yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-32863: In display drm, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07326314; Issue ID: ALPS07326314.
Key phrases: out of bounds read, missing bounds check, escalation privilege
CVE-2023-32864: In display drm, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07292187; Issue ID: ALPS07292187.
Key phrases: out of bounds write, incorrect bounds check, local escalation of privilege, escalation privilege
CVE-2023-32865: In display drm, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363456; Issue ID: ALPS07363456.
Key phrases: out of bounds write, incorrect bounds check, escalation privilege
CVE-2023-32866: In mmp, there is a possible memory corruption due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07342152; Issue ID: ALPS07342152.
Key phrases: memory corruption, local escalation of privilege, escalation privilege
CVE-2023-32867: In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07560793; Issue ID: ALPS07560793.
Key phrases: out of bounds write, missing bounds check, escalation privilege
CVE-2023-32868: In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363632; Issue ID: ALPS07363632.
Key phrases: out of bounds write, missing bounds check, escalation privilege
CVE-2023-32869: In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363632; Issue ID: ALPS07363689.
Key phrases: out of bounds write, missing bounds check, escalation privilege
CVE-2023-32870: In display drm, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363740; Issue ID: ALPS07363740.
Key phrases: out of bounds read, missing bounds check, local escalation of privilege, escalation privilege
CVE-2023-32872: In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308607; Issue ID: ALPS08308607.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2023-32874: In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161803; Issue ID: MOLY01161803 (MSV-893).
Key phrases: out of bounds write, missing bounds check, remote code execution
CVE-2023-32875: In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308607; Issue ID: ALPS08304217.
Key phrases: information disclosure
CVE-2023-32876: In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308612; Issue ID: ALPS08308612.
Key phrases: information disclosure
CVE-2023-32877: In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08308070.
Key phrases: out of bounds write, missing bounds check, escalation privilege
CVE-2023-32878: In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08307992.
Key phrases: information disclosure
CVE-2023-32879: In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08308064.
Key phrases: out of bounds write, missing bounds check, escalation privilege
CVE-2023-32880: In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08308076.
Key phrases: information disclosure
CVE-2023-32881: In battery, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08308080.
Key phrases: information disclosure, integer overflow
CVE-2023-32882: In battery, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08308616.
Key phrases: memory corruption, local escalation of privilege, escalation privilege
CVE-2023-32883: In Engineer Mode, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08282249; Issue ID: ALPS08282249.
Key phrases: out of bounds write, missing bounds check, escalation privilege
CVE-2023-32884: In netdagent, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07944011; Issue ID: ALPS07944011.
Key phrases: information disclosure, local escalation of privilege, escalation privilege
CVE-2023-32885: In display drm, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07780685; Issue ID: ALPS07780685.
Key phrases: memory corruption, local escalation of privilege, escalation privilege
CVE-2023-32886: In Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00730807; Issue ID: MOLY00730807.
Key phrases: out of bounds write, missing bounds check, remote denial of service
CVE-2023-32887: In Modem IMS Stack, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161837; Issue ID: MOLY01161837 (MSV-892).
Key phrases: missing bounds check, remote denial of service, crash
CVE-2023-32888: In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161830; Issue ID: MOLY01161830 (MSV-894).
Key phrases: out of bounds write, missing bounds check, remote denial of service
CVE-2023-32889: In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161825; Issue ID: MOLY01161825 (MSV-895).
Key phrases: out of bounds write, missing bounds check, remote denial of service
CVE-2023-32890: In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01183647; Issue ID: MOLY01183647 (MSV-963).
Key phrases: improper input validation, remote denial of service, crash
CVE-2023-32891: In bluetooth service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07933038; Issue ID: MSV-559.
Key phrases: out of bounds write, improper input validation, local escalation of privilege, escalation privilege
CVE-2023-3291: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.
Key phrases: heap-based buffer overflow
CVE-2023-3292: The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Key phrases: reflected cross-site scripting
CVE-2023-3293: Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.
Key phrases: cross-site scripting (xss)
CVE-2023-3294: Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.
Key phrases: cross-site scripting (xss)
CVE-2023-3295: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes it possible for authenticated attackers, with contributor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The issue was partially patched in version 1.5.66 and fully patched in 1.5.67
Key phrases: upload arbitrary files, arbitrary file uploads, remote code execution
CVE-2023-32955: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows man-in-the-middle attackers to execute arbitrary commands via unspecified vectors.
