yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-30646: Heap out of bound write vulnerability in BroadcastSmsConfig of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, heap out of bound write
CVE-2023-30647: Heap out of bound write vulnerability in IpcRxUsimPhoneBookCapa of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, heap out of bound write
CVE-2023-30648: Stack out-of-bounds write vulnerability in IpcRxImeiUpdateImeiNoti of RILD priro to SMR Jul-2023 Release 1 cause a denial of service on the system.
Key phrases: stack out-of-bounds write, denial of service, out of bounds write
CVE-2023-30649: Heap out of bound write vulnerability in RmtUimNeedApdu of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, heap out of bound write
CVE-2023-3065: Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT100 through 1.3.20.
Key phrases: Authentication Bypass, improper authentication, authentication bypass
CVE-2023-30650: Out of bounds read and write in callrunTspCmd of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local attackers to execute arbitrary code.
Key phrases: execute arbitrary code, out of bounds read and write
CVE-2023-30651: Out of bounds read and write in callgetTspsysfs of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local attackers to execute arbitrary code.
Key phrases: execute arbitrary code, out of bounds read and write
CVE-2023-30652: Out of bounds read and write in callrunTspCmdNoRead of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local attackers to execute arbitrary code.
Key phrases: execute arbitrary code, out of bounds read and write
CVE-2023-30653: Out of bounds read and write in enableTspDevice of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local attackers to execute arbitrary code.
Key phrases: execute arbitrary code, out of bounds read and write
CVE-2023-30654: Improper access control vulnerability in SLocationService prior to SMR Aug-2023 Release 1 allows local attacker to update fake location.
Key phrases: update fake location, improper access control
CVE-2023-30655: Improper input validation vulnerability in SCEPProfile prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities.
Key phrases: launch privileged activities, improper input validation
CVE-2023-30656: Improper input validation vulnerability in LSOItemData prior to SMR Jul-2023 Release 1 allows attackers to launch certain activities.
Key phrases: launch certain activities, improper input validation
CVE-2023-30657: Improper input validation vulnerability in EnhancedAttestationResult prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities.
Key phrases: launch privileged activities, improper input validation
CVE-2023-30658: Improper input validation vulnerability in DataProfile prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities.
Key phrases: launch privileged activities, improper input validation
CVE-2023-30659: Improper input validation vulnerability in Transaction prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities.
Key phrases: launch privileged activities, improper input validation
CVE-2023-3066: Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20.
Key phrases: impersonate anyone else, incorrect authorization
CVE-2023-30660: Exposure of Sensitive Information vulnerability in getDefaultChipId in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset Identifier.
Key phrases: access the UWB chipset Identifier, exposure of sensitive information
CVE-2023-30661: Exposure of Sensitive Information vulnerability in getChipInfos in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset Identifier.
Key phrases: access the UWB chipset Identifier, exposure of sensitive information
CVE-2023-30662: Exposure of Sensitive Information vulnerability in getChipIds in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset Identifier.
Key phrases: access the UWB chipset Identifier, exposure of sensitive information
CVE-2023-30663: Improper input validation vulnerability in OemPersonalizationSetLock in libsec-ril prior to SMR Jul-2023 Release 1 allows local attackers to cause an Out-Of-Bounds write.
Key phrases: cause an Out-Of-Bounds write, improper input validation, out-of-bounds write
CVE-2023-30664: Improper input validation vulnerability in RegisteredMSISDN prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities.
Key phrases: launch privileged activities, improper input validation
CVE-2023-30665: Improper input validation vulnerability in OnOemServiceMode in libsec-ril prior to SMR Jul-2023 Release 1 allows local attackers to cause an Out-Of-Bounds read.
Key phrases: cause an Out-Of-Bounds read, improper input validation, out-of-bounds read
CVE-2023-30666: Improper input validation vulnerability in DoOemImeiSetPreconfig in libsec-ril prior to SMR Jul-2023 Release 1 allows local attackers to cause an Out-Of-Bounds write.
