yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-2424: A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the file uploads/dede/config.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227750 is the identifier assigned to this vulnerability.
Key phrases: unrestricted upload
CVE-2023-24241: Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.
Key phrases: sql injection
CVE-2023-24243: CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF).
Key phrases: server-side request forgery (ssrf)
CVE-2023-24249: An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2023-2425: A vulnerability was found in SourceCodester Simple Student Information System 1.0. It has been classified as problematic. This affects an unknown part of the file /classes/Master.php?f=save_course of the component Add New Course. The manipulation of the argument name with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227751.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-24251: WangEditor v5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /dist/index.js.
Key phrases: cross-site scripting (xss)
CVE-2023-24253: Domotica Labs srl Ikon Server before v2.8.6 was discovered to contain a SQL injection vulnerability.
Key phrases: sql injection
CVE-2023-24256: An issue in the com.nextev.datastatistic component of NIO EC6 Aspen before v3.3.0 allows attackers to escalate privileges via path traversal.
Key phrases: escalate privileges via path traversal
CVE-2023-24258: SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter. This vulnerability allows attackers to execute arbitrary code via a crafted POST request.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted POST request, sql injection
CVE-2023-2426: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.
Key phrases: out-of-range pointer offset
CVE-2023-24261: A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted POST request
CVE-2023-24269: An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted Zip file, arbitrary file upload
CVE-2023-2427: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
Key phrases: cross-site scripting (xss)
CVE-2023-24276: TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
Key phrases: command injection
CVE-2023-24278: Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.
Key phrases: squid.svg cross-site scripting (xss)
CVE-2023-24279: A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-2428: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
Key phrases: cross-site scripting (xss)
CVE-2023-24282: An arbitrary file upload vulnerability in Poly Trio 8800 7.2.2.1094 allows attackers to execute arbitrary code via a crafted ringtone file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted ringtone file, arbitrary file upload
CVE-2023-2429: Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
Key phrases: improper access control
CVE-2023-24294: Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component NetlinkWeb::Information::SetDeviceIdentification.
Key phrases: buffer overflow
CVE-2023-24295: A stack overfow in SoftMaker Software GmbH FlexiPDF v3.0.3.0 allows attackers to execute arbitrary code after opening a crafted PDF file.
Key phrases: execute arbitrary code, execute arbitrary code after opening a crafted PDF, stack overfow
CVE-2023-2430: A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service threat.
Key phrases: trigger a Denial of Service threat, iopoll flaw, denial of service threat
CVE-2023-24304: Improper input validation in the PDF.dll plugin of IrfanView v4.60 allows attackers to execute arbitrary code via opening a crafted PDF file.
Key phrases: execute arbitrary code, execute arbitrary code via opening a crafted PDF, improper input validation
CVE-2023-24308: A potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker Software may allow attackers to execute code when a user opens a crafted PDF file. The issue occurs when handling a large number of objects in a PDF file.
Key phrases: execute code when a user opens a crafted, memory, insufficient input validation
CVE-2023-2431: A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.
Key phrases: bypass the seccomp profile enforcement. Pods that use localhost type, run in unconfined (seccomp disabled) mode, security issue
CVE-2023-24317: Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the component edit_organizer.php.
Key phrases: arbitrary file upload
CVE-2023-24320: An access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via unspecified vectors.
Key phrases: execute arbitrary commands, execute arbitrary commands via unspecified vectors, access control issue
CVE-2023-24322: A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-24323: Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability.
Key phrases: xml external entity (xxe) injection
CVE-2023-24329: An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
Key phrases: bypass blocklisting methods by supplying a URL that starts
CVE-2023-2433: The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-24330: Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbitrary commands via crafted POST request to /HNAP1/.
Key phrases: run arbitrary commands, run arbitrary commands via crafted POST request to, command injection
CVE-2023-24331: Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816_A2_v1.10CNB04 allows attackers to run arbitrary commands via the urlAdd parameter.
