yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-39007: /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.
Key phrases: XSS via openAction in app/controllers/, xss
CVE-2023-39008: A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.
Key phrases: execute arbitrary system commands, command injection
CVE-2023-39010: BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploited by loading a crafted camera calibration file.
Key phrases: code injection
CVE-2023-39013: Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.
Key phrases: code injection
CVE-2023-39015: webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloader.PhantomJSDownloader.
Key phrases: code injection
CVE-2023-39016: bboss-persistent v6.0.9 and below was discovered to contain a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.createPool. This vulnerability is exploited via passing an unchecked argument.
Key phrases: code injection
CVE-2023-39017: quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple parties because it is not plausible that untrusted user input would reach the code location where injection must occur.
Key phrases: code injection
CVE-2023-39018: FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which FFmpeg.java uses untrusted input for the path of the executable file.
Key phrases: code injection
CVE-2023-39020: stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.
Key phrases: code injection
CVE-2023-39021: wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
Key phrases: code injection
CVE-2023-39022: oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument.
Key phrases: code injection
CVE-2023-39023: university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager.configure. This vulnerability is exploited via passing an unchecked argument.
Key phrases: code injection
CVE-2023-39026: Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted request to, directory traversal
CVE-2023-39039: An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-3904: An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards.
CVE-2023-39040: An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39041: An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39042: An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39043: An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39044: An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39045: An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39046: An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39047: An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39048: An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39049: An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39050: An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39051: An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39052: An information leak in Earthgarden_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39053: An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39054: An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39056: An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39057: An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39058: An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Key phrases: obtain the channel access, obtain the channel access token and send crafted, information leak
CVE-2023-39059: An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to
CVE-2023-3906: An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.
Key phrases: bypass the asset proxy, input validation issue, image urls
CVE-2023-39061: Cross Site Request Forgery (CSRF) vulnerability in Chamilo v.1.11 thru v.1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code.
Key phrases: execute arbitrary code, cross site request forgery (csrf)
CVE-2023-39062: Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-39063: Buffer Overflow vulnerability in RaidenFTPD 2.4.4005 allows a local attacker to execute arbitrary code via the Server name field of the Step by step setup wizard.
Key phrases: execute arbitrary code, execute arbitrary code via the Server name field, buffer overflow
CVE-2023-39067: Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to execute arbitrary code via a crafted script to the URL.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script to, cross site scripting
CVE-2023-39068: Buffer Overflow vulnerability in NBD80S09S-KLC v.YK_HZXM_NBD80S09S-KLC_V4.03.R11.7601.Nat.OnvifC.20230414.bin and NBD80N32RA-KL-V3 v.YK_HZXM_NBD80N32RA-KL_V4.03.R11.7601.Nat.OnvifC.20220120.bin allows a remote attacker to casue a denial of service via a crafted request to the service.XM component.
Key phrases: casue a denial of service via a crafted, buffer overflow
CVE-2023-39069: An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism.
Key phrases: gain privileges, gain privileges via Active Directory authentication mechanism
CVE-2023-3907: A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner
Key phrases: use a Project Access Token to escalate their, privilege escalation
CVE-2023-39070: An issue in Cppcheck 2.12 dev allows a local attacker to execute arbitrary code via the removeContradiction parameter in token.cpp:1934.
Key phrases: execute arbitrary code, execute arbitrary code via the removeContradiction parameter in
CVE-2023-39073: An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request.
Key phrases: execute arbitrary code, obtain senstive information, execute arbitrary code and obtain senstive information via
CVE-2023-39075: Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) allows attackers to crash the infotainment system by sending arbitrary USB data via a USB device.
Key phrases: sending arbitrary USB data, crash the infotainment system by sending arbitrary USB, arbitrary usb data
CVE-2023-39076: Injecting random data into the USB memory area on a General Motors (GM) Chevrolet Equinox 2021 Software. 2021.03.26 (build version) vehicle causes a Denial of Service (DoS) in the in-car infotainment system.
Key phrases: Denial of Service (DoS), usb memory area, denial of service (dos)
CVE-2023-39086: ASUS RT-AC66U B1 3.0.0.4.286_51665 was discovered to transmit sensitive information in cleartext.
Key phrases: cleartext, sensitive information
CVE-2023-3909: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file.