Key phrases: cause an Out-Of-Bounds write, improper input validation, out-of-bounds write
CVE-2023-30667: Improper access control in Audio system service prior to SMR Jul-2023 Release 1 allows attacker to send broadcast with system privilege.
Key phrases: send broadcast with system privilege, improper access control
CVE-2023-30668: Out-of-bounds Write in BuildOemSecureSimLockResponse of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write
CVE-2023-30669: Out-of-bounds Write in DoOemFactorySendFactoryTestResult of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2023-3067: Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.
Key phrases: cross-site scripting (xss)
CVE-2023-30670: Out-of-bounds Write in BuildIpcFactoryDeviceTestEvent of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2023-30671: Logic error in package installation via adb command prior to SMR Jul-2023 Release 1 allows local attackers to downgrade installed application.
Key phrases: downgrade installed application, logic error
CVE-2023-30672: Improper privilege management vulnerability in Samsung Smart Switch for Windows Installer prior to version 4.3.23043_3 allows attackers to cause permanent DoS via directory junction.
Key phrases: cause permanent DoS via directory junction, improper privilege management, permanent dos
CVE-2023-30673: Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.23052_1 allows local attackers to delete arbitrary directory using directory junction.
Key phrases: delete arbitrary directory, delete arbitrary directory using directory junction, improper validation of integrity check
CVE-2023-30674: Improper configuration in Samsung Internet prior to version 21.0.0.41 allows attacker to bypass SameSite Cookie.
Key phrases: bypass SameSite Cookie, improper configuration
CVE-2023-30675: Improper authentication in Samsung Pass prior to version 4.2.03.1 allows local attacker to access stored account information when Samsung Wallet is not installed.
Key phrases: access stored account information when Samsung Wallet is, improper authentication
CVE-2023-30676: Improper access control vulnerability in Samsung Pass prior to version 4.2.03.1 allows physical attackers to access data of Samsung Pass.
Key phrases: access data of Samsung Pass, improper access control
CVE-2023-30677: Improper access control vulnerability in Samsung Pass prior to version 4.2.03.1 allows physical attackers to access data of Samsung Pass on a certain state of an unlocked device.
Key phrases: access data of Samsung Pass on a certain, improper access control
CVE-2023-30678: Potential zip path traversal vulnerability in Calendar application prior to version 12.4.07.15 in Android 13 allows attackers to write arbitrary file.
Key phrases: write arbitrary file, potential zip path traversal
CVE-2023-30679: Improper access control in HDCP trustlet prior to SMR Aug-2023 Release 1 allows local attackers to execute arbitrary code.
Key phrases: execute arbitrary code, improper access control
CVE-2023-3068: A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/modal_add_product.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230580.
Key phrases: sql injection
CVE-2023-30680: Improper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with privilege.
Key phrases: code execution with privilege, improper privilege management
CVE-2023-30681: An improper input validation vulnerability within initialize function in HAL VaultKeeper prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds write.
Key phrases: cause out-of-bounds write, input validation, improper input validation, out of bounds write
CVE-2023-30682: Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call silenceRinger API without permission.
Key phrases: call silenceRinger API without permission, improper access control
CVE-2023-30683: Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call endCall API without permission.
Key phrases: call endCall API without permission, improper access control
CVE-2023-30684: Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRingingCall API without permission.
Key phrases: call acceptRingingCall API without permission, improper access control
CVE-2023-30685: Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakcers to change TTY mode.
Key phrases: change TTY mode, improper access control
CVE-2023-30686: Out-of-bounds Write in ReqDataRaw of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write
CVE-2023-30687: Out-of-bounds Write in RmtUimApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write
CVE-2023-30688: Out-of-bounds Write in MakeUiccAuthForOem of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2023-30689: Out-of-bounds Write in BuildOemEmbmsGetSigStrengthResponse of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2023-3069: Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.