Key phrases: run arbitrary commands, run arbitrary commands via the urlAdd parameter, command injection
CVE-2023-24332: A stack overflow vulnerability in Tenda AC6 with firmware version US_AC6V5.0re_V03.03.02.01_cn_TDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/PowerSaveSet.
Key phrases: run arbitrary commands, run arbitrary commands via crafted POST request to, stack overflow
CVE-2023-24333: A stack overflow vulnerability in Tenda AC21 with firmware version US_AC21V1.0re_V16.03.08.15_cn_TDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/openSchedWifi.
Key phrases: run arbitrary commands, run arbitrary commands via crafted POST request to, stack overflow
CVE-2023-24334: A stack overflow vulnerability in Tenda AC23 with firmware version US_AC23V1.0re_V16.03.07.45_cn_TDC01 allows attackers to run arbitrary commands via schedStartTime parameter.
Key phrases: run arbitrary commands, run arbitrary commands via schedStartTime parameter, stack overflow
CVE-2023-2434: The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with editor-level permissions and above, to reset plugin settings.
Key phrases: unauthorized loss of data, missing capability check
CVE-2023-24343: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSchedule.
Key phrases: stack overflow
CVE-2023-24344: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWlanGuestSetup.
Key phrases: stack overflow
CVE-2023-24345: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetWanDhcpplus.
Key phrases: stack overflow
CVE-2023-24346: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the wan_connected parameter at /goform/formEasySetupWizard3.
Key phrases: stack overflow
CVE-2023-24347: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formSetWanDhcpplus.
Key phrases: stack overflow
CVE-2023-24348: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetACLFilter.
Key phrases: stack overflow
CVE-2023-24349: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetRoute.
Key phrases: stack overflow
CVE-2023-2435: The Blog-in-Blog plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.1 via a shortcode attribute. This allows editor-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other safe file types can be uploaded and included.
Key phrases: execute arbitrary files, bypass access controls, obtain sensitive data, include and execute arbitrary files on the server, local file inclusion, code execution
CVE-2023-24350: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the config.smtp_email_subject parameter at /goform/formSetEmail.
Key phrases: stack overflow
CVE-2023-24351: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the FILECODE parameter at /goform/formLogin.
Key phrases: stack overflow
CVE-2023-24352: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWPS.
Key phrases: stack overflow
CVE-2023-2436: The Blog-in-Blog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blog_in_blog' shortcode in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-24364: Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under the Admin Panel.
Key phrases: sql injection
CVE-2023-24366: An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request.
Key phrases: download sensitive files via a crafted HTTP request, arbitrary file download
CVE-2023-24369: A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter under the Add New Articles function.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via injecting, cross-site scripting (xss)
CVE-2023-2437: The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. An attacker can leverage CVE-2023-2448 and CVE-2023-2446 to get the user's email address to successfully exploit this vulnerability.
Key phrases: bypass in versions up to, authentication bypass
CVE-2023-24372: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in USB Memory Direct Simple Custom Author Profiles plugin <=1.0.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24374: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24376: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilityin Nico Graff WP Simple Events plugin <=1.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24377: Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-24378: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Codeat Glossary plugin <= 2.1.27 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-2438: The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'userpro_save_userdata' function. This makes it possible for unauthenticated attackers to update the user meta and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-24380: Cross-Site Request Forgery (CSRF) vulnerability in Webbjocke Simple Wp Sitemap.This issue affects Simple Wp Sitemap: from n/a through 1.2.1.
Key phrases: cross-site request forgery (csrf)
CVE-2023-24381: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NsThemes Advanced Social Pixel plugin <= 2.1.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24382: Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-24383: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Namaste! LMS plugin <= 2.5.9.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24384: Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart <=1.4.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-24385: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in David Lingren Media Library Assistant plugin <= 3.11 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24386: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Karishma Arora AI Contact Us Form plugin <=1.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24387: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Organization chart plugin <= 1.4.4 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24388: Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).
