yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-4154: A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
Key phrases: gain access, access all attributes, design flaw
CVE-2023-41542: SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.
Key phrases: obtain sensitive information, escalate privileges and obtain sensitive information via the, sql injection
CVE-2023-41543: SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.
Key phrases: obtain sensitive information, escalate privileges and obtain sensitive information via the, sql injection
CVE-2023-41544: SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.
Key phrases: execute arbitrary code, execute arbitrary code via crafted HTTP request to, ssti injection
CVE-2023-4155: A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker manages to call the handler multiple times, they can trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations without stack guard pages (`CONFIG_VMAP_STACK`).
Key phrases: double fetch race condition, stack overflow, denial of service, guest-to-host escape
CVE-2023-41552: Tenda AC7 V1.0 V15.03.06.44 and Tenda AC9 V3.0 V15.03.06.42_multi were discovered to contain a stack overflow via parameter ssid at url /goform/fast_setting_wifi_set.
Key phrases: stack overflow
CVE-2023-41553: Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter list at url /goform/SetStaticRouteCfg.
Key phrases: stack overflow
CVE-2023-41554: Tenda AC9 V3.0 V15.03.06.42_multi was discovered to contain a stack overflow via parameter wpapsk_crypto at url /goform/WifiExtraSet.
Key phrases: stack overflow
CVE-2023-41555: Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter security_5g at url /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2023-41556: Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter list at url /goform/SetIpMacBind.
Key phrases: stack overflow
CVE-2023-41557: Tenda AC7 V1.0 V15.03.06.44 and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter entrys and mitInterface at url /goform/addressNat.
Key phrases: stack overflow
CVE-2023-41558: Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter timeZone at url /goform/SetSysTimeCfg.
Key phrases: stack overflow
CVE-2023-41559: Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter page at url /goform/NatStaticSetting.
Key phrases: stack overflow
CVE-2023-4156: A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.
Key phrases: heap out-of-bounds read flaw, crash, sensitive information, out of bounds read
CVE-2023-41560: Tenda AC9 V3.0 V15.03.06.42_multi was discovered to contain a stack overflow via parameter firewallEn at url /goform/SetFirewallCfg.
Key phrases: stack overflow
CVE-2023-41561: Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter startIp and endIp at url /goform/SetPptpServerCfg.
Key phrases: stack overflow
CVE-2023-41562: Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter time at url /goform/PowerSaveSet.
Key phrases: stack overflow
CVE-2023-41563: Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter mac at url /goform/GetParentControlInfo.
Key phrases: stack overflow
CVE-2023-41564: An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted .shtml, arbitrary file upload
CVE-2023-4157: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitHub repository omeka/omeka-s prior to version 4.0.3.
Key phrases: injection
CVE-2023-41570: MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.
Key phrases: incorrect access control mechanisms
CVE-2023-41575: Multiple stored cross-site scripting (XSS) vulnerabilities in /bbdms/sign-up.php of Blood Bank & Donor Management v2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Full Name, Message, or Address parameters.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-41578: Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.
Key phrases: arbitrary file read
CVE-2023-4158: Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.3.
Key phrases: cross-site scripting (xss)
CVE-2023-41580: Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.
Key phrases: enumerate arbitrary fields, enumerate arbitrary fields in the LDAP server and, ldap injection, sensitive data
CVE-2023-41588: A cross-site scripting (XSS) vulnerability in Time to SLA plugin v10.13.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the durationFormat parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-4159: Unrestricted Upload of File with Dangerous Type in GitHub repository omeka/omeka-s prior to 4.0.3.
Key phrases: unrestricted upload, dangerous type
CVE-2023-41592: Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.
Key phrases: cross-site scripting (xss)
CVE-2023-41593: Multiple cross-site scripting (XSS) vulnerabilities in Dairy Farm Shop Management System Using PHP and MySQL v1.1 allow attackers to execute arbitrary web scripts and HTML via a crafted payload injected into the Category and Category Field parameters.
Key phrases: execute arbitrary web scripts, execute arbitrary web scripts and HTML via a, cross-site scripting (xss)
CVE-2023-41594: Dairy Farm Shop Management System Using PHP and MySQL v1.1 was discovered to contain multiple SQL injection vulnerabilities in the Login function via the Username and Password parameters.