Key phrases: unverified password change
CVE-2023-30690: Improper input validation vulnerability in Duo prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities.
Key phrases: launch privileged activities, improper input validation
CVE-2023-30691: Parcel mismatch in AuthenticationConfig prior to SMR Aug-2023 Release 1 allows local attacker to privilege escalation.
Key phrases: privilege escalation, parcel mismatch
CVE-2023-30692: Improper input validation vulnerability in Evaluator prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities.
Key phrases: launch privileged activities, improper input validation
CVE-2023-30693: Out-of-bounds Write in DoOemFactorySendFactoryBypassCommand of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write
CVE-2023-30694: Out-of-bounds Write in IpcTxPcscTransmitApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write
CVE-2023-30695: Out-of-bounds Write vulnerability in SSHDCPAPP TA prior to &quot;SAMSUNG ELECTONICS, CO, LTD. - System Hardware Update - 7/13/2023&quot; in Windows Update for Galaxy book Go, Galaxy book Go 5G, Galaxy book2 Go and Galaxy book2 Pro 360 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2023-30696: An improper input validation in IpcTxGetVerifyAkey in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds write.
Key phrases: cause out-of-bounds write, improper input validation, out of bounds write
CVE-2023-30697: An improper input validation in IpcTxCfgSetSimlockPayload in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds write.
Key phrases: cause out-of-bounds write, improper input validation, out of bounds write
CVE-2023-30698: Improper access control vulnerability in TelephonyUI prior to SMR Aug-2023 Release 1 allows local attacker to connect BLE without privilege.
Key phrases: connect BLE without privilege, improper access control
CVE-2023-30699: Out-of-bounds write vulnerability in parser_hvcC function of libsimba library prior to SMR Aug-2023 Release 1 allows code execution by remote attackers.
Key phrases: code execution by remote attackers, out-of-bounds write, out of bounds write
CVE-2023-3070: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Key phrases: cross-site scripting (xss)
CVE-2023-30700: PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local attackers to access ContentProvider without proper permission.
Key phrases: access ContentProvider without proper permission, pendingintent hijacking
CVE-2023-30701: PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access.
Key phrases: arbitrary file access, pendingintent hijacking
CVE-2023-30702: Stack overflow vulnerability in SSHDCPAPP TA prior to &quot;SAMSUNG ELECTONICS, CO, LTD. - System Hardware Update - 7/13/2023&quot; in Windows Update for Galaxy book Go, Galaxy book Go 5G, Galaxy book2 Go and Galaxy book2 Pro 360 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, stack overflow
CVE-2023-30703: Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information.
Key phrases: access sensitive information, url validation
CVE-2023-30704: Improper Authorization vulnerability in Samsung Internet prior to version 22.0.0.35 allows physical attacker access downloaded files in Secret Mode without user authentication.
Key phrases: physical attacker access downloaded files in Secret Mode, improper authorization
CVE-2023-30705: Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access privileged content providers as Galaxy Store permission.
Key phrases: improper sanitization of incoming intent
CVE-2023-30706: Improper authorization in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows attacker to read arbitrary file with system privilege.
Key phrases: read arbitrary file, read arbitrary file with system privilege, improper authorization
CVE-2023-30707: Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local attackers to delete arbitrary files with Samsung Keyboard privilege.
Key phrases: delete arbitrary files, delete arbitrary files with Samsung Keyboard privilege, improper input validation
CVE-2023-30708: Improper authentication in SecSettings prior to SMR Sep-2023 Release 1 allows attacker to access Captive Portal Wi-Fi in Reactivation Lock status.
Key phrases: access Captive Portal Wi-Fi in Reactivation, improper authentication
CVE-2023-30709: Improper access control in Dual Messenger prior to SMR Sep-2023 Release 1 allows local attackers launch activity with system privilege.