Key phrases: regular expression denial of service
CVE-2023-39094: Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username parameter in the student list function.
Key phrases: execute arbitrary code, execute arbitrary code via the username parameter in, cross site scripting
CVE-2023-39096: WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and output encoding.
Key phrases: cross-site scripting (xss)
CVE-2023-39097: WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability.
Key phrases: stored cross-site scripting (xss)
CVE-2023-39106: An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.
Key phrases: execute arbitrary code, execute arbitrary code via the SnakeYamls Constructor(
CVE-2023-39107: An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks.
Key phrases: overwrite root-owned files by using hardlinks, arbitrary file overwrite
CVE-2023-39108: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
Key phrases: make arbitrary requests, make arbitrary requests via injection of crafted URLs, server-side request forgery (ssrf)
CVE-2023-39109: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
Key phrases: make arbitrary requests, make arbitrary requests via injection of crafted URLs, server-side request forgery (ssrf)
CVE-2023-39110: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
Key phrases: make arbitrary requests, make arbitrary requests via injection of crafted URLs, server-side request forgery (ssrf)
CVE-2023-39112: ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.
Key phrases: arbitrary file deletion
CVE-2023-39113: ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c. This vulnerability is triggered when running the program gif2tga.
Key phrases: segmentation violation
CVE-2023-39114: ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerability is triggered when running the program SDLaffgif.
Key phrases: segmentation violation
CVE-2023-39115: install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document.
Key phrases: XSS via a crafted SVG document, xss
CVE-2023-39121: emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.
Key phrases: sql injection
CVE-2023-39122: BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200).
Key phrases: SQL injection via the /RF-Server/, sql injection
CVE-2023-39125: NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c because a file's width, height, and BPP are not validated. NOTE: the vendor's perspective is "this main application was not intended to be a well tested program, it's just something to demonstrate it works and for the user to see how to integrate it into their own programs."
Key phrases: integer overflow, out-of-bounds write, out of bounds write
CVE-2023-39128: GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c.
Key phrases: stack overflow
CVE-2023-39129: GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c.
Key phrases: heap use after free
CVE-2023-39130: GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c.
Key phrases: heap buffer overflow
CVE-2023-39135: An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry.
Key phrases: execute a path traversal attack via a crafted
CVE-2023-39136: An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), edge case, denial of service (dos)
CVE-2023-39137: An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.
Key phrases: spoof zip filenames which can lead to inconsistent, inconsistent filename parsing, spoofing
CVE-2023-39138: An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.
Key phrases: execute a path traversal via extracting a crafted
CVE-2023-39139: An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.
Key phrases: execute a path traversal via extracting a crafted
CVE-2023-3914: A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.
Key phrases: internal projects
CVE-2023-39141: webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.
Key phrases: path traversal
CVE-2023-39143: PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).
Key phrases: delete arbitrary files, upload, path traversal, remote code execution
CVE-2023-39144: Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.
Key phrases: plaintext
CVE-2023-39147: An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted image, arbitrary file upload
CVE-2023-3915: An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified as external and may be used to access internal projects.
Key phrases: escalate privilege
CVE-2023-39150: ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387.
Key phrases: arbitrary code execution
CVE-2023-39151: Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.
Key phrases: stored cross-site scripting (xss)
CVE-2023-39152: Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.
CVE-2023-39153: A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.
Key phrases: trick users into logging in to the attacker, cross-site request forgery (csrf), cross site request forgery
CVE-2023-39154: Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified URL using, incorrect permission checks
CVE-2023-39155: Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.
Key phrases: user.pem key form field
CVE-2023-39156: A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.
Key phrases: delete previously created Bazaar SCM tags, cross-site request forgery (csrf), cross site request forgery
CVE-2023-39157: Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10.
Key phrases: improper control of generation of code, code injection
CVE-2023-39158: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Banner Management For WooCommerce plugin <=2.4.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-39159: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin <=2.1.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-39162: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in XLPlugins User Email Verification for WooCommerce plugin <=3.5.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-39164: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Molongui Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors  Molongui plugin <=4.6.19 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-39165: Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets plugin <=2.2.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-39166: Cross-Site Request Forgery (CSRF) vulnerability in tagDiv tagDiv Composer allows Cross-Site Scripting (XSS).This issue affects tagDiv Composer: from n/a before 4.4.
