yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-0004: A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges.These files can include logs and system components that impact the integrity and availability of PAN-OS software.
Key phrases: local file deletion, integrity and availability
CVE-2023-0005: A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.
CVE-2023-0006: A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with elevated privileges through a race condition.
Key phrases: local file deletion, race condition
CVE-2023-0007: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrators browser when viewed.
Key phrases: cross-site scripting (xss)
CVE-2023-0008: A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.
Key phrases: file disclosure, race condition
CVE-2023-0009: A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated privileges.
Key phrases: local privilege escalation (pe), elevated privileges, elevate privileges
CVE-2023-0010: A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal users browser when they click on a specifically crafted link.
Key phrases: be executed in the context of an authenticated, reflected cross-site scripting (xss)
CVE-2023-0011: A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial interface to send malicious AT commands.Exploitation of the vulnerability gives full administrative (root) privileges to the attacker to execute any operating system command on TOBY-L2 which can lead to modification of the behavior of the module itself as well as the components connected with it (depending on its rights on other connected systems). It can further provide the ability to read system level files and hamper the availability of the module as well..This issue affects TOBY-L2 series: TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220, TOBY-L280.
Key phrases: execute arbitrary operating system commands, execute arbitrary operating system commands using specifically crafted, at commands, root privilege, availability
CVE-2023-0012: In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SAP_LocaAdmin are denied the ability to logon locally by security policy so that this can only occur if the system has already been compromised.
Key phrases: malicious file, compromised
CVE-2023-0013: The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.
Key phrases: cross-site scripting (xss), limited impact, confidentiality, confidentiality and integrity
CVE-2023-0014: SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system.
Key phrases: obtain illegitimate access, capture-replay
CVE-2023-0015: In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intelligence DHTML may be vulnerable to XSS attacks. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.
Key phrases: xss, limited impact, confidentiality, confidentiality and integrity
CVE-2023-0016: SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection vulnerability and could allow an attacker to access, modify, and/or delete data from the backend database.
Key phrases: execute crafted database queries, access, sql injection, delete data
CVE-2023-0017: An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current system. This could allow the attacker to have full read access to user data, make modifications to user data, and make services within the system unavailable.
Key phrases: have full read access to user data, improper access control, open interface, unavailable
CVE-2023-0018: Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports containing a malicious payload. Once these reports are viewable, anyone who opens those reports would be susceptible to stored XSS attacks. As a result of the attack, information maintained in the victim's web browser can be read, modified, and sent to the attacker.
Key phrases: xss
CVE-2023-0019: In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.
Key phrases: high impact, confidential data, confidentiality
CVE-2023-0020: SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality and limited impact on integrity of the application.
Key phrases: access sensitive information which is otherwise restricted, successful exploitation, high impact on confidentiality, integrity
CVE-2023-0021: Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.
Key phrases: inject code that may expose sensitive data like, reflected cross-site scripting, confidentiality of the application
CVE-2023-0022: SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application causing a high impact on the confidentiality, integrity, and availability of the application.
Key phrases: inject malicious code that can be executed by, exploitation, high impact, confidentiality, confidentiality and integrity, integrity and availability
CVE-2023-0023: In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the application.
CVE-2023-0024: SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources, resulting in Cross-Site Scripting vulnerability.
Key phrases: craft a malicious link, cross-site scripting, sensitive information
CVE-2023-0025: SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources.
Key phrases: craft a malicious link, restrict access to the desired resources, sensitive information
CVE-2023-0026: An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occurs as soon as the update is received. This issue is exploitable remotely as the respective attribute can propagate through unaffected systems and intermediate AS (if any). Continuous receipt of a BGP update containing this attribute will create a sustained Denial of Service (DoS) condition. Some customers have experienced these BGP session flaps which prompted Juniper SIRT to release this advisory out of cycle before fixed releases are widely available as there is an effective workaround.This issue affects:Juniper Networks Junos OS15.1R1 and later versions prior to 20.4R3-S8;21.1 version 21.1R1 and later versions prior to 21.2R3-S6;21.3 versions prior to 21.3R3-S5;21.4 versions prior to 21.4R3-S4;22.1 versions prior to 22.1R3-S4;22.2 versions prior to 22.2R3-S2;22.3 versions prior to 22.3R2-S2, 22.3R3-S1;22.4 versions prior to 22.4R2-S1, 22.4R3;23.1 versions prior to 23.1R1-S1, 23.1R2.Juniper Networks Junos OS EvolvedAll versions prior to 20.4R3-S8-EVO;21.1 version 21.1R1-EVO and later versions prior to 21.2R3-S6-EVO;21.3 versions prior to 21.3R3-S5-EVO;21.4 versions prior to 21.4R3-S4-EVO;22.1 versions prior to 22.1R3-S4-EVO;22.2 versions prior to 22.2R3-S2-EVO;22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;23.1 versions prior to 23.1R1-S1-EVO, 23.1R2-EVO.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), improper input validation, denial of service (dos), exploitable remotely
CVE-2023-0027: Rockwell Automation Modbus TCP Server AOI prior to 2.04.00 is vulnerable to an unauthorized user sending a malformed message that could cause the controller to respond with a copy of the most recent response to the last valid request. If exploited, an unauthorized user could read the connected devices Modbus TCP Server AOI information.