Key phrases: local attackers launch activity with system privilege, improper access control
CVE-2023-3071: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Key phrases: cross-site scripting (xss)
CVE-2023-30710: Improper input validation vulnerability in Knox AI prior to SMR Sep-2023 Release 1 allows local attackers to launch privileged activities.
Key phrases: launch privileged activities, improper input validation
CVE-2023-30711: Improper authentication in Phone and Messaging Storage SMR SEP-2023 Release 1 allows attacker to insert arbitrary data to the provider.
Key phrases: insert arbitrary data, insert arbitrary data to the provider, improper authentication
CVE-2023-30712: Improper input validation in Settings Suggestions prior to SMR Sep-2023 Release 1 allows attackers to launch arbitrary activity.
Key phrases: launch arbitrary activity, improper input validation
CVE-2023-30713: Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to change some settings of the folder lock.
Key phrases: change some settings of the folder lock, improper privilege management
CVE-2023-30714: Improper authorization vulnerability in FolderContainerDragDelegate in One UI Home prior to SMR Sep-2023 Release 1 allows physical attackers to change some settings of the folder lock.
Key phrases: change some settings of the folder lock, improper authorization
CVE-2023-30715: Improper access control vulnerability in Weather prior to SMR Sep-2023 Release 1 allows attackers to access location information set in Weather without permission.
Key phrases: access location information set in Weather without permission, improper access control
CVE-2023-30716: Improper access control vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to trigger certain commands.
Key phrases: trigger certain commands, improper access control
CVE-2023-30717: Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to get unresettable identifiers.
Key phrases: get unresettable identifiers, sensitive information exposure
CVE-2023-30718: Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1 allows local attacker to change a Auto Hotspot setting.
Key phrases: change a Auto Hotspot setting
CVE-2023-30719: Exposure of Sensitive Information vulnerability in InboundSmsHandler prior to SMR Sep-2023 Release 1 allows local attackers to access certain message data.
Key phrases: access certain message data, exposure of sensitive information
CVE-2023-3072: HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.
Key phrases: block without a label, unexpected results
CVE-2023-30720: PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access.
Key phrases: gain arbitrary file access, pendingintent hijacking
CVE-2023-30721: Insertion of sensitive information into log vulnerability in Locksettings prior to SMR Sep-2023 Release 1 allows a privileged local attacker to get lock screen match information from the log.
Key phrases: get lock screen match information from the log, sensitive information
CVE-2023-30722: Protection Mechanism Failure in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.13.5 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, protection mechanism failure
CVE-2023-30723: Improper input validation vulnerability in Samsung Health prior to version 6.24.2.011 allows attackers to write arbitrary file with Samsung Health privilege.
Key phrases: write arbitrary file, write arbitrary file with Samsung Health privilege, improper input validation
CVE-2023-30724: Improper authentication in GallerySearchProvider of Gallery prior to version 14.5.01.2 allows attacker to access search history.
Key phrases: access search history, improper authentication
CVE-2023-30725: Improper authentication in LocalProvier of Gallery prior to version 14.5.01.2 allows attacker to access the data in content provider.
Key phrases: access the data in content provider, improper authentication
CVE-2023-30726: PendingIntent hijacking vulnerability in GameLauncher prior to version 4.2.59.5 allows local attackers to access data.
Key phrases: access data, pendingintent hijacking
CVE-2023-30727: Improper access control vulnerability in SecSettings prior to SMR Oct-2023 Release 1 allows attackers to enable Wi-Fi and connect arbitrary Wi-Fi without User Interaction.
Key phrases: connect arbitrary Wi, enable Wi-Fi and connect arbitrary Wi, improper access control
CVE-2023-30728: Intent redirection vulnerability in PackageInstallerCHN prior to version 13.1.03.00 allows local attacker to access arbitrary file. This vulnerability requires user interaction.
Key phrases: access arbitrary file, intent redirection
CVE-2023-30729: Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including sensitive information.
Key phrases: intercept the network traffic including sensitive information, improper certificate validation
CVE-2023-3073: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.