Key phrases: sql injection
CVE-2023-41595: An issue in xui-xray v1.8.3 allows attackers to obtain sensitive information via default password.
Key phrases: obtain sensitive information, obtain sensitive information via default password
CVE-2023-41597: EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41599: An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.
Key phrases: execute a directory traversal
CVE-2023-4160: The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.90 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-41601: Multiple cross-site scripting (XSS) vulnerabilities in install/index.php of CSZ CMS v1.3.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Database Username or Database Host parameters.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2023-41603: D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers to arbitrarily access any services running on the device that may be inadvertently listening via IPv6.
Key phrases: arbitrarily access any services running on the device
CVE-2023-41609: An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.
Key phrases: redirect a victim user to an arbitrary web, open redirect
CVE-2023-4161: The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can trick an admin into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2023-41613: EzViz Studio v2.2.0 is vulnerable to DLL hijacking.
Key phrases: dll hijacking
CVE-2023-41614: A stored cross-site scripting (XSS) vulnerability in the Add Animal Details function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description of Animal parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2023-41615: Zoo Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the Admin sign-in page via the username and password fields.
Key phrases: sql injection
CVE-2023-41616: A reflected cross-site scripting (XSS) vulnerability in the Search Student function of Student Management System v1.2.3 and before allows attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload.
Key phrases: execute arbitrary Javascript, execute arbitrary Javascript in the context of a, cross-site scripting (xss), arbitrary javascript
CVE-2023-41618: Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft.
Key phrases: reflective cross-site scripting (xss)
CVE-2023-41619: Emlog Pro v2.1.14 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/article.php?action=write.
Key phrases: cross-site scripting (xss)
CVE-2023-4162: A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command. This could allow an authenticated privileged user local user to crash a Brocade Fabric OS swith using the cli passwdcfg --set -expire -minDiff.
Key phrases: crash a Brocade Fabric OS swith using the, segmentation fault
CVE-2023-41621: A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php.
Key phrases: cross site scripting (xss)
CVE-2023-41623: Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php.
Key phrases: sql injection
CVE-2023-41626: Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.
Key phrases: arbitrary file upload
CVE-2023-41627: O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device.
Key phrases: send forged routing tables to the device
CVE-2023-41628: An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messaging procedure between the E2Node and E2Term components.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2023-41629: A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal.
Key phrases: execute a path traversal
CVE-2023-4163: In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large input to buffers in the portcfgfportbuffers command.
Key phrases: buffer overflow condition, large input to buffers
CVE-2023-41630: eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the Gii code generator component.
Key phrases: remote code execution (rce)
CVE-2023-41631: eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function.
Key phrases: remote code execution (rce), file upload
CVE-2023-41633: Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c.
Key phrases: null pointer dereference
CVE-2023-41635: A XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the filesystem via supplying a crafted XML file.
Key phrases: read any file in the filesystem via supplying, xml external entity (xxe)
CVE-2023-41636: A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38 allows attackers to access the database and execute arbitrary commands via a crafted SQL query.
Key phrases: execute arbitrary commands, access the database and execute arbitrary commands via, sql injection
CVE-2023-41637: An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted HTML file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted HTML, arbitrary file upload
CVE-2023-41638: An arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted file.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a crafted file, arbitrary file upload
CVE-2023-4164: There is a possible informationdisclosure due to a missing permission check. This could lead to localinformation disclosure of health data with no additional executionprivileges needed.
Key phrases: informationdisclosure, missing permission check, localinformation disclosure
CVE-2023-41640: An improper error handling vulnerability in the component ErroreNonGestito.aspx of GruppoSCAI RealGimm 1.1.37p38 allows attackers to obtain sensitive technical information via a crafted SQL query.
Key phrases: obtain sensitive technical information, obtain sensitive technical information via a crafted SQL, improper error handling
CVE-2023-41642: Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter.
Key phrases: execute arbitrary Javascript, execute arbitrary Javascript in the context of a, reflected cross-site scripting (xss), arbitrary javascript
CVE-2023-41646: Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/
Key phrases: obtain the hash of the master password, obtain the hash of the master password for
CVE-2023-41648: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Swapnil V. Patil Login and Logout Redirect.This issue affects Login and Logout Redirect: from n/a through 2.0.3.
