yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-47701: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query.  IBM X-Force ID:  266166.
Key phrases: denial of service
CVE-2023-47702: IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view modify files on the system.  IBM X-Force ID:  271196.
Key phrases: traverse directories on the system
CVE-2023-47703: IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  271197.
Key phrases: obtain sensitive information, obtain sensitive information when a detailed technical error
CVE-2023-47704: IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository.  IBM X-Force ID:  271220.
Key phrases: plain text hard-coded credentials, hard coded credentials
CVE-2023-47705: IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation.  IBM X-Force ID:  271228.
Key phrases: manipulate username data due to improper input validation
CVE-2023-47706: IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type.  IBM X-Force ID:  271341.
Key phrases: upload files of a dangerous file type
CVE-2023-47707: IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  271522.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2023-4771: A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.
Key phrases: cross-site scripting
CVE-2023-47715: IBM Storage Protect Plus Server 10.1.0 through 10.1.16 could allow an authenticated user with read-only permissions to add or delete entries from an existing HyperVisor configuration.  IBM X-Force ID:  271538.
Key phrases: add or delete entries from an existing HyperVisor
CVE-2023-47716: IBM CP4BA - Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a user to gain the privileges of another user under unusual circumstances.  IBM X-Force ID:  271656.
Key phrases: gain the privileges, gain the privileges of another user under unusual, gain privileges
CVE-2023-47718: IBM Maximo Asset Management 7.6.1.3 and Manage Component 8.10 through 8.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  271843.
Key phrases: execute malicious and unauthorized actions transmitted from a, cross-site request forgery, cross site request forgery
CVE-2023-4772: The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletter_form' shortcode in versions up to, and including, 7.8.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-47722: IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user.  IBM X-Force ID:  271912.
Key phrases: browser cache
CVE-2023-4773: The WordPress Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wordpress_social_login_meta' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-4774: The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-47741: IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common browser tools before the memory is garbage collected. A malicious actor with access to the victim's PC could exploit this vulnerability to gain access to the IBM i operating system. IBM X-Force ID: 272532.
Key phrases: gain access, clear text password
CVE-2023-47742: IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances.  IBM X-Force ID:  272533.
Key phrases: man in the middle techniques, sensitive information
CVE-2023-47745: IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or transmits user credentials in plain clear text which can be read by a local user using a trace command.  IBM X-Force ID:  272638.
Key phrases: plain clear text
CVE-2023-47746: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query.  IBM X-Force ID:  272644.
Key phrases: cause a denial of service using a specially
CVE-2023-47747: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query.  IBM X-Force ID:  272646.
Key phrases: cause a denial of service using a specially
CVE-2023-4775: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, and including, 2023.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-47754: Missing Authorization vulnerability in Clever plugins Delete Duplicate Posts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Delete Duplicate Posts: from n/a through 4.8.9.
Key phrases: Accessing Functionality Not Properly Constrained by ACLs, missing authorization
CVE-2023-47755: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel Slider plugin <=3.3.5 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47757: Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber  Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects AWeber  Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth: from n/a through 7.3.9.
Key phrases: Accessing Functionality Not Properly Constrained by ACLs, missing authorization, cross-site request forgery (csrf)
CVE-2023-47758: Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form plugin <=1.7.11 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-47759: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty plugin <=3.1.2 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-4776: The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
Key phrases: sql injection
CVE-2023-47765: Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <=2.1.9 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-47766: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <=1.11.0 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47767: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fla-shop.Com Interactive World Map plugin <=3.2.0 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47768: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter plugin <=1.17 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-4777: An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins and to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins.
Key phrases: enumerate credentials IDs of credentials stored in Jenkins, permission check
CVE-2023-47772: Contributor+Stored Cross-Site Scripting (XSS) vulnerability in Slider Revolution <=6.6.14.
Key phrases: stored cross-site scripting (xss)
CVE-2023-47773: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <=2.8.2 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47775: Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments  wpDiscuz plugin <=7.6.11 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-47777: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.This issue affects WooCommerce: from n/a through 8.1.1; WooCommerce Blocks: from n/a through 11.1.1.
Key phrases: Stored XSS.This issue affects WooCommerce: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-47779: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.
Key phrases: url redirection, open redirect
CVE-2023-4778: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
Key phrases: out-of-bounds read
CVE-2023-47781: Cross-Site Request Forgery (CSRF) vulnerability in Thrive Themes Thrive Theme Builder <3.24.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-47784: Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a through 6.6.15.
Key phrases: unrestricted upload of file with dangerous type
CVE-2023-47785: Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider plugin <=7.7.9 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-47786: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <=7.7.9 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47787: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3.