Key phrases: cross-site scripting (xss)
CVE-2023-30730: Implicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android 11, 12.1.00.30, 12.0.07.53, 12.1.03.10 in Android 12, and 13.0.01.43, 13.1.00.83 in Android 13 allows local attacker to access specific file.
Key phrases: access specific file, implicit intent hijacking
CVE-2023-30731: Logic error in package installation via debugger command prior to SMR Oct-2023 Release 1 allows physical attacker to install an application that has different build type.
Key phrases: install an application that has different build type, logic error
CVE-2023-30732: Improper access control in system property prior to SMR Oct-2023 Release 1 allows local attacker to get CPU serial number.
Key phrases: get CPU serial number, improper access control
CVE-2023-30733: Stack-based Buffer Overflow in vulnerability HDCP trustlet prior to SMR Oct-2023 Release 1 allows local privileged attackers to perform code execution.
Key phrases: perform code execution, stack-based buffer overflow
CVE-2023-30734: Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via implicit intent.
Key phrases: access sensitive information via implicit intent, improper access control
CVE-2023-30735: Improper Preservation of Permissions vulnerability in SAssistant prior to version 8.7 allows local attackers to access backup data in SAssistant.
Key phrases: access backup data in SAssistant, improper preservation of permissions
CVE-2023-30736: Improper authorization in PushMsgReceiver of Samsung Assistant prior to version 8.7.00.1 allows attacker to execute javascript interface. To trigger this vulnerability, user interaction is required.
Key phrases: execute javascript interface, improper authorization
CVE-2023-30737: Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via implicit intent.
Key phrases: access sensitive information via implicit intent, improper access control
CVE-2023-30738: An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Odyssey allows local attacker to execute SMM memory corruption.
Key phrases: execute SMM memory corruption, smm memory corruption, improper input validation
CVE-2023-30739: Arbitrary File Descriptor Write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, arbitrary file descriptor write
CVE-2023-3074: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Key phrases: cross-site scripting (xss)
CVE-2023-30740: SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality, limited impact on integrity and availability of the application.
Key phrases: access sensitive information which is otherwise restricted, successful exploitation, high impact on confidentiality, integrity, integrity and availability
CVE-2023-30741: Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
Key phrases: redirect users to untrusted site using a malicious, insufficient input validation, limited impact, confidentiality, confidentiality and integrity
CVE-2023-30742: SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.An attacker could store a malicious URL and lure the victim to click, causing the script supplied by the attacker to execute in the victim user's session. The information from the victim's session could then be modified or read by the attacker.
Key phrases: cross-site scripting (xss)
CVE-2023-30743: Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5 control allows injection of untrusted CSS. This blocks users interaction with the application. Further, in the absence of URL validation by the application, the vulnerability could lead to the attacker reading or modifying users information through phishing attack.
Key phrases: the attacker reading or modifying users information through, phishing
CVE-2023-30744: In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming and directory API to instantiate an object which has methods which can be called without further authorization and authentication. A subsequent call to one of these methods can read or change the state of existing services without any effect on availability.
Key phrases: open interface, availability
CVE-2023-30745: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <=2.1.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-30746: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Booqable Rental Software Booqable Rental plugin <=2.4.15 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-30747: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPGem WooCommerce Easy Duplicate Product plugin <=0.3.0.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-30749: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin <=7.3.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-3075: Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8.
Key phrases: cross-site request forgery (csrf)
CVE-2023-30750: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This issue affects CM Popup Plugin for WordPress: from n/a through 1.5.10.
Key phrases: sql command, sql injection
CVE-2023-30751: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in iControlWP Article Directory Redux plugin <=1.0.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-30752: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Silvia Pfeiffer and Andrew Nimmo External Videos plugin <=2.0.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-30753: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <=2.1.1.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-30754: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AdFoxly AdFoxly  Ad Manager, AdSense Ads & Ads.Txt plugin <=1.8.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-30757: A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions). The know-how protection feature in affected products does not properly update the encryption of existing program blocks when a project file is updated.This could allow attackers with access to the project file to recover previous - yet unprotected - versions of the project without the knowledge of the know-how protection password.