Key phrases: Cross-Site Scripting (XSS).This issue affects, cross-site request forgery (csrf), cross-site scripting (xss)
CVE-2023-39167: InSENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.
Key phrases: obtain the devices' logfiles that contain sensitive data
CVE-2023-39169: The affected devices use publicly available default credentials with administrative privileges.
Key phrases: publicly available default credentials, default credentials,
CVE-2023-3917: Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.
Key phrases: cause pipelines to fail, denial of service
CVE-2023-39171: SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.
Key phrases: publicly known admin credentials
CVE-2023-39172: The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.
Key phrases: capture and modify network traffic, unencrypted, sensitive information
CVE-2023-39173: In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access
Key phrases: gain full account access, token with limited permissions
CVE-2023-39174: In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers
CVE-2023-39175: In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible
Key phrases: xss
CVE-2023-39181: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds write
CVE-2023-39182: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-39183: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-39184: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-39185: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-39186: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-39187: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-39188: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out of bounds read
CVE-2023-39189: A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.
Key phrases: trigger an out-of-bounds read, crash, information disclosure, out of bounds read
CVE-2023-39191: An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code in the context of the kernel.
Key phrases: execute arbitrary code, escalate privileges and execute arbitrary code in the, improper input validation flaw
CVE-2023-39192: A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.
Key phrases: trigger an out-of-bounds read, crash, information disclosure, out of bounds read
CVE-2023-39193: A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.
Key phrases: trigger an out-of-bounds read, crash, information disclosure, out of bounds read
CVE-2023-39194: A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.
Key phrases: trigger an out-of-bounds read, information disclosure, out of bounds read
CVE-2023-39196: Improper Authentication vulnerability in Apache Ozone.The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication.The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this vulnerability.The accessible metadata does not contain sensitive information that can be used to exploit the system later on, and the accessible data does not make it possible to gain access to actual user data within Ozone.This issue affects Apache Ozone: 1.2.0 and subsequent releases up until 1.3.0.Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Key phrases: gain access, download metadata internal to the Storage Container Manager, improper authentication, sensitive information
CVE-2023-39197: An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
Key phrases: disclose sensitive information via the DCCP protocol, out-of-bounds read, out of bounds read
CVE-2023-39198: A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.
Key phrases: guess the returned handle value and trigger a, race condition, use-after-free issue, denial of service, privilege escalation, use after free
CVE-2023-39199: Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access.
Key phrases: conduct an information disclosure via network access, cryptographic issues
CVE-2023-3920: An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation.
CVE-2023-39201: Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access.
Key phrases: conduct an escalation of privilege via local access, untrusted search path, escalation privilege
CVE-2023-39202: Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access.
Key phrases: conduct a denial of service via local access, untrusted search path
CVE-2023-39203: Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disclosure of information via network access.
Key phrases: conduct a disclosure of information via network access, uncontrolled resource consumption
CVE-2023-39204: Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.
Key phrases: conduct a denial of service via network access, buffer overflow
CVE-2023-39205: Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access.
Key phrases: conduct a denial of service via network access, improper conditions check
CVE-2023-39206: Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.
Key phrases: conduct a denial of service via network access, buffer overflow
CVE-2023-39208: Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network access.
Key phrases: conduct a denial of service via network access, improper input validation
CVE-2023-39209: Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network access.
Key phrases: enable an information disclosure via network access, improper input validation
CVE-2023-39210: Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user to enable an information disclosure via local access.
Key phrases: enable an information disclosure via local access, cleartext storage, sensitive information
CVE-2023-39211: Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access.
Key phrases: enable an information disclosure via local access, improper privilege management
CVE-2023-39212: Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.
Key phrases: enable a denial of service via local access, untrusted search path
CVE-2023-39213: Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access.
Key phrases: enable an escalation of privilege via network access, improper neutralization of special elements, escalation privilege
CVE-2023-39214: Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.
Key phrases: enable a denial of service via network access, exposure of sensitive information
CVE-2023-39215: Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.
Key phrases: conduct a denial of service via network access, improper authentication
CVE-2023-39216: Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
Key phrases: enable an escalation of privilege via network access, improper input validation, escalation privilege
CVE-2023-39217: Improper input validation in Zoom SDKs before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.
