Key phrases: execute arbitrary code, execute arbitrary code via the formAccept function in, command injection
CVE-2023-31986: A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the setWAN function in /bin/webs without any limitations.
Key phrases: execute arbitrary code, execute arbitrary code via the setWAN function in, command injection
CVE-2023-3199: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This makes it possible for unauthenticated attackers to update status order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-31994: Certain Hanwha products are vulnerable to Denial of Service (DoS). ck vector is: When an empty UDP packet is sent to the listening service, the service thread results in a non-functional service (DoS) via WS Discovery and Hanwha proprietary discovery services. This affects IP Camera ANE-L7012R 1.41.01 and IP Camera XNV-9082R 2.10.02.
Key phrases: Denial of Service (DoS), denial of service (dos), ck vector
CVE-2023-31995: Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2023-31996: Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function.
Key phrases: command injection
CVE-2023-31997: UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. Applicable Cloud Keys that are both (1) running UniFi OS 3.1 and (2) hosting the UniFi Network application. "Applicable Cloud Keys" include the following: Cloud Key Gen2 and Cloud Key Gen2 Plus.
Key phrases: access MongoDB
CVE-2023-31998: A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices.
Key phrases: interrupt UPnP service to said devices, heap overflow
CVE-2023-31999: All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it.v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.
Key phrases: validate it.v7.2.0 changes the default behavior to store, cross-site-request-forgery, breaking change
CVE-2023-3200: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This makes it possible for unauthenticated attackers to update new order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-32000: A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site Administrator credentials to escalate privileges by persuading an Administrator to visit a malicious web page.
Key phrases: escalate privileges by persuading an Administrator to visit, cross-site scripting (xss)
CVE-2023-32002: The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Key phrases: bypass the policy
CVE-2023-32003: `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory.This vulnerability affects all users using the experimental permission model in Node.js 20.Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Key phrases: bypass the permission, path traversal, arbitrary directory
CVE-2023-32004: A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.This vulnerability affects all users using the experimental permission model in Node.js 20.Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Key phrases: bypass when verifying file permissions
CVE-2023-32005: A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.This flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.This vulnerability affects all users using the experimental permission model in Node.js 20.Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVE-2023-32006: The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Key phrases: bypass the policy
CVE-2023-32007: ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This issue was disclosed earlier as CVE-2022-33891, but incorrectly claimed version 3.1.3 (which has since gone EOL) would not be affected.NOTE: This vulnerability only affects products that are no longer supported by the maintainer.Users are recommended to upgrade to a supported version of Apache Spark, such as version 3.4.0.
Key phrases: perform impersonation by providing an arbitrary user name, arbitrary shell command execution
CVE-2023-32008: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-32009: Windows Collaborative Translation Framework Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-3201: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This makes it possible for unauthenticated attackers to update new order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-32010: Windows Bus Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows bus filter driver elevation of privilege
CVE-2023-32011: Windows iSCSI Discovery Service Denial of Service Vulnerability
Key phrases: windows iscsi discovery service denial of service
CVE-2023-32012: Windows Container Manager Service Elevation of Privilege Vulnerability
Key phrases: service elevation of privilege
CVE-2023-32013: Windows Hyper-V Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-32014: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-32015: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-32016: Windows Installer Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-32017: Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-32018: Windows Hello Remote Code Execution Vulnerability
Key phrases: windows hello remote code execution
CVE-2023-32019: Windows Kernel Information Disclosure Vulnerability
Key phrases: windows kernel information disclosure
CVE-2023-3202: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-32020: Windows DNS Spoofing Vulnerability
Key phrases: windows dns spoofing
CVE-2023-32021: Windows SMB Witness Service Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2023-32022: Windows Server Service Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows server service security feature bypass
CVE-2023-32024: Microsoft Power Apps Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-32025: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-32026: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-32027: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-32028: Microsoft SQL OLE DB Remote Code Execution Vulnerability
Key phrases: microsoft sql ole db remote code execution