Key phrases: execute arbitrary commands, execute arbitrary commands via unspecified vectors, os command injection, man in the middle
CVE-2023-32956: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to execute arbitrary code via unspecified vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, os command injection
CVE-2023-32957: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dazzlersoft Team Members Showcase plugin <=1.3.4 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32958: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nose Graze Novelist plugin <=1.2.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32960: Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <=1.23.3 versions leads to sitewide Cross-Site Scripting (XSS).
Key phrases: cross-site request forgery (csrf), sitewide cross-site scripting (xss)
CVE-2023-32961: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <=7.3.3 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-32962: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in HasTheme WishSuite  Wishlist for WooCommerce plugin <=1.3.4 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32964: Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <=1.9.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-32965: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CRUDLab Jazz Popups plugin <=1.8.7 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-32966: Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab Jazz Popups leads to Stored XSS.This issue affects Jazz Popups: from n/a through 1.8.7.
Key phrases: cross-site request forgery (csrf), stored xss
CVE-2023-32967: An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.QTS 5.x, QuTS hero are not affected.We have already fixed the vulnerability in the following versions:QuTScloud c5.1.5.2651 and laterQTS 4.5.4.2627 build 20231225 and later
Key phrases: bypass intended access restrictions, bypass intended access restrictions via a network, incorrect authorization
CVE-2023-32968: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2514 build 20230906 and laterQTS 5.1.2.2533 build 20230926 and laterQuTS hero h5.0.1.2515 build 20230907 and laterQuTS hero h5.1.2.2534 build 20230927 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-32969: A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network.We have already fixed the vulnerability in the following versions:QuTScloud c5.1.5.2651 and laterQTS 5.1.4.2596 build 20231128 and laterQuTS hero h5.1.4.2596 build 20231128 and later
Key phrases: inject malicious code via a network, cross-site scripting (xss)
CVE-2023-3297: In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.
Key phrases: use-after-free, use after free
CVE-2023-32970: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.QES is not affected.We have already fixed the vulnerability in the following versions:QuTS hero h5.0.1.2515 build 20230907 and laterQuTS hero h5.1.0.2453 build 20230708 and laterQuTS hero h4.5.4.2476 build 20230728 and laterQuTScloud c5.1.0.2498 and laterQTS 5.1.0.2444 build 20230629 and laterQTS 4.5.4.2467 build 20230718 and later
Key phrases: launch a denial-of-service (, null pointer dereference, denial-of-service (dos), denial of service
CVE-2023-32971: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2425 build 20230609 and laterQTS 5.1.0.2444 build 20230629 and laterQTS 4.5.4.2467 build 20230718 and laterQuTS hero h5.0.1.2515 build 20230907 and laterQuTS hero h5.1.0.2424 build 20230609 and laterQuTS hero h4.5.4.2476 build 20230728 and laterQuTScloud c5.1.0.2498 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-32972: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2425 build 20230609 and laterQTS 5.1.0.2444 build 20230629 and laterQTS 4.5.4.2467 build 20230718 and laterQuTS hero h5.0.1.2515 build 20230907 and laterQuTS hero h5.1.0.2424 build 20230609 and laterQuTS hero h4.5.4.2476 build 20230728 and laterQuTScloud c5.1.0.2498 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-32973: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2425 build 20230609 and laterQTS 5.1.0.2444 build 20230629 and laterQTS 4.5.4.2467 build 20230718 and laterQuTS hero h5.0.1.2515 build 20230907 and laterQuTS hero h5.1.0.2424 build 20230609 and laterQuTS hero h4.5.4.2476 build 20230728 and laterQuTScloud c5.1.0.2498 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-32974: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.0.2444 build 20230629 and laterQuTS hero h5.1.0.2424 build 20230609 and laterQuTScloud c5.1.0.2498 and later
Key phrases: read the contents of unexpected files and expose, path traversal
CVE-2023-32975: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2514 build 20230906 and laterQTS 5.1.2.2533 build 20230926 and laterQuTS hero h5.0.1.2515 build 20230907 and laterQuTS hero h5.1.2.2534 build 20230927 and later
Key phrases: execute code via a network, buffer copy without checking size of input
CVE-2023-32976: An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.We have already fixed the vulnerability in the following version:Container Station 2.6.7.44 and later
Key phrases: execute commands via a network, os command injection
CVE-2023-32977: Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32978: A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
Key phrases: connect to an attacker-specified LDAP server, cross-site request forgery (csrf), cross site request forgery
CVE-2023-32979: Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.
Key phrases: check for the existence of files in the
CVE-2023-32980: A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.