Key phrases: cross-site request forgery (csrf)
CVE-2023-24389: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in brandiD Social Proof (Testimonial) Slider plugin <=2.2.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-2439: The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-24390: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WeSecur Security plugin <=1.2.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24391: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline plugin <=2.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24392: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Full Width Banner Slider Wp plugin <=1.1.7 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-24393: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Animated Number Counters plugin <=1.6 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24394: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy iframe popup plugin <=3.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24395: Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <= 1.0.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-24396: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.11 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24397: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Reservation.Studio Reservation.Studio widget plugin <=1.0.11 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24398: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Snap Creek Software EZP Coming Soon Page plugin <= 1.0.7.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24399: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <=2.1.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-2440: The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'admin_page', 'userpro_verify_user' and 'verifyUnverifyAllUsers' functions. This makes it possible for unauthenticated attackers to modify the role of verified users to elevate verified user privileges to that of any user such as 'administrator' via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-24400: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Hu-manity.Co Cookie Notice & Compliance for GDPR / CCPA plugin <=2.4.6 versions.
Key phrases: cross-site scripting (xss)
CVE-2023-24401: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Davidsword Mobile Call Now & Map Buttons plugin <=1.5.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24402: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Veribo, Roland Murg WP Booking System – Booking Calendar plugin <= 2.0.18 versions.
Key phrases: cross-site scripting (xss)
CVE-2023-24403: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP For The Win bbPress Voting plugin <= 2.1.11.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24404: Reflected Cross-Site Scripting (XSS) vulnerability in VryaSage Marketing Performance plugin <=2.0.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-24405: Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin <= 1.9.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-24406: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb ur Rehman Simple PopUp plugin <=1.8.6 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24408: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <=6.11.4 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24409: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs plugin <= 1.1.15 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-24410: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin  Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin  Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n/a through 4.3.25.
Key phrases: SQL Injection, sql injection
CVE-2023-24411: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kerry Kline BNE Testimonials plugin <= 2.0.7 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24412: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Image Social Feed plugin <=1.7.6 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24413: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress vertical image slider plugin <= 1.2.16 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-24414: Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <=3.2.11 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-24415: Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <=4.2.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-24416: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7.
Key phrases: path traversal
CVE-2023-24417: Cross-Site Request Forgery (CSRF) vulnerability in tiggersWelt.Net Worthy plugin <= 1.6.5-6497609 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-24418: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny carousel horizontal slider plus plugin <=3.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-24419: Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin<= 5.5.6 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-2442: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.
Key phrases: perform arbitrary actions, perform arbitrary actions on behalf of victims, xss
CVE-2023-24420: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zestard Technologies Admin side data storage for Contact Form 7 plugin <= 1.1.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-24421: Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-24422: A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Key phrases: execute arbitrary code, bypass the sandbox protection, sandbox bypass, define and run sandboxed scripts, bypass sandbox
CVE-2023-24423: A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit.
Key phrases: rebuild previous builds triggered by Gerrit, cross-site request forgery (csrf), cross site request forgery
CVE-2023-24424: Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
CVE-2023-24425: Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to.
Key phrases: access and potentially capture Kubernetes credentials they are
CVE-2023-24426: Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
CVE-2023-24427: Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
CVE-2023-24428: A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account.
Key phrases: trick users into logging in to the attacker, cross-site request forgery (csrf), cross site request forgery
CVE-2023-24429: Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Key phrases: control agent processes to have Jenkins parse a, server-side request forgery, server side request forgery
CVE-2023-2443: Rockwell Automation ThinManager product allows the use of medium strength ciphers. If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.