Key phrases: cross-site request forgery (csrf)
CVE-2023-47789: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3.
Key phrases: cross-site request forgery (csrf)
CVE-2023-4779: The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to, and including, 20230811 due to insufficient input sanitization and output escaping on user supplied attributes like 'before'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-47790: Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in Poporon Pz-LinkCard plugin <=2.4.8 versions.
Key phrases: cross-site request forgery (csrf), cross-site scripting (xss)
CVE-2023-47791: Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <=1.1.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-47792: Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads  Increase Maximum File Upload Size plugin <=2.1.1 versions.
Key phrases: cross-site request forgery (csrf), infinite uploads, big file uploads
CVE-2023-47795: Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's Title text field.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, stored cross-site scripting (xss)
CVE-2023-47797: Reflected cross-site scripting (XSS) vulnerability on a content pages edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, reflected cross-site scripting (xss)
CVE-2023-47798: Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.
Key phrases: remain authenticated after an account has been locked, remote authenticated users
CVE-2023-47800: Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to perform remote code execution, data exfiltration, or other nefarious actions such as tampering with data or destroying/disrupting MSSQL services.
Key phrases: perform remote code execution, data exfiltration, tampering with data, destroying disrupting, default password
CVE-2023-47801: An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password Record API Key to Copy/Move private password records.
Key phrases: system wide api key, copy move password record api key
CVE-2023-47804: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose.Links can be activated by clicks, or by automatic document events.The execution of such links must be subject to user approval.In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution.This is a corner case of CVE-2022-47502.
Key phrases: arbitrary script execution
CVE-2023-47806: Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through 1.3.7.
Key phrases: cross-site request forgery (csrf)
CVE-2023-47808: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <=1.3.2 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47809: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <=2.6 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-4781: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.
Key phrases: heap-based buffer overflow
CVE-2023-47810: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asdqwe Dev Ajax Domain Checker plugin <=1.3.0 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47811: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <=1.0.5 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47812: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns plugin <=1.6.1 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47813: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <=2.8.1 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47814: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Waterloo Plugins BMI Calculator Plugin plugin <=1.0.3 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47815: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra plugin <=2.5.2 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47816: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <=1.7.0.13 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47817: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <=2023.10.13 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47819: Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <=1.1.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-4782: Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.
Key phrases: allows arbitrary file, arbitrary file write during the `init`
CVE-2023-47821: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <=2.1.8 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47824: Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages  Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <=1.3.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-47825: Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra plugin <=6.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-47827: Incorrect Authorization vulnerability in NicheAddons Events Addon for Elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Events Addon for Elementor: from n/a through 2.1.3.
Key phrases: Accessing Functionality Not Properly Constrained by ACLs, incorrect authorization
CVE-2023-47829: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codez Quick Call Button plugin <=1.2.9 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-4783: The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-47831: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in assorted[chips] DrawIt (draw.Io) plugin <=1.1.3 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47833: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress plugin <=0.18.3 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47834: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <=8.1.13 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47835: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz  WordPress Quizzes Builder plugin <=1.2.32 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47839: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <=3.3.26 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2023-47840: Improper Control of Generation of Code ('Code Injection') vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: from n/a through 1.5.2.
Key phrases: improper control of generation of code, code injection
CVE-2023-47842: Unrestricted Upload of File with Dangerous Type vulnerability in Zachary Segal CataBlog.This issue affects CataBlog: from n/a through 1.7.0.
Key phrases: unrestricted upload of file with dangerous type
CVE-2023-47844: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4.
Key phrases: Reflected XSS.This issue affects Grab & Save:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-47846: Unrestricted Upload of File with Dangerous Type vulnerability in Terry Lin WP Githuber MD.This issue affects WP Githuber MD: from n/a through 1.16.2.
Key phrases: unrestricted upload of file with dangerous type
CVE-2023-47848: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tainacan.Org Tainacan allows Reflected XSS.This issue affects Tainacan: from n/a through 0.20.4.
Key phrases: Reflected XSS.This issue affects Tainacan: from n, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
Key phrases: cause a denial of service by initiating a
CVE-2023-47850: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo  Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo  Social Network, Membership, Registration, User Profiles: from n/a through 6.2.2.0.
Key phrases: Stored XSS.This issue affects Community by PeepSo  , cross-site scripting, stored xss
CVE-2023-47851: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate allows Stored XSS.This issue affects Bootstrap Shortcodes Ultimate: from n/a through 4.3.1.
Key phrases: Stored XSS.This issue affects Bootstrap Shortcodes Ultimate:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-47852: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5.