Key phrases: make another user stop watching an attacker-, cross-site request forgery (csrf), cross site request forgery
CVE-2023-32981: An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.
Key phrases: replace arbitrary files, provide crafted archives as parameters to create or, arbitrary file write
CVE-2023-32982: Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Key phrases: unencrypted
CVE-2023-32983: Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers to observe and capture them.
Key phrases: extra variables
CVE-2023-32984: Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin's test information pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file.
Key phrases: stored cross-site scripting (xss)
CVE-2023-32985: Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Key phrases: check for the existence of an attacker-, attacker-specified file path
CVE-2023-32986: Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.
Key phrases: replace arbitrary files, create or replace arbitrary files on the Jenkins
CVE-2023-32987: A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
Key phrases: connect to an attacker-specified LDAP server, cross-site request forgery (csrf), cross site request forgery
CVE-2023-32988: A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Key phrases: enumerate credentials IDs of credentials stored in Jenkins, missing permission check
CVE-2023-32989: A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.
Key phrases: connect to an attacker-specified Azure Cloud, cross-site request forgery (csrf), cross site request forgery
CVE-2023-3299: HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.
Key phrases: block without a label, unexpected results
CVE-2023-32990: A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.
Key phrases: connect to an attacker-specified Azure Cloud
CVE-2023-32991: A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
Key phrases: send an HTTP request to an attacker-, cross-site request forgery (csrf), cross site request forgery
CVE-2023-32992: Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
Key phrases: send an HTTP request to an attacker-, missing permission checks
CVE-2023-32993: Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
Key phrases: hostname validation, man-in-the-middle, man in the middle
CVE-2023-32994: Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
Key phrases: man in the middle
CVE-2023-32995: A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.
Key phrases: send an HTTP POST request with JSON body, cross-site request forgery (csrf), cross site request forgery
CVE-2023-32996: A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.
Key phrases: send an HTTP POST request with JSON body, permission check
CVE-2023-32997: Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.
CVE-2023-32998: A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
Key phrases: connect to an attacker-specified URL and, cross-site request forgery (csrf), cross site request forgery
CVE-2023-32999: A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
Key phrases: connect to an attacker-specified URL and, permission check
CVE-2023-3300: HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
Key phrases: http search api
CVE-2023-33000: Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them.
Key phrases: credentials
CVE-2023-33001: Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVE-2023-33002: Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Key phrases: stored cross-site scripting (xss)
CVE-2023-33003: A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics.
Key phrases: reset profiler statistics, cross-site request forgery (csrf), cross site request forgery
CVE-2023-33004: A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics.
Key phrases: reset profiler statistics, permission check
CVE-2023-33005: Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.
CVE-2023-33006: A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker's account.
Key phrases: trick users into logging in to the attacker, cross-site request forgery (csrf), cross site request forgery
CVE-2023-33007: Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Key phrases: stored cross-site scripting (xss)
CVE-2023-33008: Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon.A malicious attacker can craft up some JSON input that uses large numbers (numbers such as1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. This issue affects Apache Johnzon: through 1.2.20.
Key phrases: deserialization of untrusted data, denial of service risk
CVE-2023-33009: A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
Key phrases: cause denial-of-service (DoS, buffer overflow, denial-of-service (dos) conditions, remote code execution, denial of service
CVE-2023-3301: A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service.
Key phrases: race scenario, denial of service
CVE-2023-33010: A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
Key phrases: cause denial-of-service (DoS, buffer overflow, denial-of-service (dos) conditions, remote code execution, denial of service
CVE-2023-33011: A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled.
Key phrases: execute some OS commands by using a crafted, format string
CVE-2023-33012: A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2,could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled.
Key phrases: execute some OS commands by using a crafted, command injection
CVE-2023-33013: A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.
Key phrases: execute some OS commands remotely by sending a, post-authentication command injection
CVE-2023-33014: Information disclosure in Core services while processing a Diag command.
Key phrases: information disclosure
CVE-2023-33015: Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Key phrases: transient dos
CVE-2023-33016: Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
Key phrases: transient dos
CVE-2023-33017: Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
Key phrases: memory corruption
CVE-2023-33018: Memory corruption while using the UIM diag command to get the operators name.
Key phrases: memory corruption
CVE-2023-33019: Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
Key phrases: transient dos, invalid channel
CVE-2023-3302: Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.
Key phrases: improper neutralization of formula elements
CVE-2023-33020: Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.
Key phrases: transient dos, invalid channel
CVE-2023-33021: Memory corruption in Graphics while processing user packets for command submission.