Key phrases: the use of medium strength ciphers, insecure cipher
CVE-2023-24430: Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2023-24431: A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Key phrases: enumerate credentials IDs of credentials stored in Jenkins, missing permission check
CVE-2023-24432: A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified HTTP server, cross-site request forgery (csrf), cross site request forgery
CVE-2023-24433: Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified HTTP server, missing permission checks
CVE-2023-24434: A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified URL using, cross-site request forgery (csrf), cross site request forgery
CVE-2023-24435: A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified URL using, permission check
CVE-2023-24436: A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Key phrases: enumerate credentials IDs of credentials stored in Jenkins, permission check
CVE-2023-24437: A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified URL using, cross-site request forgery (csrf), cross site request forgery
CVE-2023-24438: A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified URL using
CVE-2023-24439: Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Key phrases: unencrypted
CVE-2023-2444: A cross site request forgery vulnerability exists in Rockwell Automation's FactoryTalk Vantagepoint. This vulnerability can be exploited in two ways. If an attacker sends a malicious link to a computer that is on the same domain as the FactoryTalk Vantagepoint server and a user clicks the link, the attacker could impersonate the legitimate user and send requests to the affected product.Additionally, if an attacker sends an untrusted link to a computer that is not on the same domain as the server and a user opens the FactoryTalk Vantagepoint website, enters credentials for the FactoryTalk Vantagepoint server, and clicks on the malicious link a cross site request forgery attack would be successful as well.
Key phrases: cross site request forgery, malicious link, untrusted link, impersonate
CVE-2023-24440: Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Key phrases: plain text
CVE-2023-24441: Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2023-24442: Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Key phrases: unencrypted
CVE-2023-24443: Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2023-24444: Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
CVE-2023-24445: Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
Key phrases: redirect url
CVE-2023-24446: A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
Key phrases: trick users into logging in to the attacker, cross-site request forgery (csrf), cross site request forgery
CVE-2023-24447: A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
Key phrases: connect to an attacker-specified AMQP(S), cross-site request forgery (csrf), cross site request forgery
CVE-2023-24448: A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
Key phrases: connect to an attacker-specified AMQP(S)
CVE-2023-24449: Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Key phrases: check for the existence of an attacker-
CVE-2023-2445: Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information on folders in user vaults via a specific folder name.
Key phrases: retrieve usage information on folders in user vaults, improper access control
CVE-2023-24450: Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Key phrases: unencrypted
CVE-2023-24451: A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Key phrases: enumerate credentials IDs of credentials stored in Jenkins, permission check
CVE-2023-24452: A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
Key phrases: connect to an attacker-specified URL using, cross-site request forgery (csrf), cross site request forgery
CVE-2023-24453: A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Key phrases: connect to an attacker-specified URL using, missing check
CVE-2023-24454: Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Key phrases: unencrypted
CVE-2023-24455: Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Key phrases: check for the existence of an attacker-, attacker-specified file path
CVE-2023-24456: Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.
CVE-2023-24457: A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account.
Key phrases: trick users into logging in to the attacker, cross-site request forgery (csrf), cross site request forgery
CVE-2023-24458: A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL.
Key phrases: connect to an attacker-specified URL, cross-site request forgery (csrf), cross site request forgery
CVE-2023-24459: A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Key phrases: connect to an attacker-specified URL, permission check
CVE-2023-2446: The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account.
Key phrases: gain access, sensitive information disclosure
CVE-2023-24461: An improper certificate validationvulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: impersonate a BIG-IP APM system, certificate validationvulnerability
CVE-2023-24463: Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
Key phrases: potentially enable information disclosure via adjacent access, improper input validation
CVE-2023-24464: Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the product to execute arbitrary JavaScript on a legitimate user's web browser. The affected products and versions are as follows: BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier
Key phrases: execute arbitrary JavaScript, the web management console of the product to, stored-cross-site scripting
CVE-2023-24465: Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and prior versions, OpenHarmony-v3.0.7 and prior versionshas a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause the current application to crash.