Key phrases: malformed message, exploited
CVE-2023-0028: Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+.
Key phrases: cross-site scripting (xss)
CVE-2023-0029: A vulnerability was found in Multilaser RE708 RE1200R4GC-2T2R-V3_v3411b_MUL029B. It has been rated as problematic. This issue affects some unknown processing of the component Telnet Service. The manipulation leads to denial of service. The attack may be initiated remotely. The identifier VDB-217169 was assigned to this vulnerability.
Key phrases: denial of service
CVE-2023-0030: A use-after-free flaw was found in the Linux kernels nouveau driver in how a user triggers a memory overflow that causes the nvkm_vma_tail function to fail. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Key phrases: crash or potentially escalate their privileges on the, use-after-free flaw, memory overflow, use after free, escalate privilege
CVE-2023-0033: The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2023-0034: The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0035: softbus_client_stub in communication subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay attack".Local attackers can bypass authentication and attack other SAs with high privilege.
Key phrases: bypass authentication, authentication bypass, an "SA relay attack", sa relay
CVE-2023-0036: platform_callback_stub in misc subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay attack".Local attackers can bypass authentication and attack other SAs with high privilege.
Key phrases: bypass authentication, authentication bypass, an "SA relay attack"
CVE-2023-0037: The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Key phrases: sql injection
CVE-2023-0038: The "Survey Maker  Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-0040: Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.
Key phrases: inject new HTTP header fields, crlf injection, data disclosure, logical errors, misbehaviours
CVE-2023-0041: IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration.  IBM X-Force ID:  243657.
Key phrases: take over another user's session due to, insufficient session expiration
CVE-2023-0042: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols.
Key phrases: arbitrary protocols
CVE-2023-0043: The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Key phrases: reflected cross-site scripting
CVE-2023-0044: If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
Key phrases: cross-site, information disclosure
CVE-2023-0045: The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176.We recommend upgrading past commita664ec9158eeddd75121d39c9a0758016097fa96
CVE-2023-0046: Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.
CVE-2023-0048: Code Injection in GitHub repository lirantal/daloradius prior to master-branch.
Key phrases: code injection
CVE-2023-0049: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
Key phrases: out-of-bounds read
CVE-2023-0050: An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.
Key phrases: perform arbitrary actions, perform arbitrary actions on behalf of victims, kroki diagram, xss
CVE-2023-0051: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
Key phrases: heap-based buffer overflow
CVE-2023-0052: SAUTER Controls Nova 200220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol (FTP) are the only protocols available for device management, an unauthorized user could access the system and modify the device configuration, which could result in the unauthorized user executing unrestricted malicious commands.
Key phrases: the execution of commands without credentials
CVE-2023-0053: SAUTER Controls Nova 200220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive information such as user credentials to gain access to the system. 
Key phrases: obtain sensitive information, gain access, cleartext
CVE-2023-0054: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
Key phrases: out-of-bounds write
CVE-2023-0055: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.
Key phrases: sensitive cookie
CVE-2023-0056: An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.
Key phrases: run a specially crafted malicious server in an, resource consumption, availability, crash
CVE-2023-0057: Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
Key phrases: improper restriction of rendered ui layers or frames
CVE-2023-0058: The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Key phrases: make logged in admin add Stored XSS payloads, csrf check, stored xss payloads
CVE-2023-0059: The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0060: The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0061: The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0062: The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0063: The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0064: The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0065: The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0066: The Companion Sitemap Generator WordPress plugin through 4.5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0067: The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0068: The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0069: The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0070: The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0071: The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0072: The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0073: The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0074: The WP Social Widget WordPress plugin before 2.2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0075: The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0076: The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0077: Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to overflow buffers via unspecified vectors.
Key phrases: overflow buffers via unspecified vectors, integer overflow or wraparound
CVE-2023-0078: The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users with a role as low as subscriber to perform Stored XSS attacks against higher privilege users
Key phrases: perform Stored XSS attacks against higher privilege users, stored xss
CVE-2023-0079: The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0080: The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
Key phrases: include arbitrary files, include arbitrary files via a traversal attack, read non PHP files and retrieve their content, rce
CVE-2023-0081: The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0082: The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0083: The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions, OpenHarmony-v3.0.7 and prior versionshas an Improper Input Validation vulnerability which local attackers can exploit this vulnerability to send malicious data, causing the current application to crash.
Key phrases: improper input validation, malicious data, crash, application crash
CVE-2023-0084: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-0085: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.