Key phrases: memory corruption
CVE-2023-33022: Memory corruption in HLOS while invoking IOCTL calls from user-space.
Key phrases: memory corruption
CVE-2023-33023: Memory corruption while processing finish_sign command to pass a rsp buffer.
Key phrases: memory corruption
CVE-2023-33024: Memory corruption while sending SMS from AP firmware.
Key phrases: memory corruption
CVE-2023-33025: Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.
Key phrases: memory corruption
CVE-2023-33026: Transient DOS in WLAN Firmware while parsing a NAN management frame.
Key phrases: transient dos
CVE-2023-33027: Transient DOS in WLAN Firmware while parsing rsn ies.
Key phrases: transient dos, rsn ies
CVE-2023-33028: Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
Key phrases: memory corruption
CVE-2023-33029: Memory corruption in DSP Service during a remote call from HLOS to DSP.
Key phrases: memory corruption
CVE-2023-3303: Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
Key phrases: improper access control
CVE-2023-33030: Memory corruption in HLOS while running playready use-case.
Key phrases: memory corruption
CVE-2023-33031: Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
Key phrases: memory corruption
CVE-2023-33032: Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
Key phrases: memory corruption
CVE-2023-33033: Memory corruption in Audio during playback with speaker protection.
Key phrases: memory corruption
CVE-2023-33034: Memory corruption while parsing the ADSP response command.
Key phrases: memory corruption
CVE-2023-33035: Memory corruption while invoking callback function of AFE from ADSP.
Key phrases: memory corruption
CVE-2023-33036: Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.
Key phrases: permanent dos
CVE-2023-33037: Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.
Key phrases: cryptographic issue
CVE-2023-33038: Memory corruption while receiving a message in Bus Socket Transport Server.
Key phrases: memory corruption
CVE-2023-33039: Memory corruption in Automotive Display while destroying the image handle created using connected display driver.
Key phrases: memory corruption, destroying
CVE-2023-3304: Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
Key phrases: improper access control
CVE-2023-33040: Transient DOS in Data Modem during DTLS handshake.
Key phrases: transient dos
CVE-2023-33041: Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
Key phrases: state confusion
CVE-2023-33042: Transient DOS in Modem after RRC Setup message is received.
Key phrases: transient dos
CVE-2023-33043: Transient DOS in Modem when a Beam switch request is made with a non-configured BWP.
Key phrases: non-configured bwp
CVE-2023-33044: Transient DOS in Data modem while handling TLB control messages from the Network.
Key phrases: transient dos
CVE-2023-33045: Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
Key phrases: memory corruption
CVE-2023-33046: Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
Key phrases: memory corruption
CVE-2023-33047: Transient DOS in WLAN Firmware while parsing no-inherit IES.
Key phrases: transient dos, no-inherit ies
CVE-2023-33048: Transient DOS in WLAN Firmware while parsing t2lm buffers.
Key phrases: transient dos
CVE-2023-33049: Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.
Key phrases: heap leakage
CVE-2023-3305: A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=config_save&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231801 was assigned to this vulnerability.
Key phrases: improper access control
CVE-2023-33053: Memory corruption in Kernel while parsing metadata.
Key phrases: memory corruption
CVE-2023-33054: Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.
Key phrases: cryptographic issue
CVE-2023-33055: Memory Corruption in Audio while invoking callback function in driver from ADSP.
Key phrases: memory corruption
CVE-2023-33056: Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
Key phrases: transient dos
CVE-2023-33057: Transient DOS in Multi-Mode Call Processor while processing UE policy container.
Key phrases: transient dos
CVE-2023-33058: Information disclosure in Modem while processing SIB5.
Key phrases: information disclosure
CVE-2023-33059: Memory corruption in Audio while processing the VOC packet data from ADSP.
Key phrases: memory corruption
CVE-2023-3306: A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. It has been declared as critical. This vulnerability affects unknown code of the file app.09df2a9e44ab48766f5f.js of the component Admin Password Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-231802 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: improper access control, disclosure
CVE-2023-33060: Transient DOS in Core when DDR memory check is called while DDR is not initialized.
Key phrases: transient dos
CVE-2023-33061: Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
Key phrases: transient dos
CVE-2023-33062: Transient DOS in WLAN Firmware while parsing a BTM request.
Key phrases: transient dos
CVE-2023-33063: Memory corruption in DSP Services during a remote call from HLOS to DSP.
Key phrases: memory corruption
CVE-2023-33064: Transient DOS in Audio when invoking callback function of ASM driver.