Key phrases: null pointer reference, crash, application crash
CVE-2023-24468: Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2
Key phrases: broken access control
CVE-2023-24469: Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0
Key phrases: potential cross-site scripting
CVE-2023-2447: The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on the 'export_users' function. This makes it possible for unauthenticated attackers to export the users to a csv file, granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-24470: Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.
Key phrases: potential xml external entity injection
CVE-2023-24471: An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.An authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data that would normally be not accessible in the Query and Assertions functions.
Key phrases: obtain unauthorized information, access control
CVE-2023-24472: A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide malicious input to trigger this vulnerability.
Key phrases: denial of service, malicious input
CVE-2023-24473: An information disclosure vulnerability exists in the TGAInput::read_tga2_header functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: information disclosure, sensitive information
CVE-2023-24474: Experion server may experience a DoS due to a heap overflow which could occur when handling a specially crafted message
Key phrases: dos, heap overflow
CVE-2023-24475: Out of bounds read in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access.
Key phrases: enable information disclosure via local access, out of bounds read
CVE-2023-24476: An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid.
Key phrases: resend requests without the server authenticating that the, local access
CVE-2023-24477: In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.
Key phrases: gain acces to the original user's session
CVE-2023-24478: Use of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux before version 22.4 may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, insufficiently random values
CVE-2023-24479: An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.
Key phrases: authentication bypass, arbitrary command execution, arbitrary commands
CVE-2023-2448: The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to arbitrary shortcode execution. An attacker can leverage CVE-2023-2446 to get sensitive information via shortcode.
Key phrases: missing capability check, unauthorized access, sensitive information
CVE-2023-24480: Controller DoS due to stack overflow when decoding a message from the server
Key phrases: controller dos, stack overflow
CVE-2023-24481: Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2023-24482: A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versions < V10.3.3.2.33), COMOS V10.3.3.3 (All versions < V10.3.3.3.9), COMOS V10.3.3.4 (All versions < V10.3.3.4.6), COMOS V10.4.0.0 (All versions < V10.4.0.0.31), COMOS V10.4.1.0 (All versions < V10.4.1.0.32), COMOS V10.4.2.0 (All versions < V10.4.2.0.25). Cache validation service in COMOS is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition.
Key phrases: execute arbitrary code, execute arbitrary code on the target system or, buffer overflow, denial of service condition
CVE-2023-24483: A vulnerability has been identified that, if exploited, could result in a local user elevating their privilege level to NT AUTHORITY\\SYSTEM on a Citrix Virtual Apps and Desktops Windows VDA.
Key phrases: elevate privileges
CVE-2023-24484: A malicious user can cause log files to be written to a directory that they do not have permission to write to.
Key phrases: file write
CVE-2023-24485: Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app.
Key phrases: perform operations as SYSTEM on the computer running
CVE-2023-24486: A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the Citrix Virtual Apps and Desktops session of another user who is using the same computer from which the ICA session is launched.
Key phrases: gain access
CVE-2023-24487: Arbitrary file read in Citrix ADC and Citrix Gateway?
Key phrases: arbitrary file read
CVE-2023-24488: Cross site scripting vulnerability in Citrix ADC and Citrix Gateway? in allows and attacker to perform cross site scripting
Key phrases: perform cross site scripting, cross-site scripting
CVE-2023-24489: A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
Key phrases: remotely compromise the customer-managed ShareFile storage
CVE-2023-2449: The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_process_form). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-2448 and CVE-2023-2446, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.
Key phrases: unauthorized password resets, sql injection
CVE-2023-24490: Users with only access to launch VDA applications can launch an unauthorized desktop
CVE-2023-24491: A vulnerability has been discovered in the Citrix Secure Access client for Windowswhich, if exploited, could allow an attacker with access to an endpoint with Standard User Account that has the vulnerable client installed to escalate their local privileges to that ofNT AUTHORITY\\\\SYSTEM.
Key phrases: an endpoint with Standard User Account that has