Key phrases: url redirection, open redirect
CVE-2023-4165: A vulnerability, which was classified as critical, was found in Tongda OA. This affects an unknown part of the file general/system/seal_manage/iweboffice/delete_seal.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-236181 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: sql injection, disclosure
CVE-2023-41650: Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin <=2.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41652: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 10.6.6.
Key phrases: SQL Injection, sql command, sql injection
CVE-2023-41653: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e  Sermons Online plugin <=1.0.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41654: Cross-Site Request Forgery (CSRF) vulnerability in Andreas Heigl authLdap plugin <=2.5.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41655: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Andreas Heigl authLdap plugin <=2.5.9 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41657: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. HollerBox plugin <=2.3.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41658: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Photo Gallery Slideshow & Masonry Tiled Gallery plugin <=1.0.13 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41659: Cross-Site Request Forgery (CSRF) vulnerability in Jules Colle, BDWM Responsive Gallery Grid plugin <=2.3.10 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-4166: A vulnerability has been found in Tongda OA and classified as critical. This vulnerability affects unknown code of the file general/system/seal_manage/dianju/delete_log.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-236182 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: sql injection, disclosure
CVE-2023-41660: Cross-Site Request Forgery (CSRF) vulnerability in WPSynchro WP Synchro plugin <=1.9.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41661: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <=3.1.35 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41662: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ulf Benjaminsson WP-dTree plugin <=4.4.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41663: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Giovambattista Fazioli WP Bannerize Pro plugin <=1.6.9 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41666: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Stockdio Stock Quotes List plugin <=2.9.9 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41667: Cross-Site Request Forgery (CSRF) vulnerability in Ulf Benjaminsson WP-dTree plugin <=4.4.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41668: Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <=1.1.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41669: Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <=1.06 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-4167: A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic. This issue affects some unknown processing of the file /web/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-236183.
CVE-2023-41670: Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel (in person: Edward Bock) Use Memcached plugin <=1.0.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41672: Cross-Site Request Forgery (CSRF) vulnerability in Rmi Leclercq Hide admin notices  Admin Notification Center plugin <=2.3.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41673: An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests.
Key phrases: read or backup the full system configuration via, cwe-285, improper authorization
CVE-2023-41675: A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated remote attacker to crash the WAD process via multiple crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection.
Key phrases: crash the WAD process via multiple crafted packets, use after free, cwe-416
CVE-2023-41676: An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version  7.0.0 and before 6.7.5 may allow an attacker with access to windows agent logs to obtain the windows agent password via searching through the logs.
Key phrases: obtain the windows agent password, windows agent logs to obtain the windows agent, cwe-200, exposure of sensitive information
CVE-2023-41678: A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.
Key phrases: execute unauthorized code or commands via specifically crafted, double free
CVE-2023-41679: An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least "device management" permission on his profile and belonging to a specific ADOM to add and delete CLI script on other ADOMs
Key phrases: a specific ADOM to add and delete CLI, cwe-284, improper access control
CVE-2023-4168: A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of the component Redirect Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: information disclosure
CVE-2023-41680: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.1 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
Key phrases: execute unauthorized code or commands via crafted HTTP, cross-site scripting, improper neutralization of input during web page generation
CVE-2023-41681: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.1 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
Key phrases: execute unauthorized code or commands via crafted HTTP, cross-site scripting, improper neutralization of input during web page generation
CVE-2023-41682: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 2.5.0 through 2.5.2 and 2.4.1 and 2.4.0 allows attacker to denial of service via crafted http requests.
Key phrases: denial of service via crafted http requests, path traversal
CVE-2023-41684: Cross-Site Request Forgery (CSRF) vulnerability in Felix Welberg SIS Handball plugin <=1.0.45 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41685: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ilGhera Woocommerce Support System allows SQL Injection.This issue affects Woocommerce Support System: from n/a through 1.2.1.
Key phrases: SQL Injection, sql injection
CVE-2023-41687: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Irina Sokolovskaya Goods Catalog plugin <=2.4.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-4169: A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/sys/set_passwd of the component Administrator Password Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-236185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: improper access control, disclosure
CVE-2023-41691: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pensopay WooCommerce PensoPay plugin <=6.3.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41692: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hennessey Digital Attorney theme <=3 theme.