Key phrases: enable a denial of service via network access, improper input validation
CVE-2023-39218: Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access.
Key phrases: enable information disclosure via network access
CVE-2023-39219: PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests
Key phrases: weakness, unresponsive
CVE-2023-3922: An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page.
Key phrases: hijack
CVE-2023-39221: Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.
Key phrases: potentially enable escalation of privilege via network access, improper access control, escalation privilege
CVE-2023-39222: OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
Key phrases: execute an arbitrary OS command that is not, os command injection, execute arbitrary, arbitrary os command
CVE-2023-39223: Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
Key phrases: cross-site scripting, arbitrary script
CVE-2023-39224: Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Note that Archer C5 is no longer supported, therefore the update for this product is not provided.
Key phrases: execute arbitrary OS commands, arbitrary os command
CVE-2023-39226: In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a single UDP packet.
Key phrases: execute arbitrary code, execute arbitrary code through a single UDP packet
CVE-2023-39227: ?Softneta MedDream PACSstores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate users credentials.
Key phrases: plaintext storage, leak
CVE-2023-39228: Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access.
Key phrases: potentially enable denial of service via network access, improper access control
CVE-2023-39230: Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, insecure inherited permissions, escalation privilege
CVE-2023-39231: PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's first factor credentials.
Key phrases: be paired without requiring second factor authentication from
CVE-2023-39233: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may disclose sensitive information.
Key phrases: sensitive information
CVE-2023-39234: Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when looping over `lt->numrealfacs`.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-39235: Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when looping over `lt->num_time_ticks`.
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2023-39236: ASUS RT-AC86U Traffic Analyzer - Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.
Key phrases: execute arbitrary commands, statistic function, command injection, disrupt system, terminate services
CVE-2023-39237: ASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.
Key phrases: execute arbitrary commands, command injection, disrupt system, terminate services
CVE-2023-39238: It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific valuewithin its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Key phrases: format string, disrupt service, arbitrary code, arbitrary code execution
CVE-2023-39239: It is identified a format string vulnerability in ASUS RT-AX56U V2s General function API. This vulnerability is caused by lacking validation for a specific value within its  apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Key phrases: format string, disrupt service, arbitrary code, arbitrary code execution
CVE-2023-39240: It is identified a format string vulnerability in ASUS RT-AX56U V2s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Key phrases: format string, disrupt service, arbitrary code, arbitrary code execution
CVE-2023-39244: DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthenticated attacker could potentially exploit this vulnerability by eavesdropping the network traffic to gain admin level credentials.
Key phrases: gain admin level credentials, information disclosure
CVE-2023-39245: DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthenticated attacker could potentially exploit this vulnerability by eavesdropping the network traffic to gain admin level credentials.
Key phrases: gain admin level credentials, information disclosure
CVE-2023-39246: Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure Operation on Windows Junction Vulnerability during installation. A local malicious user could potentially exploit this vulnerability to create an arbitrary folder inside a restricted directory, leading to Privilege Escalation
Key phrases: insecure operation, windows junction, privilege escalation
CVE-2023-39248: Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, when switches are configured with VLT and VRRP. A remote unauthenticateduser can cause the network to be flooded leading to Denial of Service for actual network users. This is a high severity vulnerability as it allows an attacker to cause an outage of network. Dell recommends customers to upgrade at the earliest opportunity.
Key phrases: cause an outage of network, uncontrolled resource consumption (denial of service)
CVE-2023-39249: Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables IT/System Administrators to perform driver scans and Dell-recommended driver installations without requiring them to log out of the local non-admin user session. However, the granted privilege is limited solely to the SupportAssist User Interface and automatically expires after 15 minutes.
Key phrases: Authentication Bypass, gain temporary privilege, gain temporary privilege within the SupportAssist User Interface, authentication bypass
CVE-2023-39250: Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager for VMware (RMSV) versions prior to 3.1.2 contain an information disclosure vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to retrieve an encryption key that could aid in further attacks. 
Key phrases: information disclosure
CVE-2023-39251: Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability in order to corrupt memory on the system.
Key phrases: improper input validation, corrupt memory
CVE-2023-39252: Dell SCG Policy Manager 5.16.00.14  contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by performing MitM attacks and let attackers obtain sensitive information.
Key phrases: obtain sensitive information, broken cryptographic algorithm, mitm