Key phrases: Bypass in versions up to, bypass Captcha restrictions, reCaptcha Bypass, recaptcha bypass, bots
CVE-2023-0086: The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.  This can be used to enable SVG uploads that could make Cross-Site Scripting possible.
Key phrases: cross-site request forgery, cross-site scripting
CVE-2023-0087: The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spm_plugin_options_page_tree_max_width parameter in versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-0088: The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other things. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-0089: The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'.This affects all versions 8.20.0 and below. 
Key phrases: execute remote code through 'eval injection', versions and below
CVE-2023-0090: The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'.  Exploitation requires network access to the webservices API, but such access is a non-standard configuration.  This affects all versions 8.20.0 and below.
Key phrases: execute remote code through 'eval injection', versions and below
CVE-2023-0091: A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.
Key phrases: access or modify potentially sensitive information
CVE-2023-0093: Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment.
Key phrases: command injection, phish
CVE-2023-0094: The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0095: The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0096: The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0097: The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-0098: The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
Key phrases: sql injection
CVE-2023-0099: The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Key phrases: reflected cross-site scripting
CVE-2023-0100: In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.
Key phrases: host header
CVE-2023-0101: A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potentially execute a specially crafted file to obtain root or NT AUTHORITY / SYSTEM privileges on the Nessus host.
Key phrases: obtain root or NT AUTHORITY / SYSTEM privileges, privilege escalation
CVE-2023-0102: LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files.
Key phrases: delete arbitrary files, authentication, missing authentication
CVE-2023-0103: If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communication buffer, the device stops operating. This could allow an attacker to cause a denial-of-service condition.
Key phrases: cause a denial-of-service condition, memory locations, communication buffer, denial of service
CVE-2023-0104: The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the users computer or gain access to sensitive data.  
Key phrases: gain control, gain access, gain control of the users computer or gain, zipslip, sensitive data
CVE-2023-0105: A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.
Key phrases: the email trust not being handled correctly in, impersonate
CVE-2023-0106: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Key phrases: cross-site scripting (xss)
CVE-2023-0107: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Key phrases: cross-site scripting (xss)
CVE-2023-0108: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Key phrases: cross-site scripting (xss)
CVE-2023-0110: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Key phrases: cross-site scripting (xss)
CVE-2023-0111: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Key phrases: cross-site scripting (xss)
CVE-2023-0112: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Key phrases: cross-site scripting (xss)
CVE-2023-0113: A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-217591.
Key phrases: information disclosure
CVE-2023-0114: A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to cleartext storage in a file or on disk. Local access is required to approach this attack. The identifier of this vulnerability is VDB-217592.
Key phrases: cleartext storage
CVE-2023-0116: The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability.
Key phrases: availability
CVE-2023-0117: The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this vulnerability may affect availability of features,such as MeeTime.
Key phrases: availability of features
CVE-2023-0118: An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.
Key phrases: execute arbitrary code, bypass safe mode in templates and execute arbitrary code, arbitrary code execution flaw
CVE-2023-0119: A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials.
Key phrases: obtain user credentials, cross-site scripting
CVE-2023-0120: An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user.
Key phrases: improper permission validation, improper permissions
CVE-2023-0121: A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.
Key phrases: cause high resource consumption using malicious test report, denial of service issue, malicious test report artifacts
CVE-2023-0122: A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4.
Key phrases: Denial of Service (DoS), perform a Pre-Auth Denial of Service, null pointer dereference, pre-auth denial of service (dos)
CVE-2023-0123: Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.
Key phrases: execute arbitrary code, remotely execute arbitrary code when a malformed file, stack-based buffer overflow, stack based buffer overflow
CVE-2023-0124: Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to an out-of-bounds write, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.
Key phrases: execute arbitrary code, remotely execute arbitrary code when a malformed file, out-of-bounds write, out of bounds write
CVE-2023-0125: A vulnerability was found in Control iD Gerencia Web 1.30. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation of the argument Nome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217717 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-0126: Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.
Key phrases: access arbitrary files, access arbitrary files and directories stored outside the, pre-authentication path traversal
CVE-2023-0127: A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.
Key phrases: execute arbitrary commands, execute arbitrary commands as root, command injection
CVE-2023-0128: Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: use after free, heap corruption, convince
CVE-2023-0129: Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and specific interactions. (Chromium security severity: High)
Key phrases: heap buffer overflow, heap corruption, convince
CVE-2023-0130: Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: inappropriate implementation, spoofing
CVE-2023-0131: Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: bypass file download restrictions, inappropriate implementation
CVE-2023-0132: Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: inappropriate implementation
CVE-2023-0133: Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to bypass main origin permission delegation via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: bypass main origin permission, inappropriate implementation
CVE-2023-0134: Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. (Chromium security severity: Medium)
Key phrases: use after free, heap corruption, database corruption, convince
CVE-2023-0135: Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. (Chromium security severity: Medium)
Key phrases: use after free, heap corruption, database corruption, convince
CVE-2023-0136: Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to execute incorrect security UI via a crafted HTML page. (Chromium security severity: Medium)