CVE-2023-32029: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2023-3203: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This makes it possible for unauthenticated attackers to update limit the number of product per category to use cache data in home screen via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-32030: .NET and Visual Studio Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-32031: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-32032: .NET and Visual Studio Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-32033: Microsoft Failover Cluster Remote Code Execution Vulnerability
Key phrases: microsoft failover cluster remote code execution
CVE-2023-32034: Remote Procedure Call Runtime Denial of Service Vulnerability
Key phrases: remote procedure call runtime denial of service
CVE-2023-32035: Remote Procedure Call Runtime Denial of Service Vulnerability
Key phrases: remote procedure call runtime denial of service
CVE-2023-32037: Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability
Key phrases: windows bridge network driver information disclosure
CVE-2023-32038: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-32039: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-32040: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-32041: Windows Update Orchestrator Service Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-32042: OLE Automation Information Disclosure Vulnerability
Key phrases: ole automation information disclosure
CVE-2023-32043: Windows Remote Desktop Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows remote desktop security feature bypass
CVE-2023-32044: Microsoft Message Queuing Denial of Service Vulnerability
Key phrases: microsoft message queuing denial of service
CVE-2023-32045: Microsoft Message Queuing Denial of Service Vulnerability
Key phrases: microsoft message queuing denial of service
CVE-2023-32046: Windows MSHTML Platform Elevation of Privilege Vulnerability
Key phrases: windows mshtml platform elevation of privilege
CVE-2023-32047: Paint 3D Remote Code Execution Vulnerability
Key phrases: paint remote code execution
CVE-2023-32049: Windows SmartScreen Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows smartscreen security feature bypass
CVE-2023-3205: An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.
Key phrases: denial of service
CVE-2023-32050: Windows Installer Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-32051: Raw Image Extension Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2023-32052: Microsoft Power Apps (online) Spoofing Vulnerability
Key phrases: spoofing
CVE-2023-32053: Windows Installer Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-32054: Volume Shadow Copy Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-32055: Active Template Library Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-32056: Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-32057: Microsoft Message Queuing Remote Code Execution Vulnerability
Key phrases: microsoft message queuing remote code execution
CVE-2023-32058: Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.
CVE-2023-32059: Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.
CVE-2023-3206: A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=restart. The manipulation of the argument restart with the input reboot leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: denial of service, reboot, disclosure
CVE-2023-32060: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker program events or program stages, the `/trackedEntityInstances` and `/events` API endpoints may include all events regardless of the sharing settings applied to the category option combinations. When this specific configuration is present, users may have access to events which they should not be able to see based on the sharing settings of the category options.  The events will not appear in the user interface for web-based Tracker Capture or Capture applications, but if the Android Capture App is used they will be displayed to the user. Versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0 contain a fix for this issue. No workaround is known.
CVE-2023-32061: Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerability and hide subsequent comments from other users. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. There are no known workarounds.
CVE-2023-32062: OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1.
Key phrases: insufficient security checks
CVE-2023-32063: OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.
Key phrases: insufficient security checks
CVE-2023-32064: OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.
Key phrases: insufficient security checks
CVE-2023-32065: OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.
CVE-2023-32066: Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file,  as happens in version 1.22.12.5783.
CVE-2023-32067: c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.
Key phrases: denial of service
CVE-2023-32068: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect.  The issue has now been patched against all patterns that are known for performing redirects. This issue has been patched in XWiki 14.10.4 and 15.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: upgrade
CVE-2023-32069: XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XWiki 15.0-rc-1 and 14.10.4. There are no known workarounds.
CVE-2023-32070: XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.
Key phrases: dangerous attributes attribute values, cross-site scripting (xss)
CVE-2023-32071: XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.
Key phrases: javascript
CVE-2023-32072: Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version 14.8.99.60 and Tuleap Enterprise edition prior to 14.8-3 and 14.7-7, the logs of the triggered Jenkins job URLs are not properly escaped. A malicious Git administrator can setup a malicious Jenkins hook to make a victim, also a Git administrator, execute uncontrolled code. Tuleap Community Edition 14.8.99.60, Tuleap Enterprise Edition 14.8-3, and Tuleap Enterprise Edition 14.7-7 contain a patch for this issue.