Key phrases: the project file to recover previous - yet
CVE-2023-30758: Cross-site scripting vulnerability in Pleasanter 1.3.38.1 and earlier allows a remote authenticated attacker to inject an arbitrary script.
Key phrases: inject an arbitrary script, cross-site scripting
CVE-2023-30759: The driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to detect its modification and may spawn an unexpected process with the administrative privilege. If a non-administrative user modifies the driver installation package and runs it on the target PC, an arbitrary program may be executed with the administrative privilege.
CVE-2023-3076: The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
Key phrases: exploitable
CVE-2023-30760: Out-of-bounds read in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, out-of-bounds read, out of bounds read
CVE-2023-30762: Improper authentication vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on the product or the device settings may be altered. Affected products and versions are as follows: KB-AHR04D versions prior to 91110.1.101106.78, KB-AHR08D versions prior to 91210.1.101106.78, KB-AHR16D versions prior to 91310.1.101106.78, KB-IRIP04A versions prior to 95110.1.100290.78A, KB-IRIP08A versions prior to 95210.1.100290.78A, and KB-IRIP16A versions prior to 95310.1.100290.78A.
Key phrases: improper authentication, arbitrary os command
CVE-2023-30763: Heap-based overflow in Intel(R) SoC Watch based software before version 2021.1 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, heap-based overflow, heap based overflow, escalation privilege
CVE-2023-30764: OS command injection vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on the product or the device settings may be altered. Affected products and versions are as follows: KB-AHR04D versions prior to 91110.1.101106.78, KB-AHR08D versions prior to 91210.1.101106.78, KB-AHR16D versions prior to 91310.1.101106.78, KB-IRIP04A versions prior to 95110.1.100290.78A, KB-IRIP08A versions prior to 95210.1.100290.78A, and KB-IRIP16A versions prior to 95310.1.100290.78A.
Key phrases: os command injection, arbitrary os command
CVE-2023-30765: ?Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management configurations, resulting in privilege escalation.
Key phrases: alter privilege management configurations, improper access controls, privilege escalation
CVE-2023-30766: Hidden functionality issue exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on the product or the device settings may be altered. Affected products and versions are as follows: KB-AHR04D versions prior to 91110.1.101106.78, KB-AHR08D versions prior to 91210.1.101106.78, KB-AHR16D versions prior to 91310.1.101106.78, KB-IRIP04A versions prior to 95110.1.100290.78A, KB-IRIP08A versions prior to 95210.1.100290.78A, and KB-IRIP16A versions prior to 95310.1.100290.78A.
Key phrases: hidden functionality issue, arbitrary os command
CVE-2023-30767: Improper buffer restrictions in Intel(R) Optimization for TensorFlow before version 2.13.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper buffer restrictions, escalation privilege
CVE-2023-30768: Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family with the BIOS version 0016 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2023-30769: Vulnerability discovered is related to the peer-to-peer (p2p) communications, attackers can craft consensus messages, send it to individual nodes and take them offline. An attacker can crawl the network peers using getaddr message and attack the unpatched nodes.
Key phrases: offline
CVE-2023-3077: The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
Key phrases: blind sql injection
CVE-2023-30770: A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation. An attacker can exploit this vulnerability to execute arbitrary code. Affected ADM versions include: 4.0.6.REG2, 4.1.0 and below as well as 4.2.0.RE71 and below.
Key phrases: execute arbitrary code, stack-based buffer overflow, stack based buffer overflow
CVE-2023-30771: Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database.This problem is fixed from version 0.13.4 of iotdb-web-workbench onwards.
Key phrases: incorrect authorization
CVE-2023-30772: The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device.
Key phrases: race condition, use-after-free, use after free
CVE-2023-30774: A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.