Key phrases: reflected cross-site scripting (xss)
CVE-2023-41693: Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview MyCryptoCheckout plugin <=2.125 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41694: Cross-Site Request Forgery (CSRF) vulnerability in Realbig Team Realbig For WordPress plugin <=1.0.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41697: Cross-Site Request Forgery (CSRF) vulnerability in Nikunj Soni Easy WP Cleaner plugin <=1.9 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41699: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedded: from 5.0.0 before 5.57.0, from 4.1.2.191 before 4.1.2.191.46, from 6.0.0 before 6.8.0, from 6.2023.1 before 6.2023.11.
Key phrases: Libraries, url redirection, open redirect
CVE-2023-4170: A vulnerability was found in DedeBIZ 6.2.10. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Article Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-236186 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: disclosure
CVE-2023-41703: User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.
CVE-2023-41704: Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.
CVE-2023-41705: Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
Key phrases: availability
CVE-2023-41706: Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known.
Key phrases: availability
CVE-2023-41707: Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
Key phrases: availability
CVE-2023-41708: References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.
Key phrases: bypass existing safeguards to inject malicious script code
CVE-2023-4171: A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file \\\\Service\\\\FileDownload.ashx. The manipulation of the argument Files leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-236206 is the identifier assigned to this vulnerability.
Key phrases: path traversal
CVE-2023-41710: User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
CVE-2023-41711: SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash.
Key phrases: post-authentication stack-based buffer overflow, firewall crash
CVE-2023-41712: SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash.
Key phrases: post-authentication stack-based buffer overflow, firewall crash
CVE-2023-41713: SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.
Key phrases: hard-coded password
CVE-2023-41715: SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel.
Key phrases: elevate their privileges inside the tunnel, improper privilege management, elevate privileges
CVE-2023-41717: Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions.
Key phrases: bypass file download/upload restrictions, inappropriate file type control
CVE-2023-41718: When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over a specific file.
Key phrases: gain unauthorized elevated privileges, elevate privileges
CVE-2023-41719: A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a specific web request which may lead to remote code execution.
Key phrases: remote code execution, impersonate
CVE-2023-4172: A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some unknown processing of the file \\\\Service\\\\FileHandler.ashx. The manipulation of the argument FileDirectory leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236207.
Key phrases: absolute path traversal
CVE-2023-41720: A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker with a foothold on an Ivanti Connect Secure (ICS) appliance can escalate their privileges by exploiting a vulnerable installed application. This vulnerability allows the attacker to gain elevated execution privileges on the affected system.
Key phrases: gain elevated execution, gain elevated execution privileges on the affected system, escalate privilege
CVE-2023-41721: Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.Affected Products:UDMUDM-PROUDM-SEUDRUDW Mitigation:Update UniFi Network to Version 7.5.187 or later.
Key phrases: improper access control logic, risk of access to device configuration information
CVE-2023-41723: A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability is reduced because the user with the Read-Only role is only able to view the schedule and cannot make changes.
Key phrases: view the Dashboard Schedule, criticality
CVE-2023-41724: A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. 
Key phrases: execute arbitrary commands, execute arbitrary commands on the underlying operating system, command injection
CVE-2023-41725: Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability
Key phrases: unrestricted file upload, local privilege escalation
CVE-2023-41726: Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability
Key phrases: Local Privilege Escalation Vulnerability, local privilege escalation
CVE-2023-41727: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
Key phrases: Denial of Service (DoS), memory corruption, denial of service (dos), code execution
CVE-2023-41728: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rescue Themes Rescue Shortcodes plugin <=2.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41729: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <=1.22.3.31 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-4173: A vulnerability, which was classified as problematic, was found in mooSocial mooStore 3.1.6. Affected is an unknown function of the file /search/index. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236208.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-41730: Cross-Site Request Forgery (CSRF) vulnerability in SendPress Newsletters plugin <=1.22.3.31 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41731: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress publish post email notification plugin <=1.0.2.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41732: Cross-Site Request Forgery (CSRF) vulnerability in CodePeople CP Blocks plugin <=1.0.20 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2023-41733: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilityin YYDevelopment Back To The Top Button plugin <=2.1.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41734: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nigauri Insert Estimated Reading Time plugin <=1.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41735: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email posts to subscribers.This issue affects Email posts to subscribers: from n/a through 6.2.