Key phrases: sql command, sql injection
CVE-2023-47853: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred  Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin allows Stored XSS.This issue affects myCred  Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin: from n/a through 2.6.1.
Key phrases: Stored XSS.This issue affects myCred  Points, cross-site scripting, stored xss
CVE-2023-47854: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Howard Ehrenberg Parallax Image allows Stored XSS.This issue affects Parallax Image: from n/a through 1.7.1.
Key phrases: Stored XSS.This issue affects Parallax Image: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-47857: in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia camera crash through modify a released pointer.
Key phrases: a local attacker cause multimedia camera crash through, released pointer
CVE-2023-47858: Mattermost fails to properly verify the permissions needed for viewing archived public channels,allowing a member of one team to get details about the archived public channels of another team via theGET /api/v4/teams/<team-id>/channels/deleted endpoint.
Key phrases: get details about the archived public channels of
CVE-2023-47861: A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
Key phrases: cross-site scripting (xss), arbitrary javascript
CVE-2023-47862: A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send a series of HTTP requests to trigger this vulnerability.
Key phrases: local file inclusion, arbitrary code execution, series of http requests
CVE-2023-47865: Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the Hardened Mode setting was enabled
CVE-2023-47867: MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device.
Key phrases: wi-fi hosts, compromise
CVE-2023-47870: Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6.
Key phrases: forced all users log out, cross-site request forgery (csrf), missing authorization, cross site request forgery
CVE-2023-47872: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team wpForo Forum allows Stored XSS.This issue affects wpForo Forum: from n/a through 2.2.3.
Key phrases: Stored XSS.This issue affects wpForo Forum: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-47873: Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator: from n/a through 1.0.9.
Key phrases: dangerous type
CVE-2023-47874: Missing Authorization vulnerability in Perfmatters.This issue affects Perfmatters: from n/a through 2.1.6.
Key phrases: missing authorization
CVE-2023-47875: Cross-Site Request Forgery (CSRF) vulnerability in Perfmatters allows Cross Site Request Forgery.This issue affects Perfmatters: from n/a through 2.1.6.
Key phrases: Cross Site Request Forgery, cross-site request forgery (csrf), cross site request forgery
CVE-2023-47876: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Reflected XSS.This issue affects Perfmatters: from n/a through 2.1.6.
Key phrases: Reflected XSS.This issue affects Perfmatters: from n, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2023-47877: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Stored XSS.This issue affects Perfmatters: from n/a before 2.2.0.
Key phrases: Stored XSS.This issue affects Perfmatters: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2023-47882: The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.
Key phrases: execute arbitrary JavaScript code, execute arbitrary JavaScript code via an implicit intent
CVE-2023-47883: The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to an exposed MainActivity.
Key phrases: javascript code execution, explicit intent, exposed mainactivity
CVE-2023-47889: The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. These exposed actions can allow any app on the device to send unauthorized broadcasts, leading to unintended consequences. The vulnerability is particularly concerning because these actions include powering off, system reboot & entering recovery mode.
Key phrases: send unauthorized broadcasts, exported broadcast receivers, unintended consequences, reboot
CVE-2023-47890: pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.
Key phrases: unrestricted file upload
CVE-2023-4792: The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers with subscriber access or higher to duplicate posts and pages.
Key phrases: unauthorized page and post duplication
CVE-2023-4795: The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2023-4796: The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive site options.
Key phrases: information disclosure
CVE-2023-4797: The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.
Key phrases: run arbitrary commands
CVE-2023-4798: The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.
Key phrases: conduct Stored XSS attacks, stored xss
CVE-2023-4799: The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2023-47990: SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table parameter.
Key phrases: run arbitrary SQL commands, run arbitrary SQL commands via the table parameter, sql injection, arbitrary sql commands
CVE-2023-47992: An integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, cause a denial-of-service attacks and/or run arbitrary code.
Key phrases: run arbitrary code, obtain sensitive information, integer overflow, denial-of-service, denial of service
CVE-2023-47993: A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in FreeImage 3.18.0 allows attackers to cause a denial-of-service.
Key phrases: cause a denial-of-service, buffer out-of-bound read, out of bound read, denial of service
CVE-2023-47994: An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a denial of service and/or run arbitrary code.
Key phrases: run arbitrary code, obtain sensitive information, integer overflow, denial of service
CVE-2023-47995: Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.
Key phrases: cause a denial of service, memory allocation, excessive size value
CVE-2023-47996: An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a denial of service.
Key phrases: obtain information, obtain information and cause a denial of service, integer overflow
CVE-2023-47997: An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of service.