Key phrases: transient dos
CVE-2023-33065: Information disclosure in Audio while accessing AVCS services from ADSP payload.
Key phrases: information disclosure
CVE-2023-33066: Memory corruption in Audio while processing RT proxy port register driver.
Key phrases: memory corruption
CVE-2023-33067: Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Key phrases: memory corruption
CVE-2023-33068: Memory corruption in Audio while processing IIR config data from AFE calibration block.
Key phrases: memory corruption
CVE-2023-33069: Memory corruption in Audio while processing the calibration data returned from ACDB loader.
Key phrases: memory corruption
CVE-2023-3307: A vulnerability was found in miniCal 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /booking/show_bookings/. The manipulation of the argument search_query leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231803. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: sql injection, disclosure
CVE-2023-33070: Transient DOS in Automotive OS due to improper authentication to the secure IO calls.
Key phrases: improper authentication
CVE-2023-33071: Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities.
Key phrases: memory corruption
CVE-2023-33072: Memory corruption in Core while processing control functions.
Key phrases: memory corruption
CVE-2023-33074: Memory corruption in Audio when SSR event is triggered after music playback is stopped.
Key phrases: memory corruption
CVE-2023-33076: Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
Key phrases: memory corruption
CVE-2023-33077: Memory corruption in HLOS while converting from authorization token to HIDL vector.
Key phrases: memory corruption
CVE-2023-33078: Information Disclosure while processing IOCTL request in FastRPC.
Key phrases: information disclosure
CVE-2023-33079: Memory corruption in Audio while running invalid audio recording from ADSP.
Key phrases: memory corruption
CVE-2023-3308: A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8. Affected is an unknown function of the component Aviator Template Engine. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231804.
CVE-2023-33080: Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Key phrases: transient dos, vender specific ie (information element)
CVE-2023-33081: Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
Key phrases: transient dos
CVE-2023-33082: Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
Key phrases: memory corruption
CVE-2023-33083: Memory corruption in WLAN Host while processing RRM beacon on the AP.
Key phrases: memory corruption
CVE-2023-33084: Transient DOS while processing IE fragments from server during DTLS handshake.
Key phrases: transient dos, ie fragments
CVE-2023-33085: Memory corruption in wearables while processing data from AON.
Key phrases: memory corruption
CVE-2023-33086: Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.
Key phrases: transient dos, informational request
CVE-2023-33087: Memory corruption in Core while processing RX intent request.
Key phrases: memory corruption
CVE-2023-33088: Memory corruption when processing cmd parameters while parsing vdev.
Key phrases: memory corruption
CVE-2023-33089: Transient DOS when processing a NULL buffer while parsing WLAN vdev.
Key phrases: transient dos, null buffer
CVE-2023-3309: A vulnerability classified as problematic was found in SourceCodester Resort Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file ?page=rooms of the component Manage Room Page. The manipulation of the argument Cottage Number leads to cross site scripting. The attack can be launched remotely. The identifier VDB-231805 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-33090: Transient DOS while processing channel information for speaker protection v2 module in ADSP.
Key phrases: transient dos
CVE-2023-33092: Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.
Key phrases: memory corruption
CVE-2023-33094: Memory corruption while running VK synchronization with KASAN enabled.
Key phrases: memory corruption
CVE-2023-33095: Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
Key phrases: transient dos, incorrect container length
CVE-2023-33096: Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.
Key phrases: transient dos
CVE-2023-33097: Transient DOS in WLAN Firmware while processing a FTMR frame.
Key phrases: transient dos
CVE-2023-33098: Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
Key phrases: transient dos, wpa ies
CVE-2023-33099: Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.
Key phrases: transient dos, non-standard size
CVE-2023-3310: A vulnerability, which was classified as critical, has been found in code-projects Agro-School Management System 1.0. Affected by this issue is some unknown functionality of the file loaddata.php. The manipulation of the argument subject/course leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231806 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-33100: Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification.
Key phrases: transient dos
CVE-2023-33101: Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
Key phrases: transient dos, payload length 0
CVE-2023-33103: Transient DOS while processing CAG info IE received from NW.
Key phrases: transient dos
CVE-2023-33104: Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
Key phrases: transient dos
CVE-2023-33105: Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
Key phrases: transient dos, open authentication frames, invalid transaction sequence number
CVE-2023-33106: Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
Key phrases: memory corruption
CVE-2023-33107: Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Key phrases: memory corruption
CVE-2023-33108: Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.
Key phrases: memory corruption