Key phrases: exposure of sensitive information
CVE-2023-41736: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Email posts to subscribers plugin <=6.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41737: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGens Swifty Bar, sticky bar by WPGens plugin <=1.2.10 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2023-41738: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
Key phrases: execute arbitrary commands, execute arbitrary commands via unspecified vectors, os command injection
CVE-2023-41739: Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to conduct denial-of-service attacks via unspecified vectors.
Key phrases: conduct denial-of-service attacks via, uncontrolled resource consumption, unspecified vectors, denial of service
CVE-2023-4174: A vulnerability has been found in mooSocial mooStore 3.1.6 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The identifier VDB-236209 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-41740: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to read specific files via unspecified vectors.
Key phrases: read specific files via unspecified vectors, path traversal
CVE-2023-41741: Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to obtain sensitive information via unspecified vectors.
Key phrases: obtain sensitive information, obtain sensitive information via unspecified vectors, exposure of sensitive information
CVE-2023-41742: Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
Key phrases: attack surface
CVE-2023-41743: Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Agent (Windows) before build 31637, Acronis Cyber Protect 15 (Windows) before build 35979.
Key phrases: local privilege escalation, insecure driver communication port permissions
CVE-2023-41744: Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Agent (macOS) before build 30600, Acronis Cyber Protect 15 (macOS) before build 35979.
Key phrases: local privilege escalation
CVE-2023-41745: Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30991, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
Key phrases: sensitive information disclosure, excessive collection of system information
CVE-2023-41746: Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.
Key phrases: remote command execution, improper input validation
CVE-2023-41747: Sensitive information disclosure due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.
Key phrases: sensitive information disclosure, improper input validation
CVE-2023-41748: Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.
Key phrases: remote command execution, improper input validation
CVE-2023-41749: Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Windows) before build 32047, Acronis Cyber Protect 15 (Windows) before build 35979.
Key phrases: sensitive information disclosure, excessive collection of system information
CVE-2023-4175: A vulnerability was found in mooSocial mooTravel 3.1.8 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. VDB-236210 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-41750: Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 32047.
Key phrases: sensitive information disclosure, missing authorization
CVE-2023-41751: Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acronis Agent (Windows) before build 32047.
Key phrases: sensitive information disclosure, improper token expiration validation
CVE-2023-41752: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2.Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.
Key phrases: exposure of sensitive information
CVE-2023-4176: A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file appointmentapproval.php. The manipulation of the argument time leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236211.
Key phrases: sql injection
CVE-2023-41763: Skype for Business Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-41764: Microsoft Office Spoofing Vulnerability
Key phrases: microsoft office spoofing
CVE-2023-41765: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: layer tunneling protocol remote code execution
CVE-2023-41766: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-41767: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: layer tunneling protocol remote code execution
CVE-2023-41768: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: layer tunneling protocol remote code execution
CVE-2023-41769: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: layer tunneling protocol remote code execution
CVE-2023-4177: A vulnerability was found in EmpowerID up to 7.205.0.0. It has been rated as problematic. This issue affects some unknown processing of the component Multi-Factor Authentication Code Handler. The manipulation leads to information disclosure. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 7.205.0.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-236213 was assigned to this vulnerability.
Key phrases: information disclosure
CVE-2023-41770: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: layer tunneling protocol remote code execution
CVE-2023-41771: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: layer tunneling protocol remote code execution
CVE-2023-41772: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2023-41773: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: layer tunneling protocol remote code execution
CVE-2023-41774: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: layer tunneling protocol remote code execution
CVE-2023-41775: Improper access control vulnerability in 'direct' Desktop App for macOS ver 2.6.0 and earlier allows a local attacker to bypass access restriction and to use camrea, microphone, etc. of the device where the product is installed without the user's consent.
Key phrases: bypass access restriction, bypass access restriction and to use camrea, improper access control
CVE-2023-41776: There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges.
Key phrases: local privilege escalation
CVE-2023-41779: There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed.
Key phrases: illegal memory access, crashed
CVE-2023-4178: Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass.This issue affects Neutron Smart VMS: before b1130.1.0.1.
Key phrases: Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass, authentication bypass by spoofing