Key phrases: uncontrolled code
CVE-2023-32073: WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.
Key phrases: bypass to the fix for CVE-2023-30854, command injection, remote code execution
CVE-2023-32074: user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.2
Key phrases: broken bypassed
CVE-2023-32075: The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.
Key phrases: business logic errors
CVE-2023-32076: in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.
Key phrases: configure the behavior of the framework, integrity, file read
CVE-2023-32077: Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6.  If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Key phrases: interact with DNS API endpoints, dns key usage, hardcoded
CVE-2023-32078: Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user update function. By specifying another user's username, it was possible to update the other user's password. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Key phrases: insecure direct object reference (idor)
CVE-2023-32079: Netmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escalate privileges to those of an admin user. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Key phrases: escalate privileges to those of an admin user, mass assignment
CVE-2023-3208: A vulnerability, which was classified as critical, has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3. Affected by this issue is some unknown functionality of the file /Log/Query?appid=0B736354-9473-4D66-B9C0-15CAC149EB05&tabid=tab_0B73635494734D66B9C015CAC149EB05 of the component Login. The manipulation of the argument sidx/sord leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231230 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: sql injection, disclosure
CVE-2023-32080: Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11.6 impacts anyone running the affected versions of Wings.  This vulnerability can be used to gain access to the host system running Wings if a user is able to modify an server's install script or the install script executes code supplied by the user (either through environment variables, or commands that execute commands based off of user data). This vulnerability has been resolved in version `v1.11.6` of Wings, and has been back-ported to the 1.7 release series in `v1.7.5`. Anyone running `v1.11.x` should upgrade to `v1.11.6` and anyone running `v1.7.x` should upgrade to `v1.7.5`.There are no workarounds aside from upgrading. Running Wings with a rootless container runtime may mitigate the severity of any attacks, however the majority of users are using container runtimes that run as root as per the Wings documentation. SELinux may prevent attackers from performing certain operations against the host system, however privileged containers have a lot of freedom even on systems with SELinux enabled.It should be noted that this was a known attack vector, for attackers to easily exploit this attack it would require compromising an administrator account on a Panel.  However, certain eggs (the data structure that holds the install scripts that get passed to Wings) have an issue where they are unknowingly executing shell commands with escalated privileges provided by untrusted user data.
Key phrases: gain access, attack vector, execute code, execute commands, escalate privilege
CVE-2023-32081: Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted. The issue is patched in Vert.x 3.9.16 and 4.4.2. There are no trivial workarounds.
CVE-2023-32082: etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
Key phrases: key names (not value) associated to
CVE-2023-32083: Microsoft Failover Cluster Information Disclosure Vulnerability
Key phrases: microsoft failover cluster information disclosure
CVE-2023-32084: HTTP.sys Denial of Service Vulnerability
Key phrases: denial of service
CVE-2023-32085: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2023-32087: Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation
Key phrases: xss
CVE-2023-32088: Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation
Key phrases: xss issue
CVE-2023-32089: Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description
Key phrases: xss issue
CVE-2023-3209: The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
CVE-2023-32090: Pega platform clients who are using versions 6.1 through 7.3.1 may beutilizing default credentials
Key phrases: default credentials, default credentials,
CVE-2023-32091: Cross-Site Request Forgery (CSRF) vulnerability in POEditor plugin <=0.9.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32092: Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo  Social Network, Membership, Registration, User Profiles plugin <=6.0.9.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32093: Cross-Site Request Forgery (CSRF) vulnerability in Criss Swaim TPG Redirect plugin <=1.0.7 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32095: Improper Control of Generation of Code ('Code Injection') vulnerability in Milan Dinic Rename Media Files.This issue affects Rename Media Files: from n/a through 1.0.1.
Key phrases: improper control of generation of code, code injection
CVE-2023-32096: Compiler removal of buffer clearing in sli_crypto_transparent_aead_encrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
Key phrases: key material duplication
CVE-2023-32097: Compiler removal of buffer clearing in sli_crypto_transparent_aead_decrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
Key phrases: key material duplication