Key phrases: heap buffer overflow
CVE-2023-30775: A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c.
Key phrases: heap buffer overflow
CVE-2023-30776: An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API.This issue affects Apache Superset version 1.3.0 up to 2.0.1.
CVE-2023-30777: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <=6.1.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-30778: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry plugin <=10.0.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-30779: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jonathan Daggerhart Query Wrangler plugin <=1.5.51 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-3078: An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.
Key phrases: execute code with elevated privileges, uncontrolled search path, elevate privileges
CVE-2023-30780: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TheGuideX User IP and Location plugin <=2.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-30781: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Theme Blvd Tweeple plugin <=0.9.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-30782: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <=3.7.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-30784: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kaya Studio Kaya QR Code Generator plugin <=1.5.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-30785: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Grid plugin <=1.21 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-30786: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Benjamin Guy Captcha Them All plugin <=1.3.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-30787: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/introductions` endpoint and first_met_additional_info parameter.
Key phrases: execute malicious code in the application via CSTI, csti
CVE-2023-30788: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people/add` endpoint and nickName, description, lastName, middleName and firstName parameter.
Key phrases: execute malicious code in the application via CSTI, csti
CVE-2023-30789: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/work` endpoint and job and company parameter.
Key phrases: execute malicious code in the application via CSTI, csti
CVE-2023-3079: Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: type confusion, heap corruption
CVE-2023-30790: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/relationships` endpoint and first_name and last_name parameter.
Key phrases: execute malicious code in the application via CSTI, csti
CVE-2023-30791: Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.
Key phrases: change the avatar of his profile, uploading files with HTML extension that interprets both
CVE-2023-30792: Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources.
Key phrases: for cross-site scripting on link clicks
CVE-2023-30795: A vulnerability has been identified in JT Open (All versions < V11.4), JT Utilities (All versions < V13.4), Parasolid V34.0 (All versions < V34.0.253), Parasolid V34.1 (All versions < V34.1.243), Parasolid V35.0 (All versions < V35.0.177), Parasolid V35.1 (All versions < V35.1.073). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-30796: A vulnerability has been identified in JT Open (All versions < V11.4), JT Utilities (All versions < V13.4). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-30797: Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.
Key phrases: gain access, guess the credentials and gain access to resources, insufficiently random values, default credentials,
CVE-2023-30798: There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
Key phrases: specify any number of form fields or files, denial of service
CVE-2023-30799: MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary code on the system.
Key phrases: execute arbitrary code, privilege escalation issue, escalate privilege
CVE-2023-3080: The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-30800: The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in RouterOS 6.49.10 stable. RouterOS version 7 is not affected.
Key phrases: heap memory corruption, crash
CVE-2023-30801: All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
Key phrases: execute arbitrary operating system commands, default credentials, exploited in the wild, default credentials,
CVE-2023-30802: The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Length field.
Key phrases: obtain PHP source code by sending an HTTP request, source code disclosure
CVE-2023-30803: The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a crafted Y-forwarded-for header.
Key phrases: bypass authentication, authentication bypass
CVE-2023-30804: The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpn_html/loadfile.php endpoint. This issue is exploitable by a remote and unauthenticated attacker when paired with CVE-2023-30803.
Key phrases: read arbitrary system files, authenticated file disclosure, exploitable
CVE-2023-30805: The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /LogInOut.php endpoint. This is due to mishandling of shell meta-characters in the "un" parameter.
Key phrases: execute arbitrary commands, operating system command injection
CVE-2023-30806: The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /cgi-bin/login.cgi endpoint. This is due to mishandling of shell meta-characters in the PHPSESSID cookie.
Key phrases: execute arbitrary commands, operating system command injection
CVE-2023-3081: The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: An incomplete fix was released in 1.11.1.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-3082: The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-3083: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Key phrases: cross-site scripting (xss)
CVE-2023-30837: Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.
Key phrases: allocation overflows