Key phrases: cause a denial of service, infinite loop
CVE-2023-4800: The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
CVE-2023-48003: An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the '<meta http-equiv="refresh"' in the WebSocket messages.
Key phrases: redirect targeted victims to any URL via the, html injection, open redirect
CVE-2023-4801: An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected.
Key phrases: improper certification validation, man in the middle
CVE-2023-48011: GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments.c.
Key phrases: heap-use-after-free, use after free
CVE-2023-48013: GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core/filter.c.
Key phrases: double free
CVE-2023-48014: GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/av_parsers.c.
Key phrases: stack overflow
CVE-2023-48016: Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter.
Key phrases: sql injection
CVE-2023-48017: Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management.
Key phrases: cross site request forgery (csrf)
CVE-2023-4802: A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected.
Key phrases: run arbitrary javascript, reflected cross-site scripting
CVE-2023-48020: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus.
Key phrases: cross-site request forgery (csrf)
CVE-2023-48021: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.
Key phrases: cross-site request forgery (csrf)
CVE-2023-48022: Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment
Key phrases: execute arbitrary code, execute arbitrary code via the job submission API
CVE-2023-48023: Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment
Key phrases: /log_proxy SSRF, log_proxy ssrf
CVE-2023-48024: Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hash_destroy(hash_table_t *h) at hash.c
Key phrases: use-after-free, use after free
CVE-2023-48025: Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned get_length(lisp_cell_t * x) at eval.c
Key phrases: out-of-bounds-read, out of bounds read
CVE-2023-48028: kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based on varying response messages, potentially paving the way for a brute force attack.
Key phrases: brute force
CVE-2023-48029: Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploited when an administrator visits the user management section, exports the data to a CSV file, and then opens it, leading to the execution of the malicious payload on the administrator's computer.
Key phrases: csv injection
CVE-2023-4803: A reflected cross-site scripting vulnerability in the WriteWindowTitle endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected.
Key phrases: run arbitrary javascript, reflected cross-site scripting
CVE-2023-48031: OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This can enable the attacker to execute arbitrary code or establish a reverse shell, leading to unauthorized file writes or control over the victim's station via a crafted file upload operation.
Key phrases: execute arbitrary code, bypass security restrictions, unrestricted upload of file with dangerous type, unauthorized file writes, control over the victims station, file upload
CVE-2023-48034: An issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to both decrypt wireless keystrokes and inject arbitrary keystrokes via use of weak encryption.
Key phrases: inject arbitrary keystrokes, both decrypt wireless keystrokes and inject arbitrary keystrokes, weak encryption
CVE-2023-48039: GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75.
Key phrases: memory leak
CVE-2023-4804: Anunauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed.
Key phrases: accidentally exposed
CVE-2023-48042: Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote attackers to inject arbitrary JavaScript code.
Key phrases: inject arbitrary JavaScript code, cross site scripting (xss)
CVE-2023-48049: A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v. 13.0 through 13.0.1.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the name parameter in controllers/main.py component.
Key phrases: execute arbitrary code, gain privileges, execute arbitrary code and to gain privileges via, sql injection
CVE-2023-4805: The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2023-48050: SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py component.
Key phrases: execute arbitrary code, gain privileges, execute arbitrary code and to gain privileges via, sql injection
CVE-2023-48051: An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding.
Key phrases: decrypt sensitive information via weak encryption padding
CVE-2023-48052: Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
Key phrases: eavesdrop on communications between the host and server, missing ssl certificate validation, man-in-the-middle, man in the middle
CVE-2023-48053: Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
Key phrases: static iv, disclosure of information and communications
CVE-2023-48054: Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
Key phrases: eavesdrop on communications between the host and server, missing ssl certificate validation, man-in-the-middle, man in the middle
CVE-2023-48055: SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. This vulnerability can lead to the disclosure of information and communications.
Key phrases: hardcoded key, disclosure of information and communications
CVE-2023-48056: PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
Key phrases: static iv, disclosure of information and communications
CVE-2023-48058: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run
Key phrases: cross-site request forgery (csrf)
CVE-2023-4806: A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.
Key phrases: application crash
CVE-2023-48060: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add
Key phrases: cross-site request forgery (csrf)
CVE-2023-48063: An issue was discovered in dreamer_cms 4.1.3. There is a CSRF vulnerability that can delete a theme project via /admin/category/delete.
Key phrases: csrf
CVE-2023-48068: DedeCMS v6.2 was discovered to contain a Cross-site Scripting (XSS) vulnerability via spec_add.php.
Key phrases: cross-site scripting (xss)